Privacy Policy

At Kate & Lane Paper Co. we are committed to protecting your privacy and handling your personal data responsibly. This policy explains what information we collect, why we collect it, how we use it, and your rights under UK data protection law.

This policy applies to personal data collected through our website (kateandlane.co.uk) and in the course of providing our services.

Kate & Lane Paper Co. is the data controller or data processor for the personal data you provide to us. This means we may be responsible for deciding how and why your personal data is used.

Contact us about this policy or your data: Email: privacy@kateandlane.co.uk

1 Who we are

We collect and process the following categories of personal data:

From you directly:

Contact details: your name, email address, and postal address
Event details: wedding date, venue name, and any personalisation information (such as names, timings, and wording) needed to produce your stationery
Guest data: names and addresses you provide for our guest-addressing service, typically submitted via a spreadsheet template

From your use of our website:

Technical data: IP address, browser type, and pages visited, collected automatically via cookies and analytics tools (see Section 9 on Cookies)

We do not collect sensitive personal data (such as health information or religious beliefs). We do not store your payment card details; these are handled entirely by our third-party payment processor.

2 The Personal Data We Collect

The table below sets out each processing activity, the personal data involved, and the lawful basis we rely on under UK GDPR.

3 How and Why We Use Your Data

  
        Purpose
        Personal data used
        Lawful basis
      
        Fulfilling your order (design, typesetting, printing, and dispatch)
        Name, address, event details
        Contract – processing is necessary to perform the contract with you (Art. 6(1)(b))
      
        Communicating with you about your order, proofs, and queries
        Name, email address
        Contract – necessary to perform the contract (Art. 6(1)(b))
      
        Guest-addressing service
        Guest names and addresses
        Contract – necessary to perform the service you have requested (Art. 6(1)(b))
      
        Maintaining business and tax records
        Name, address, order and payment records
        Legal obligation – we are required to keep financial records for HMRC purposes (Art. 6(1)(c))
      
        Sending you marketing communications about our products and services
        Name, email address
        Legitimate interests – where you are an existing customer and we are marketing similar services; or

Consent – where you have specifically opted in (Art. 6(1)(a) or (f))
      
        Improving our website and understanding how it is used
        Technical and usage data
        Legitimate interests – to ensure our website functions correctly and to improve our services (Art. 6(1)(f))

Purpose	Personal data used	Lawful basis
Fulfilling your order (design, typesetting, printing, and dispatch)	Name, address, event details	Contract – processing is necessary to perform the contract with you (Art. 6(1)(b))
Communicating with you about your order, proofs, and queries	Name, email address	Contract – necessary to perform the contract (Art. 6(1)(b))
Guest-addressing service	Guest names and addresses	Contract – necessary to perform the service you have requested (Art. 6(1)(b))
Maintaining business and tax records	Name, address, order and payment records	Legal obligation – we are required to keep financial records for HMRC purposes (Art. 6(1)(c))
Sending you marketing communications about our products and services	Name, email address	Legitimate interests – where you are an existing customer and we are marketing similar services; or Consent – where you have specifically opted in (Art. 6(1)(a) or (f))
Improving our website and understanding how it is used	Technical and usage data	Legitimate interests – to ensure our website functions correctly and to improve our services (Art. 6(1)(f))

We will never sell your personal data to third parties or use it for purposes unrelated to the services we provide.

We only share your personal data where it is necessary to provide our services. The categories of recipients are:

Professional printing partners: We share your order artwork and any relevant details with our printers to enable physical production of your stationery.
Delivery and postal services: We share your name and delivery address with couriers and postal services to dispatch your order.
Payment processors: Your payment is handled by a third-party payment processor. We do not receive or store your card details.
Website platform: Our website is hosted by Squarespace, Inc., which processes certain data on our behalf as a data processor. Squarespace is certified under appropriate data transfer mechanisms (see Section 8 on International Transfers).

All third parties are contractually required to keep your data secure, use it only for the purpose we have specified, and comply with applicable data protection law.

We do not share your data with any third party for their own marketing purposes

4 Data Sharing and Third Parties

Guest Data: Our Role as a Data Processor

5

When you provide us with a guest list for our addressing service, you (as the person who has collected your guests' personal data) are the data controller for that information. In processing it on your behalf, Kate & Lane Paper Co. acts as a data processor.

We use guest data solely to complete the addressing service you have requested. Once your order is complete and the data is no longer required for production, it is securely deleted from our active systems. We will not use guest data for any other purpose, and we will not share it with any party beyond those directly involved in fulfilling your order.

If you are providing us with guest data, you are responsible for ensuring you have a lawful basis for sharing that information with us, and that your guests are aware their data may be used for this purpose.

We keep your personal data only for as long as necessary. Our standard retention periods are:

Order and financial records (names, addresses, order details, payment records): 7 years from the date of the transaction, as required by HMRC for tax and accounting purposes.
Guest data used for addressing services: Deleted securely as soon as your order has been completed and dispatched, or within 30 days at the latest.
Marketing consent records: Until you withdraw your consent or opt out of marketing communications.
Website analytics data: In line with Squarespace's data retention policies (typically 14 months).

When data is no longer needed, it is deleted or anonymised securely.

6 Data Retention

We take reasonable and appropriate steps to protect your personal data from unauthorised access, loss, or disclosure. These measures include:

Using password-protected accounts and systems
Communicating digitally via encrypted email and secure file-sharing platforms
Limiting access to your data to those who need it to fulfil your order
Using third-party providers (such as Squarespace and our payment processor) who maintain their own security certifications

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

7 Data Security

Some of our third-party providers, including Squarespace (our website host), are based outside the UK. Where data is transferred internationally, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements.

8 International Data Transfers

Our website uses cookies — small text files stored on your device — to help us operate the site and understand how it is used. When you visit our website, you will be shown a cookie banner that allows you to manage your preferences.

We use the following types of cookies:

Strictly necessary cookies: Required for the website to function (e.g. maintaining your session or cart). These cannot be disabled.
Performance/analytics cookies: Help us understand how visitors use the site (e.g. which pages are most visited). These are only set with your consent.
Marketing cookies: Used to personalise content or track the effectiveness of advertising. These are only set with your consent.

You can update your cookie preferences at any time by clearing your browser cookies and revisiting our site, or by adjusting your browser settings.

9 Cookies

Under UK data protection law, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at privacy@kateandlane.co.uk. We will respond within one month of receiving your request.

Right to be informed: You have the right to be told how we use your personal data. This privacy policy fulfils that obligation.
Right of access: You have the right to request a copy of the personal data we hold about you (known as a Subject Access Request).
Right to rectification: You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to erasure: You have the right to ask us to delete your personal data in certain circumstances — for example, if we no longer need it for the purpose it was collected, or if you withdraw your consent (where consent is the lawful basis we rely on).
Right to restrict processing: You have the right to ask us to pause the processing of your data — for example, while you contest its accuracy or object to our use of it.
Right to data portability: Where we process your data on the basis of contract or consent, you have the right to receive a copy of that data in a structured, commonly used, machine-readable format so that you can transfer it to another service provider.
Right to object: You have the right to object to processing where we rely on legitimate interests as our lawful basis. You also have an absolute right to object to your data being used for direct marketing purposes, and we will stop immediately on receipt of your request.
Rights related to automated decision-making: We do not make any decisions about you based solely on automated processing. This right is therefore not currently applicable, but we will inform you if this changes.
Right to withdraw consent: Where we rely on your consent to process your data (for example, for marketing emails), you may withdraw that consent at any time by contacting us at privacy@kateandlane.co.uk or clicking the unsubscribe link in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Please note that some of these rights are not absolute and may not apply in every situation. Where we are unable to fulfil a request, we will explain why.

10 Your Rights

If you are unhappy with how we have handled your personal data, we would encourage you to contact us first at privacy@kateandlane.co.uk so we can try to resolve your concern.

You also have the right to lodge a complaint with the UK's data protection supervisory authority at any time:

Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11 How to Complain

We may update this privacy policy from time to time to reflect changes in our practices or in applicable law. The current version will always be available on our website, and we will update the "Last updated" date at the bottom of the page accordingly. Where we make significant changes, we will take reasonable steps to notify you.

12 Changes to This Policy

Last Updated: 15/06/2026