This policy explains what 16OXY collects when you browse, personalise a product or place an order, why we collect it, who we pass it to, and what you can ask us to do about it.
POD Store operates this store and is the controller of the personal data described here. We make printed goods to order: nothing in our catalogue exists until someone buys it, which shapes most of what follows — in particular that your design files and personalisation text have to reach a production partner before you can receive anything.
If you want to reach us about anything in this policy, the details are in section 15.
We collect only what an order or an account actually needs. Nothing on this list is optional decoration; if we ask for it, something breaks without it.
We do not ask for, and have no use for, your date of birth, government identity numbers, health data, or anything else in the special categories under data-protection law. If you type such information into a personalisation field, you are choosing to send it to us and to the production partner who prints it.
This is the section most privacy policies do not have, and the one that matters most in print-on-demand.
If you are in the UK, EEA or another region with equivalent law, these are the grounds we rely on:
| Purpose | Legal basis |
|---|---|
| Producing and delivering your order | Performance of a contract |
| Account creation and sign-in | Performance of a contract |
| Tax, accounting and customs records | Legal obligation |
| Fraud prevention and site security | Legitimate interests |
| Analytics and advertising cookies | Consent |
| Marketing email | Consent |
Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interests you can object — see section 11.
We never see your full card number. Card details are entered into a form served by the payment provider and travel directly to them; they do not pass through, and are not stored on, our servers. What comes back to us is a confirmation, the last four digits and the card brand — enough to show you which card paid for which order and to issue a refund.
Our payment providers are independently certified to the PCI-DSS standard and act as controllers of the card data they hold, under their own privacy policies. Where an order is paid on delivery or by bank transfer, no card data exists at all — we hold only the payment reference and its status.
Print-on-demand is a distributed business: the partner who prints your order is usually the one nearest to your delivery address, so your data may be processed in a country other than your own — including outside the UK or EEA.
Where that happens we rely on an adequacy decision covering the destination, or on Standard Contractual Clauses with the recipient, and we pass on only the fields needed to produce and deliver the order.
| Data | Kept for |
|---|---|
| Order and invoice records | As long as tax and accounting law requires, typically 5–10 years |
| Artwork and personalisation files | While your account is open, so you can reorder; deleted on request |
| Account details | Until you close the account |
| Support conversations | Up to 3 years after the conversation ends |
| Marketing consent records | Until you unsubscribe, plus proof of the opt-out |
| Analytics data | Up to 26 months, in aggregated form |
When a retention period ends the data is deleted or irreversibly anonymised. Records we are legally required to keep — an invoice, for example — survive an account deletion request, because the law requiring them outranks the request.
Depending on where you live, you can ask us to:
Email us and we will answer within 30 days. There is no fee. We may ask you to confirm your identity first — usually by writing from the address on the order — because handing an account over to whoever asks would be the larger privacy failure. If you are unhappy with our answer you can complain to your local data-protection authority.
No system is perfectly secure. If a breach ever affects your data and poses a real risk to you, we will tell you and the relevant regulator without undue delay.
This store is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
We update this page when what we do with data changes. The date under the title always reflects the current version. If a change materially affects your rights we will tell you by email or a notice on the store before it takes effect, rather than relying on you to re-read the page.
Questions about this policy, or a request about your data, go to:
