Last updated: 2 September 2026
1. Introduction
Citrine Creative (“we”, “us”, “our” or “Citrine Creative”) respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store, protect and share personal information when you visit or use citrinecreativeltd.co.uk, contact us, request information, purchase or enquire about our products, or otherwise interact with our business.
Our products include engraved gifts, personalised souvenirs, plaques, photo products, ornaments, postcards, printed keychains, canvas products and other personalised or printed products. We may manufacture or process products using specialist equipment, including XTool machinery.
This Privacy Policy applies to personal data relating to customers, prospective customers, website visitors, business contacts and other individuals who interact with us.
We aim to process personal data lawfully, fairly and transparently and only collect information that is necessary for legitimate business purposes.
2. Who We Are
Business name: Citrine Creative
Website: citrinecreativeltd.co.uk
Location: Edinburgh, Scotland, United Kingdom
Email: ankurchaturvedi@gmail.com
For UK data-protection purposes, Citrine Creative is generally the data controller for personal information that we collect and determine the purposes and means of processing.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the email address above.
3. What Personal Data We May Collect
Depending on how you interact with us, we may collect some or all of the following information.
A. Contact information
This may include:
- Full name
- Business name
- Email address
- Telephone/mobile number
- Postal or delivery address
- Billing address
- Contact preferences
B. Order and transaction information
If you purchase products or place an order with us, we may collect:
- Products ordered
- Quantities and product specifications
- Personalisation details
- Delivery information
- Billing information
- Order history
- Transaction information
- Communications relating to your order
Where payments are processed by a third-party payment provider, we may not receive or store your complete payment-card details.
C. Personalisation and customer-submitted content
Because Citrine Creative provides personalised products, customers may voluntarily provide:
- Names
- Dates
- Messages or quotations
- Photographs
- Logos
- Artwork
- Designs
- Other images or files
- Text intended for engraving or printing
You should only provide photographs, personal information or other material belonging to another person where you have the appropriate permission or legal right to provide and use that material.
D. Business information
For business customers, including tourist souvenir shops, we may collect:
- Business name
- Business address
- Contact person’s name
- Business email address
- Telephone number
- Job title or role
- Purchase and order information
- Quotation and invoicing information
- Business correspondence
E. Website and technical information
When you visit our website, we may collect certain technical information, such as:
- IP address
- Browser type
- Device type
- Operating system
- Approximate location derived from IP address
- Pages viewed
- Time and date of visits
- Referring website
- Website interaction information
- Cookie and similar technology information
The exact information collected depends on the technologies and services installed on our website.
F. Communications
If you contact us by email, telephone, contact form or another communication method, we may retain information contained in that communication, including your name, contact details and the contents of your enquiry.
4. How We Collect Personal Data
We may collect personal information:
- Directly from you when you contact us
- When you submit a website enquiry
- When you request a quotation
- When you place an order
- When you purchase a product
- When you provide information for personalisation
- When you upload an image or design
- When you subscribe to marketing communications
- When you communicate with us by email or telephone
- Automatically through website cookies and similar technologies
- From business customers or authorised representatives
- From publicly available business information or other lawful sources
Where we obtain personal data from another source, we will provide the applicable privacy information required by data-protection law.
5. Why We Use Your Personal Data
We may use personal data for the following purposes:
Processing orders
To:
- Process and fulfil orders
- Produce personalised products
- Confirm orders
- Communicate about orders
- Arrange delivery or collection
- Provide customer support
- Process refunds, returns or complaints
Business-to-business services
For our relationships with tourist souvenir shops and other business customers, we may use information to:
- Respond to enquiries
- Prepare quotations
- Manage wholesale or business orders
- Discuss product specifications
- Manage accounts and invoices
- Communicate about products and services
- Maintain business relationships
Website operation
We may process technical information to:
- Operate our website
- Maintain website security
- Diagnose technical problems
- Improve website functionality
- Understand how visitors use our website
Marketing
Where permitted by law, we may use contact details to send information about our products, services, offers or business updates.
Where consent is required, we will ask for consent before sending relevant marketing communications.
You can unsubscribe from marketing communications at any time.
Legal and regulatory purposes
We may process personal information where necessary to:
- Comply with legal obligations
- Maintain appropriate accounting and tax records
- Establish, exercise or defend legal claims
- Prevent fraud or misuse
- Protect our legal rights
- Respond to lawful requests from competent authorities
Business administration
We may use information to:
- Maintain business records
- Manage suppliers and service providers
- Improve our products and services
- Maintain customer records
- Manage complaints and enquiries
- Protect our systems and property
6. Our Lawful Bases for Processing
Under the UK GDPR, we must have a lawful basis for processing personal data.
