Privacy Policy

Your commercial confidentiality and personal data are safe with QPack. This Privacy Policy outlines how QPACK - CUSTOM PACKAGING LTD (“QPack”, “we”, “us”, or “our”) processes, protects, and handles personal data and confidential commercial assets under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR).

1. Data Controller Identification & UK GDPR Compliance

QPACK - CUSTOM PACKAGING LTD operates as the Data Controller responsible for your personal data and commercial information. We are registered in England and Wales under Company Number 13155258, with registered offices at 128 City Road, London, EC1V 2NX, United Kingdom.

For any inquiries regarding data protection, commercial confidentiality, or exercising your statutory rights, you may contact our appointed Data Protection Lead directly via email at privacy@qpack.co.uk or by telephone at 020 8090 4242.

2. Protection of Client Artwork, CAD Files & Proprietary Trade Secrets

As a specialist packaging manufacturer, we understand that your vector artwork, structural CAD dielines, unreleased product branding, barcode structures, and custom packaging designs represent vital commercial trade secrets and proprietary intellectual property. We provide an ironclad commercial commitment to safeguarding these assets:

• Strict Commercial Non-Disclosure: We treat all vector files (AI, PDF, EPS), 3D renders, CAD dielines, and unreleased packaging graphics as confidential commercial trade secrets.
• Zero Commercial Monetization: QPack NEVER sells, leases, rents, trades, or licenses your packaging artwork, brand assets, or customer contact details to third-party marketing companies, competitor packaging suppliers, or external agencies.
• Isolated Pre-Press Server Security: Client artwork files are stored on isolated, encrypted pre-press file servers. Access is strictly restricted to certified pre-press technicians and machine operators solely for the operational purposes of plate-making, proof generation, and production printing.
• Confidential Pre-Launch Protection: We recognize that many custom packaging projects support unreleased products or confidential seasonal marketing campaigns. We will never publicly display, photograph, or distribute packaging samples of your project in our public portfolio or marketing materials prior to your product’s public commercial market launch without your express prior written consent.

3. Lawful Bases for Processing Data (Article 6 UK GDPR)

We process your personal and commercial data strictly in accordance with lawful bases set out in Article 6 of the UK GDPR:

• Contractual Necessity (Article 6(1)(b)): Processing necessary to prepare trade quotations, generate 2D/3D digital proofs, manufacture custom packaging orders, process billing, coordinate delivery logistics, and provide customer support.
• Legal & Statutory Obligation (Article 6(1)(c)): Retaining transaction invoices, VAT records, customs records, and commercial billing documentation in compliance with HM Revenue & Customs (HMRC), the Companies Act 2006, and UK tax laws.
• Legitimate Commercial Interests (Article 6(1)(f)): Processing necessary for web server security, firewall monitoring, bot prevention, fraud detection, quality control auditing, improving factory conversion workflows, and maintaining necessary commercial account communications.
• Explicit Consent (Article 6(1)(a)): Where you explicitly subscribe to our trade packaging newsletter, new material announcements, or accept optional analytical cookies. You may revoke consent at any time.

4. Categories of Data We Collect

We collect and process only the minimum necessary data required to deliver high-quality packaging and secure commercial transactions:

• Identity & Contact Data: Contact name, business trading name, registered company number, VAT number, commercial delivery and billing addresses, business email addresses, and direct telephone numbers.
• Transaction & Billing Data: Order reference history, quotation requests, invoice amounts, payment confirmation tokens, and delivery proofs of receipt. All electronic card payments are processed securely via PCI-DSS Level 1 compliant payment gateways; QPack never stores raw credit or debit card numbers on its servers.
• Pre-Press & Production Data: Digital artwork files, vector paths, corporate colour standards (Pantone spot codes), font outlines, CAD dieline dimensions, structural packaging specifications, and proof sign-off timestamps.
• Technical & Telemetry Data: IP address, browser type and version, operating system, session timestamps, and encrypted TLS handshake telemetry to ensure secure web transmission and protect against automated denial-of-service attempts.

