Privacy Policy
This policy explains how we collect, use, store and protect your personal data when you visit mailplate.co.uk, buy our guides and templates, book our email set-up service, or contact us. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
The data controller is the UK sole trader who owns and runs Mailplate ("we", "us", "our"). Our full business name appears on every receipt and invoice, and we will give it to you on request.
- Email: hello@mailplate.co.uk
- Postal address: [business postal address]
- ICO registration number: [number, or delete this line if exempt]
We have not appointed a Data Protection Officer, because the law doesn't require one for a business of our size. Please send any privacy question to the email address above.
2. Data we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, phone number (only if you give it) | You, when you buy, book or contact us |
| Order and payment | Products bought, price, date, order number, billing country | Our sales platforms (Payhip, Etsy, Gumroad) and payment providers |
| Service details | Business name, domain name, the addresses you want, and domain registration details (name, postal address, phone) | You, by email |
| Communications | Emails and messages between us | You |
| Marketing preferences | Whether you have signed up for or unsubscribed from our emails | You |
| Technical | IP address, browser type, pages visited, server logs | Your device, through our website host |
We never receive or store your full card details. Our payment providers process payments directly.
We don't ask for special category data, such as health information. Please don't send it to us.
3. How and why we use your data
The law requires a lawful basis for each use of your data. Ours are:
| Purpose | Lawful basis |
|---|---|
| Delivering your digital download and sending updated editions | Contract |
| Quoting for, building and handing over your email set-up, and registering your domain | Contract |
| Answering your questions and giving support | Contract, or legitimate interests if you are not yet a customer |
| Keeping financial records for HMRC | Legal obligation |
| Sending marketing emails | Consent, or the "soft opt-in" for existing customers (see section 5) |
| Keeping our website secure and working | Legitimate interests |
| Handling complaints, refunds and legal claims | Legitimate interests and legal obligation |
Where we rely on legitimate interests, we have checked that our interests don't override your rights. You can ask us for details of that check.
We make no decisions about you by automated means alone, and we don't use profiling that has a legal or similarly significant effect on you.
4. The done-for-you service
To build your email, we need a few extra details. We use them only for your order:
- Domain registration details: your name, postal address, email and phone number. The law requires these to register a domain in your name. We pass them to the domain registrar (for example Namecheap) and, for .uk domains, they are held by Nominet, the .uk registry.
- Passwords: we create a temporary password and send it through a one-time secure link, never by email. You change it straight away, and we delete it from our notes as soon as the handover is complete.
- After the job we keep brief notes only (your domain, the method used and the DNS records we added), so we can help if something stops working.
5. Marketing emails
We send marketing emails only if:
- you have given consent, for example by downloading our free cheat sheet; or
- you have bought from us and we are telling you about similar products or services. Each email gives you the chance to opt out.
Each email has an unsubscribe link. You can also email us to unsubscribe. We never sell your data or give it to other businesses for their own marketing.
6. Who we share your data with
We share data only where necessary, with the service providers below. They act as our processors and must follow our instructions and keep your data secure.
| Provider | What they do for us |
|---|---|
| Proton AG (Switzerland) | Business email |
| Payhip | Online shop, digital downloads and customer emails |
| Stripe and PayPal | Payment processing |
| Namecheap (and Nominet for .uk domains) | Registering your domain in your name |
| Cloudflare, Inc. (Cloudflare Pages) | Website hosting |
Marketplaces. If you buy through Etsy or Gumroad, that platform is a separate controller of your data, and its own privacy policy applies. It gives us only what we need to deliver your order.
Other disclosures. We may also share data with our accountant, with HMRC, or where the law requires it. If we ever sell or transfer the business, your data may pass to the new owner under the same protections.
7. Transfers outside the UK
Some of our providers store or process data outside the UK, including in the United States and the European Economic Area. When they do, we make sure one of these safeguards applies:
- a UK "adequacy" decision, such as the one covering the EEA;
- the UK Extension to the EU-US Data Privacy Framework, for certified US companies; or
- the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for details of the safeguard that applies to a particular provider.
8. How long we keep your data
| Data | How long we keep it |
|---|---|
| Order, payment and invoice records | 6 years from the end of the tax year of the sale, for HMRC |
| Set-up notes | 12 months after handover. Temporary passwords are deleted at handover. |
| Enquiries from people who don't buy | 12 months after our last message |
| Marketing list | Until you unsubscribe. After that we keep your email address on a "do not contact" list so we don't email you again. |
| Website server logs | As set by our host, usually no more than 30 days |
When the period ends, we delete the data or make it anonymous.
9. Security
We protect your data with these measures:
- two-factor authentication on each business account;
- encrypted connections (HTTPS/TLS);
- access limited to the business owner;
- devices protected with passwords and encryption.
If a data breach is likely to put your rights at risk, we will report it to the Information Commissioner's Office (ICO) within 72 hours. If the risk to you is high, we will also tell you without delay.
10. Your rights
Under UK data protection law you have the right to:
- access your data and get a copy of it;
- correct data that is wrong or incomplete;
- erase your data, where there is no legal reason for us to keep it;
- restrict how we use your data;
- object to our use of your data where we rely on legitimate interests, and at any time to direct marketing;
- data portability, which means receiving the data you gave us in a common digital format;
- withdraw consent at any time, where consent is our lawful basis. This doesn't affect anything we did before you withdrew it.
To use any of these rights, email hello@mailplate.co.uk. We will reply within one month. This is free in most cases. We may ask you to confirm your identity before we act on your request.
11. Cookies
Our website uses only the cookies it needs to work, so we don't show a cookie banner. Our shop and payment pages, run by Payhip, Stripe and PayPal, may set their own cookies. Their policies explain what those cookies do.
If we add analytics or advertising cookies later, we will ask for your consent first and update this section.
12. Complaints
If you are unhappy with how we have handled your data, please email us first. We will acknowledge your complaint within 30 days and tell you what we are doing about it.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
13. Changes to this policy
We will update this policy when our services or the law change. The date at the top shows when we last changed it. If a change affects how we use data you have already given us, we will tell you by email.
Children
Our products and services are meant for adults. We don't knowingly collect data from anyone under 18.