Privacy policy

1. Who is responsible for your data

DUNBAR PICTURE FRAMING LTD(“Framewell”, “we”, “us”) is the data controller for personal data processed through dunpicfra.shop. We are registered in Scotland, United Kingdom, at 8 Spott Road Industrial Estate, Dunbar, Scotland, EH42 1RS, United Kingdom. For any privacy question, contact support@dunpicfra.shop or call +44 7781595644.

2. What we collect

• Contact information, order and delivery data: name, email, phone (optional), billing and delivery address, and the sets you purchase.
• Account and membership data: subscription tier, billing cycle and download activity, where you hold a Framewell Club membership.
• Payment data: processed by Stripe. Framewell never receives or stores full card numbers — see section 5.
• Uploads (optional features): for the Family Grid layout and wall-photo preview, any photographs you upload to generate a mockup.
• Support data: messages you send through the contact or trade forms and related correspondence.
• Technical and analytics data: IP address, device and browser type, and pages viewed, collected via cookies and similar technologies (see our cookie policy).

3. Collection sources and where the data comes from

We collect data directly from you when you browse, buy a set, subscribe, upload a photo or contact us, and automatically from your device via cookies and our hosting and payment providers.

Product orders may include your shipping address, billing contact, delivery preference and order notes. We use this order fulfilment data to prepare digital downloads, resolve access issues, process refunds, returns and answer support requests about a specific purchase.

4. Why we use it and our legal bases

• To fulfil your order and deliver downloads — performance of a contract.
• To manage memberships and process payments — performance of a contract.
• To provide support and respond to enquiries — legitimate interests and, where relevant, contract.
• To generate mockups from uploads — your consent, given when you upload.
• To improve the site and prevent fraud — legitimate interests.
• To send service and, with consent, marketing messages — consent or legitimate interests; you can opt out anytime.
• To meet legal, tax and accounting duties — legal obligation.

5. Payments — provider boundary

Card payments are handled by Stripe, a PCI-DSS Level 1 payment provider. You enter card details directly with Stripe’s hosted checkout. Framewell does not see, receive or store your full card number, expiry or security code. We receive only a payment confirmation and limited details such as the last four digits, card brand and billing country to service your order and handle refunds or disputes.

6. Who we share it with

We share personal data only with processors that help us run the service:

• Hosting and delivery: our cloud hosting and content-delivery provider.
• Payments: Stripe, for checkout, subscriptions, refunds and disputes.
• Database and file storage: our managed database and storage provider, for orders, leads and uploaded files.
• Email: our transactional email provider, for receipts, downloads and support replies.

We do not sell your personal data. We may disclose data where required by law.

7. International transfers

Some providers process data outside the UK/EEA. Where they do, we rely on appropriate safeguards such as UK International Data Transfer Agreements, the EU Standard Contractual Clauses or an adequacy decision.

8. How long we keep it

• Order and transaction records: kept for up to 7 years to meet tax and accounting duties.
• Support and marketing leads: kept for up to 24 months from last contact, then deleted.
• Uploaded photographs: cached for up to 30 days to generate your mockup, then deleted.
• Analytics data: retained per the cookie policy and provider defaults.

9. How we protect it

We use encryption in transit (HTTPS), access controls, reputable processors and data minimisation. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and regulators of any breach as required.

10. Your rights

Under UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any right, email support@dunpicfra.shop.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request deletion or correction, and to be free from discrimination for exercising these rights.

Do Not Sell or Share

Framewell does not sell or share personal information for cross-context behavioural advertising. There is nothing to opt out of, but you may still contact us with any request.

11. Cookies and automated decisions

We use cookies as described in our cookie policy. We do not make solely automated decisions that produce legal or similarly significant effects about you.

12. Children

Framewell is not intended for children under 13, who may not use the service. Users aged 13 to 17 must have the consent of a parent or guardian. We do not knowingly collect data from children under 13; contact us if you believe a child has provided data and we will delete it.

13. Complaints and contact

Contact us first at support@dunpicfra.shopso we can help. You also have the right to complain to the UK Information Commissioner’s Office, or to your local supervisory authority in the EEA.

This policy is governed by the law of Scotland, United Kingdom.