Privacy & GDPR

Last updated 24 October 2026

This policy explains what personal information we collect, why we use it, who we share it with, how long we keep it and the rights you have. We are a business-to-business supplier, so most of the information we hold is business contact information about the people we deal with at our customers and suppliers.

1. Who we are

Duggan Group Ltd is the “controller” of your personal information. We are registered in England and Wales (company no. 12538672), our registered office is 7 Bryngolwg, Croespenmaen, Caerphilly, Wales, NP11 3AJ, and we are registered with the Information Commissioner’s Office (ICO) under reference ZB873256.

For anything about your information, email [email protected] or call 02922 520395.

2. What we collect

• When you ask for a quote (our quote basket or “Can’t find it?” form): your name, company, work email, phone number, company website, the products and options you choose, your message, any logo or artwork you upload, and whether you’d like to hear about offers. We also record the internet (IP) address the request came from, to stop spam and misuse.
• When you become a customer: the contact details of the people we deal with, billing and delivery addresses, purchase order references, your quotes, orders, proofs, invoices and payment status, and the emails we exchange with you.
• Card payments are handled by Stripe. We never see or store your full card details.
• Business contacts we’d like to work with: names, job titles and work contact details of people at businesses that may want our products. These come from reputable business data providers that collect and supply them in line with UK data protection law, or are given to us directly.
• When you browse our website: our hosting provider, Cloudflare, processes technical information such as your IP address and browser type to deliver the site and protect it from attacks. Our visitor statistics don’t use cookies and don’t identify you. See our cookie policy.

3. Why we use it, and our lawful basis

• To quote, take and deliver your order: proofs, production, delivery, invoices and after-sales help. Lawful basis: to take steps towards, and carry out, a contract with you or your organisation.
• To keep accounting and tax records. Lawful basis: legal obligation.
• To check enquiries (for example, spotting spam or misuse) and to keep our systems secure, including backups. Lawful basis: legitimate interests in running a safe, reliable business.
• To send marketing emails to business contacts about our products and offers. Lawful basis: legitimate interests in promoting our business to other businesses. We have carried out a legitimate interests assessment, which we keep on file. Every marketing email has an unsubscribe link, and we never email anyone again once they’ve unsubscribed. If you tick “Keep me updated” on our forms, we also have your consent.

4. Who we share it with

We only share what each party needs to do their job, and we never sell your information. The people and services we work with are:

• Our suppliers and print rooms, who receive your artwork and delivery details to make and send your order.
• Couriers, who receive your delivery name, address and phone number.
• Our bookkeeper, who can see our invoices and the details on them, including delivery addresses.
• Stripe, for card payments.
• Xero and Hubdoc, our accounting software.
• Google Workspace, for our email.
• Supabase, which hosts our customer database in the EU (Ireland).
• Cloudflare, which hosts our website, runs the security check on our forms and stores our encrypted backups.
• GitHub, which runs our automated, encrypted nightly backups.

We may also share information if the law requires it, or to protect our rights, for example in a dispute about an order.

5. Transfers outside the UK

Some of the services above are based in, or may process information in, the European Union or the United States. Where information leaves the UK, it is protected by the safeguards UK law requires, such as UK adequacy regulations (which cover the EU), the UK Extension to the EU–US Data Privacy Framework, or the UK’s approved data transfer agreements.

6. How long we keep it

• Quotes, orders and invoices: 6 years after the end of the financial year they relate to, as required for tax purposes.
• Website enquiries: 2 years if they didn’t lead to a quote, then deleted automatically along with any logo you sent. Enquiries that led to a quote are kept with the quote for 6 years.
• Email history stored in our customer system: 12 months.
• Unsubscribe requests: kept for as long as we send marketing emails, so that we never contact you again by mistake.
• Backups: database backups are kept for about a month and then deleted automatically. Backup copies of uploaded files (such as artwork, proofs and invoices) are kept for 12 months, so that anything deleted by mistake can be recovered.

7. Keeping it safe

Access to our systems is limited to the people who need it and protected by two-factor sign-in. Information is sent over encrypted connections, uploaded artwork is stored privately, and our backups are encrypted.

8. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete your information, where we don’t need to keep it;
• ask us to restrict how we use it, or object to us using it;
• object to marketing at any time, which we will always respect; and
• ask for information you gave us in a format you can take elsewhere.

To use any of these rights, email [email protected]. We’ll reply within one month. There’s normally no charge.

9. Complaints

If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

10. Changes to this policy

We’ll update this policy if the way we use information changes. The date at the top shows when it was last updated.