5. Authorized Third-Party Sub-Processors & Logistics Carriers

To fulfill custom manufacturing and delivery, we share data only with trusted third-party service providers who are contractually bound by Data Processing Agreements meeting the rigorous requirements of Article 28 UK GDPR:

• Logistics & Courier Carriers: Nominated carriers (including DPD UK, Royal Mail, DHL Express, and Palletforce) receive delivery recipient names, site delivery addresses, and driver contact telephone numbers solely for transit execution and delivery tracking notifications.
• Payment Gateways: PCI-DSS Level 1 accredited financial institutions (including Stripe UK and PayPal) process financial transactions via encrypted API endpoints.
• IT & Cloud Infrastructure: ISO 27001 certified UK and EU data centres providing encrypted cloud storage, firewall security, and transactional email routing.

6. International Data Transfers & Cross-Border Safeguards

All primary production databases, invoice ledgers, and artwork servers are located securely within the United Kingdom. Where any secondary technical service requires data transfer outside the UK or European Economic Area (EEA), such transfers are governed by UK International Data Transfer Agreements (IDTAs) or European Commission Standard Contractual Clauses (SCCs), backed by mandatory technical encryption (AES-256) to ensure the equivalent level of protection mandated by UK law.

7. Data Retention Schedules & Automated Pruning

We retain personal and commercial data only for as long as strictly necessary to fulfill the operational, commercial, and legal purposes for which it was collected:

• Tax & Accounting Records: VAT invoices, payment receipts, and commercial purchase orders are retained for six (6) full financial years following the end of the relevant tax year, in compliance with HMRC statutory obligations.
• Pre-Press Artwork & Dieline Archives: Client vector files, dielines, and approved proofs are retained for three (3) years from the date of the last completed order to enable seamless repeat manufacturing runs without re-originating setup fees. Files may be purged earlier upon written client request, subject to contract completion.
• Unconverted Quote Inquiries: Inquiries and quote requests that do not proceed to an order are retained for twenty-four (24) months to support price referencing and customer service continuity before being securely sanitized.

8. Cookies, Tracking Technologies & Consent Management

Our website utilizes cookies and similar web storage technologies to guarantee seamless functionality, cart persistence, and security:

• Strictly Necessary Cookies: Essential for website navigation, user session integrity, CSRF security tokens, and sample basket functionality. These cookies cannot be switched off in our systems.
• Analytical & Performance Cookies: Used on an aggregated, pseudonymized basis to understand site speed, page navigation flows, and server load balancing. These cookies do not identify individuals and are activated only upon your informed cookie consent.
• Consent Controls: You can manage, modify, or withdraw your cookie preferences at any time through our interactive on-site cookie controls or directly via your web browser settings.

9. Your Statutory Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you possess comprehensive statutory rights regarding your personal data:

• Right of Access: You may request a formal copy of the personal data we hold about you (Subject Access Request).
• Right to Rectification: You have the right to request correction of inaccurate, outdated, or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You may request the deletion of your personal data where there is no overriding statutory requirement (such as HMRC financial audit rules) for us to retain it.
• Right to Restriction of Processing: You may request that we suspend the processing of personal data in certain circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to the processing of your personal data where we rely on legitimate interests as our lawful basis.

We process all verifiable data subject requests within one (1) calendar month free of charge, in accordance with statutory requirements.

10. Information Security & Data Breach Protocols

QPack employs enterprise-grade technical and organizational safeguards to protect your personal information and commercial artwork against unauthorized access, alteration, disclosure, or accidental destruction. These measures include TLS 1.3 encryption across all web sessions, multi-factor authentication for administrative access, isolated VLAN network segmentation for pre-press servers, and continuous perimeter monitoring.

In the unlikely event of a confirmed personal data breach presenting a risk to client rights, QPack will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where required by law.

11. Supervisory Authority & Complaints

If you have questions, concerns, or complaints regarding how QPack handles your personal data, we invite you to contact our Data Protection Lead in the first instance at privacy@qpack.co.uk. We are committed to resolving your concerns promptly and thoroughly.

You also retain the legal right to lodge a formal complaint with the UK supervisory authority for data protection: