This policy explains what personal data ShelfPopping collects when you contact the studio or browse this website, why we process it, how long we keep it, and the rights available to you.
Last updated: 18 August 2026
[REVIEW]. A qualified legal adviser must confirm them before publication. This text is provided for informational purposes and is not legal advice.ShelfPopping (“ShelfPopping”, “we”, “us”) is a packaging design studio operating as [REVIEW: registered legal entity name and company registration number], with its registered office at [REVIEW: registered office address].
We act as the data controller for personal data described in this policy. Questions about this policy or about how we handle personal data should be sent to webmaster@draftix.online.
Enquiry data. When you email the studio we receive your name, email address, employer or brand name, and any information you choose to include about your product, packaging specifications, volumes and launch schedule.
Project data. During an engagement we process contact details of your staff, converters and printers, together with commercial documents such as briefs, quotations and delivery records.
Technical data. Our hosting provider records standard server logs, including IP address, browser type, referring page and request timestamps, for security and availability purposes.
We process enquiry data to respond to your request and prepare a proposal; project data to perform our contract with you; and technical data to keep the site secure and operational.
Where [REVIEW: applicable data protection legislation, for example the UK GDPR, EU GDPR or other governing framework] applies, our lawful bases are performance of a contract or steps taken at your request prior to entering a contract, our legitimate interests in operating and securing our business, and compliance with legal obligations such as tax record keeping.
This website uses only cookies that are strictly necessary for the site to function. We do not operate advertising or cross-site tracking cookies. If analytics or marketing cookies are introduced in future, a consent mechanism will be presented before any non-essential cookie is set. [REVIEW: confirm the analytics providers and cookie categories actually deployed.]
We share personal data only where necessary: with hosting and email providers acting as our processors; with converters, printers and testing laboratories where required to deliver your project; and with professional advisers, insurers or authorities where we are legally obliged to do so.
We do not sell personal data. Processors are bound by written terms requiring appropriate confidentiality and security measures.
Some of our service providers may process data outside [REVIEW: your governing jurisdiction or economic area]. Where that occurs, transfers are made under an adequacy decision or a recognised transfer mechanism such as standard contractual clauses, together with any additional safeguards required. [REVIEW: list the transfer mechanisms actually relied on.]
Enquiries that do not become projects are deleted within 24 months. Project records are kept for the duration of the engagement and afterwards for the period required by applicable accounting, tax and limitation rules — commonly six to seven years. [REVIEW: confirm the statutory retention periods for your jurisdiction.] Server logs are retained for a maximum of 12 months.
We apply access controls, encryption in transit, restricted file sharing and regular review of accounts with access to client material. Design files and commercial documents are treated as confidential and are not published without written permission. No transmission over the internet can be guaranteed fully secure, so we ask that highly sensitive material is shared using a secured link rather than plain email attachment.
Subject to the applicable law identified above, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests.
To exercise any of these rights, email webmaster@draftix.online. We respond within one month, or sooner where the law requires. You also have the right to lodge a complaint with your supervisory authority, which is [REVIEW: name and contact details of the competent supervisory authority].
Our services are directed to businesses. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact webmaster@draftix.online and we will delete it.
We may update this policy to reflect changes in our services or in applicable law. The effective date at the top of this page indicates the most recent revision. Material changes affecting active clients will be notified by email.