Depending on the circumstances, we may rely on the following lawful bases:
Contract
We may process personal data where it is necessary to enter into or perform a contract with you, such as processing an order or delivering a personalised product.
Legal obligation
We may process personal information where necessary to comply with a legal obligation, including accounting, tax and other regulatory requirements.
Legitimate interests
We may process personal information where it is necessary for our legitimate business interests and those interests are not overridden by your rights and interests.
Our legitimate interests may include:
- Operating and developing our business
- Providing and improving our products
- Managing customer and business relationships
- Communicating with customers and prospective customers
- Maintaining website and information security
- Preventing fraud and misuse
- Protecting our legal rights
- Managing business administration
Where we rely on legitimate interests, we will consider the impact of the processing on individuals and whether our interests are appropriately balanced against their rights.
Consent
In circumstances where consent is legally required, we will request your consent before processing your information for that purpose.
You may withdraw consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
7. Personalised Products and Customer Images
Because our business provides personalised products, you may provide photographs, names, messages, artwork, logos or other content.
We will use this material only as reasonably necessary to:
- Process your order
- Create your requested product
- Communicate with you about the order
- Provide customer service
- Resolve disputes or complaints
- Meet legal obligations
We do not claim ownership of customer-provided photographs, artwork or other content merely because you provide it to us.
You are responsible for ensuring that you have the necessary rights, permissions and licences to provide material to us and to instruct us to reproduce, engrave or print it.
For example, you should not upload or provide another person’s photograph, copyrighted artwork, logo or other protected material unless you have the appropriate permission or legal right to use it.
We may refuse to process material where we reasonably believe that doing so could infringe another person’s rights or breach applicable law.
8. How We Share Personal Data
We do not sell your personal data.
We may share personal information with trusted third parties where reasonably necessary to operate our business and provide our services.
These may include:
Website and technology providers
Companies that provide:
- Website hosting
- Website maintenance
- Cloud storage
- IT services
- Website security
- Email services
- Analytics services
Payment providers
Where applicable, payment processors may process payment information to facilitate transactions.
We encourage you to review the privacy policies of the payment providers used on our website.
Delivery and logistics providers
We may share relevant information, such as your name, address, telephone number and delivery details, with courier, postal or logistics providers where required to fulfil your order.
Professional advisers
We may share information with:
- Accountants
- Solicitors
- Insurers
- Professional advisers
where reasonably necessary for our business or legal obligations.
Government authorities and law enforcement
We may disclose personal information where required or permitted by law, including where necessary to comply with a legal obligation or lawful request.
Business transfers
If Citrine Creative is involved in a merger, acquisition, restructuring, sale of assets or other business transaction, personal information may be transferred as part of that transaction, subject to applicable data-protection requirements.
Third parties receiving personal data are expected to process it only for appropriate purposes and to apply suitable security measures where required.
9. International Data Transfers
Some of our service providers may process personal information outside the United Kingdom.
Where personal data is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place as required by applicable data-protection law.
Depending on the circumstances, these safeguards may include:
- A UK adequacy regulation
- Appropriate contractual safeguards
- UK International Data Transfer Agreements or Addendums
- Other lawful transfer mechanisms recognised under applicable data-protection law
If you would like further information about relevant international transfers or safeguards, you can contact us at:
10. How We Store and Protect Personal Data
We take reasonable technical and organisational measures to protect personal information against:
- Unauthorised access
- Accidental loss
- Destruction
- Alteration
- Disclosure
- Misuse
Depending on the systems we use, security measures may include:
- Password protection
- Access controls
- Device security
- Secure website connections
- Restricted access to customer information
- Secure cloud or hosting services
- Regular software updates
- Malware and security protection
- Secure disposal of information
- Staff or contractor confidentiality obligations where applicable
Access to personal data will be limited to people and service providers who reasonably need it for legitimate business purposes.
However, no method of transmitting or storing information electronically can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of personal information.
11. How Long We Keep Personal Data
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.
Different information may therefore be retained for different periods.
For example:
- Order and transaction information: retained for as long as reasonably necessary to administer the customer relationship and comply with accounting, tax and legal obligations.
- Customer enquiries: normally retained for as long as necessary to respond to the enquiry and maintain an appropriate record of the communication.
- Personalisation files and photographs: normally retained only for as long as reasonably necessary to fulfil the relevant order, deal with customer service issues or meet legitimate legal/business requirements, unless you have agreed to longer retention.
- Marketing information: retained until you unsubscribe or where appropriate until we determine that it is no longer necessary.
- Website and technical information: retained according to the requirements and settings of the relevant website, hosting, analytics and security services.
Where a specific retention period cannot reasonably be stated, we use criteria such as the nature and sensitivity of the information, the purpose for which it was collected, our ongoing business relationship with you, legal requirements and legitimate business needs.
When personal information is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it.
12. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Cookies may be used for purposes such as:
- Making the website function correctly
- Remembering preferences
- Security
- Understanding website usage
- Website analytics
- Marketing or advertising, where applicable
Some cookies may be strictly necessary for the operation of the website.
Where applicable law requires consent for non-essential cookies, we will request consent before placing or using those cookies.
You may also be able to manage cookies through your browser settings and, where provided, our website cookie-consent mechanism.
If we introduce additional analytics, advertising or other technologies, this Privacy Policy and/or our cookie information may be updated accordingly.
13. Marketing Communications
We may contact existing customers or prospective customers about our products and services where permitted by applicable law.
Where consent is required, we will obtain consent before sending marketing communications.
You can stop receiving marketing communications at any time by:
- Clicking the unsubscribe link in a marketing email, where available; or
- Contacting us at ankurchaturvedi@gmail.com
Stopping marketing communications will not affect service communications that are necessary for an existing order or contractual relationship.
14. Your Data Protection Rights
Subject to certain legal conditions and exemptions, you may have the following rights under UK data-protection law:
Right to be informed
You have the right to receive clear information about how we collect and use your personal information.
Right of access
You can ask us for a copy of personal data that we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete personal information.
Right to erasure
In certain circumstances, you can ask us to delete your personal information.
This is sometimes known as the “right to be forgotten”.
Right to restriction
In certain circumstances, you can ask us to restrict how we process your personal information.
Right to data portability
Where applicable, you may have the right to receive certain personal information in a structured, commonly used and machine-readable format and to have it transmitted to another organisation.
Right to object
You may have the right to object to certain processing, particularly where we rely on legitimate interests.
You have an absolute right to object to direct marketing.
Right to withdraw consent
Where we rely on consent as our lawful basis, you may withdraw your consent at any time.
Withdrawal will not affect processing that took place before withdrawal.
Rights relating to automated decision-making
You may have rights relating to certain automated decision-making or profiling.
We do not currently intend to make decisions producing legal or similarly significant effects about individuals solely through automated processing.
15. How to Exercise Your Rights
To exercise any of your data-protection rights, please contact us:
Email: ankurchaturvedi@gmail.com
Please provide sufficient information to help us identify you and understand your request.
We may need to request additional information to verify your identity before responding to a request. This is a security measure designed to prevent personal information from being disclosed to the wrong person.
We will normally respond to valid data-protection requests without undue delay and within the applicable legal timeframe.
In certain circumstances, we may be entitled to refuse a request or charge a reasonable fee where permitted by law. If this applies, we will explain the reason.
16. Complaints
If you have concerns about how we use your personal information, we encourage you to contact us first so that we can try to resolve your concern.
You also have the right to complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO).
The ICO’s website is:
ico.org.uk
You can find information about making a data-protection complaint through the ICO.
If you are located in the European Economic Area or another jurisdiction that provides additional data-protection rights, you may also have the right to complain to the relevant data-protection supervisory authority.
17. Children’s Privacy
Our website and services are primarily intended for adults and businesses.
We do not knowingly collect children’s personal data for marketing purposes.
If you believe that a child has provided personal information to us without appropriate consent or authorisation, please contact us at:
We will consider appropriate steps to investigate and, where legally required, delete the information.
18. Third-Party Websites
Our website may contain links to third-party websites, platforms or services.
We are not responsible for the privacy practices, security or content of third-party websites.
When you follow a third-party link, we recommend reviewing that organisation’s privacy policy before providing personal information.
19. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- Changes to our business
- Changes to our website
- New products or services
- Changes to technology
- Changes to data-protection law
- Changes to how we process personal information
The latest version will be published on our website.
The “Last updated” date at the beginning of this Privacy Policy indicates when the policy was most recently revised.
Where required by law, we will provide additional notice of significant changes.
20. Contact Us
If you have questions about this Privacy Policy, your personal information or how we process your data, please contact:
Citrine Creative
Location: Edinburgh, Scotland, United Kingdom
Email: ankurchaturvedi@gmail.com
Website: citrinecreativeltd.co.uk
We will endeavour to respond to privacy enquiries as soon as reasonably practicable.
Last updated: 2 September 2026