InformationPrivacy policy
Privacy policy
Last updated: 14 November 2026
This policy explains what personal information we collect when you use artwork.uk or buy from us, why we collect it, who we share it with, how long we keep it and the rights you have over it. We only collect what we need to run the shop, and we never sell your information.
In short
- We use your details to take, make and deliver your orders, run your account and keep it secure.
- We never see or store your card details. Payments are handled by Stripe or PayPal.
- We only send you news and offers if you ask for them, and you can stop them at any time.
- Our website uses no advertising or tracking cookies, and no analytics.
- You can ask to see, correct or delete your information at any time.
1. Who we are
artwork.uk is a trading name of Rocketry Ltd, a company registered in England and Wales (company number 15297535), whose registered office is at Unit 12B, Devonshire Road Industrial Estate, Millom, Cumbria, LA18 4JS.
Rocketry Ltd is the "controller" of your personal information, which means we decide how it is used and are responsible for looking after it under UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations).
If you have any questions about this policy or your information, please contact us using the details on our Contact us page.
2. The information we collect
Information you give us
- Your account: your name, email address, password and, if you give it, your phone number. Your password is stored only as a one-way scrambled code (a "hash"), so nobody, including us, can read it.
- Your address book: the delivery and billing addresses you save, including any company name, phone number, access codes and delivery notes you add for the courier.
- Your orders: what you bought, prices, delivery choices, payment method and payment status, and any notes you add.
- Made to order and personalised pieces: any wording, sizes, images, logos or designs you send us, and the proofs we agree with you.
- Messages: anything you send us by email, phone or through our website, and our replies.
- Your choices: which emails you want from us, the language you use the site in, the currency you choose and any pieces you ask us to tell you about when they are back in stock.
Information we collect when you use the website
- Security information: the date and time you sign in, your IP address and browser type, failed sign-in attempts and the devices you have signed in on. We use this to keep your account safe.
- Address search: what you type into the address search when you add an address.
- Server logs: like every website, our servers record each page request, with the IP address, browser type and time.
Information from other people
- Payment providers: Stripe and PayPal tell us whether a payment succeeded, the amount, the payment type and, for cards, the last four digits and expiry date. We never receive your full card number or security code.
- Google: if you choose to sign in with Google, Google tells us your name, email address and an account number that identifies your Google account to us. We do not receive your Google password.
- Couriers: delivery updates for your parcels.
3. How we use your information
The law says we must have a lawful reason (a "lawful basis") for each way we use your information. These are ours:
| What we use it for | Our lawful basis |
|---|---|
| Creating and running your account, including signing in with Google if you choose to | Contract: you asked us to set up your account |
| Taking payment, making and delivering your order, and dealing with cancellations, returns, refunds and repairs | Contract: we need it to do what you asked |
| Sending order confirmations, dispatch updates and replies to your messages | Contract |
| Keeping order, invoice and payment records | Legal obligation: tax and company law require us to |
| Keeping your account and our shop secure, including sign-in checks on new devices, records of sign-ins and preventing fraud | Legitimate interests: protecting you and us from fraud and misuse |
| Checking addresses with our address search so your order goes to the right place | Legitimate interests: accurate deliveries |
| Telling you when something you asked us to watch is back in stock, or news about your pre-orders | Consent: you asked us to, and you can turn these off |
| Sending you news and offers | Consent: only if you turn them on |
| Dealing with complaints and legal claims | Legitimate interests: resolving disputes and defending our legal rights |
Where we rely on legitimate interests, we have weighed them against your rights and only use your information in ways you would reasonably expect. We do not make any decisions about you using purely automated processing. Stripe and PayPal may run their own automated fraud checks on payments, as their privacy notices explain.
4. The emails we send
- Always sent: order confirmations, dispatch updates, and important messages about your password and account security.
- Your choice: account changes, back in stock alerts and pre-order news are switched on to start with, and you can turn them off.
- Only if you ask: news and offers are switched off until you turn them on.
You can change these at any time in the Notifications section of your account, and every news email has a link to unsubscribe.
5. Who we share your information with
We only share what each one needs to do its job. The companies that work for us may only use your information on our instructions.
| Who | Why |
|---|---|
| Stripe and PayPal | To take your payment and handle refunds. They are responsible for the information you give them, under their own privacy notices. |
| Couriers and postal services | To deliver your order. They receive your name, delivery address, phone number and, for tracking updates, your email address. |
| To send our emails, to look up addresses when you use the address search, and to sign you in if you choose Google sign-in. | |
| Amazon Web Services | To deliver our website to you quickly and securely. |
| Our bank | When you pay or are refunded by bank transfer. |
| Professional advisers | Our accountants, insurers and lawyers, where they need it to advise us. |
| HMRC, the police, courts and regulators | Only when the law requires us to, or to prevent fraud or crime. |
If Rocketry Ltd or this shop were ever sold, your information would pass to the new owner, who would have to look after it in line with this policy.
6. One account for all our shops
Rocketry Ltd runs more than one online shop. Your account works on all of them, so if you have already registered with one of our shops, you can sign in to the others with the same details. Your account details and address book are shared between our shops, and your email choices can be set for each shop separately.
7. Information sent outside the UK
Some of the companies we use, such as Stripe, PayPal, Google and Amazon Web Services, may process information outside the UK, including in the European Economic Area and the United States. When they do, it is protected in one of the ways UK law allows: the country is approved by the UK government as having adequate protection (including the UK-US data bridge), or the company has signed the contract terms approved by the Information Commissioner's Office.
8. How long we keep your information
| Information | How long we keep it |
|---|---|
| Your account and address book | Until you ask us to close your account |
| Orders, invoices and payment records | 6 years after the end of the financial year of the order, as tax law requires |
| Designs, images and wording for made to order pieces | 12 months after your piece is delivered, unless you ask us to keep them for a repeat order |
| Messages with us | 2 years after we last hear from you, or longer if they are part of an order record |
| Sign-in and security records | 12 months |
| Signed-in sessions | Removed 90 days after your last visit, or straight away when you log out |
| Remembered devices | Until you remove them on your account's Security page, or after 400 days |
| Server logs | Up to 3 months |
| Your email choices | Until you change them. If you unsubscribe, we keep a note of that so we do not email you again. |
When we no longer need information, we delete it or make it anonymous.
9. How we keep your information safe
- Our whole website is served over an encrypted (HTTPS) connection.
- Passwords are stored as one-way hashes, never as readable text.
- When you sign in on a device we have not seen before, we ask for a code from your authenticator app, or one we send to your email address, before letting you in.
- Our staff can only reach customer information through accounts protected by a second sign-in step, and only see what they need for their work.
- Card payments are handled entirely by Stripe and PayPal, so card details never reach our systems.
If something ever goes wrong that puts your information at risk, we will tell you and the Information Commissioner's Office where the law requires us to.
10. Your rights
You have the right to:
- see the information we hold about you and get a copy of it;
- correct anything that is wrong or incomplete;
- delete your information, unless we still need it, for example for an order we have to keep records of;
- restrict how we use your information while a concern is looked into;
- object to us using your information on the basis of our legitimate interests, and to stop news and offers at any time;
- move the information you gave us to another organisation, in a common computer format;
- withdraw your consent at any time, where we rely on it. This does not affect anything we did before you withdrew it.
You can update most of your details yourself in your account. For anything else, contact us using the details on our Contact us page. There is no charge, and we will reply within one month. If a request is complicated, we may need up to two more months, and we will tell you if so. We may ask you to confirm who you are before we act on a request, to protect your information.
11. Complaints
If you are unhappy with how we have handled your information, please tell us first using the details on our Contact us page. We will acknowledge your complaint within 30 days, look into it and let you know the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
12. Children
Our shop is not aimed at children, and we do not knowingly collect information about anyone under 13. If you think a child has given us their information, please contact us and we will delete it.
13. Cookies
We only use the cookies our website needs to work and to remember your choices. Our Cookie policy lists every one of them.
14. Changes to this policy
We will update this policy when the way we use your information changes, and change the date at the top. If a change affects you significantly, we will tell you by email before it happens.