Last updated: 4 October 2026
Who we are
PressFlow is operated by Fell & Harbour. This policy covers press-flow.co.uk, our demonstration site at demo.press-flow.co.uk, software purchases, product-key administration, enquiries and support. We are the controller of the personal information we use for those activities.
Contact: contact@press-flow.co.uk
Business address: 79 Towncroft, Dearham, Maryport, Cumbria, CA15 7HY
If you place a print order with a business that uses PressFlow on its own website, that business's privacy policy applies to your order and artwork. Buying our software does not give us routine access to that business's customers or files.
Information we collect
Depending on how you interact with us, we collect:
- Enquiries: your name, email address, business details and the information you send.
- Purchases and accounts: contact and billing details, country, applicable tax information, account identifier, order details, payment status and payment transaction references. Passwords are handled through WordPress authentication, not stored as readable passwords by PressFlow's licence manager.
- Licences: purchaser email, associated order, product-key records, plan expiry, permitted site count, activated site addresses, random installation identifiers and activation/check timestamps.
- Cancellation notices: your name, confirmation email, purchase details, optional identification information, the notice, its reference and receipt time. We keep a private record on this website and send you a receipt. A temporary receipt link is available for 24 hours.
- Support: your messages, plugin and software versions, error details and any screenshots, diagnostic information or files you choose to provide. Temporary access credentials are used only when agreed for a support task.
- Website security: connection information such as IP address, browser information, requested pages and timestamps, where recorded by our hosting and security services.
- Demonstrations: any test choices, account details, messages or artwork you submit to our own demonstration website. Use fictional information and sample artwork wherever possible.
- Preferences: browser storage used for requested shopping features, remembered print choices and VAT display preferences where those features are present.
We obtain information directly from you, from your authorised representative, from your installation's licence requests and from our payment, hosting and communications providers. If a colleague orders or requests support for you, we may receive your business contact details from them.
Do not send unnecessary personal information, passwords in ordinary email, or sensitive customer artwork when a redacted example will explain an issue. We do not require information about health, ethnicity, religion or other special-category matters to sell a licence.
Why we use information
| Purpose | Information used | Lawful basis |
|---|---|---|
| Answer a prospective customer's enquiry and arrange a purchase | Contact details and correspondence | Steps requested before entering a contract; legitimate interests for business representatives |
| Supply software, administer an account and provide purchased support | Account, order and support details | Performance of our contract with the individual purchaser; legitimate interests in serving a business customer through its representatives |
| Issue, verify, release and administer paid site activations | Licence, order and installation details | Performance of the purchaser's contract; legitimate interests in managing business entitlements and protecting the licence service |
| Process payments, cancellation notices, refunds and accounting records | Billing, transaction and tax details | Contract and applicable legal obligations |
| Protect our site, investigate abuse and resolve disputes | Necessary security logs, correspondence and transaction records | Legitimate interests in security, fraud prevention and establishing or defending claims; legal obligation where applicable |
| Send optional promotional email | Email address and subscription preference | Consent |
| Operate requested demonstration and shopping features | Session, configuration and submitted information | Legitimate interests in providing the requested demonstration; contract/pre-contract steps for genuine transactions |
| Use optional analytics or advertising technologies, if enabled | The information identified in our cookie notice | Consent where required; any other permitted basis is explained before the activity starts |
For legitimate interests, we consider necessity and the effect on your rights. You can object to processing based on legitimate interests. We do not treat an employee's contact details as automatically covered by a contract with their employer.
Order emails, activation notices and replies to your support requests are service communications. They do not subscribe you to promotional messages. Optional marketing consent can be withdrawn through an unsubscribe link or by emailing us, without affecting your purchase.
Providing checkout and licence information is necessary to fulfil a purchase and administer its activation. Optional marketing and unnecessary diagnostic information are not conditions of buying. If essential information is missing, we may be unable to supply the relevant service.
What an installed PressFlow plugin sends to us
Entering a product key in the welcome screen sends the key, site address, a random installation ID and plugin version to our HTTPS licence service. Later validation requests use a licence ID and site activation token, with site address, installation ID and plugin version. A release request identifies the activation being released. Once activated, validation is normally scheduled daily through WordPress cron.
The customer plugin retains an activation token and a masked key hint rather than the full purchase key. Our licence manager stores the purchaser's email, entitlements and activation records; full product keys are encrypted in its private records. It also uses a short-lived, keyed hash of the requesting network address to limit repeated requests. Hosting security logs may separately record the connection's IP address.
These licence requests do not contain your shop's print orders, artwork, customer database, print specifications or payment details. PressFlow's licence client does not send general shop analytics to us. WordPress, WooCommerce, your theme, other plugins and hosting services may make their own requests under their own settings.
Artwork and customer data on your own website
PressFlow's print orders, quotes, customer artwork, proofs and saved jobs are processed on the merchant's WordPress/WooCommerce installation. The merchant selects its hosting, communications services, retention settings and who can access that installation. The merchant is normally the controller of that shop's customer information.
Private artwork storage and permission checks help control access, but do not replace the merchant's own privacy notice, lawful processing decisions, security, backups or retention procedures. Artwork transfer links may lead to external services chosen by the customer or merchant; their operators have separate policies.
If you authorise us to access your installation for support or a website-build service, we will agree the scope and handle customer data only as necessary for that task. Where we act as your processor, the work requires appropriate data-processing terms. Our separate use of purchaser details for billing and licence administration remains controller processing.
We do not use support artwork or shop customer records for our marketing, public demonstrations or model training. Public use of a customer's case study, logo or identifiable screenshot requires separate permission.
Who receives information
We share only what is needed with service providers for hosting, backups, website security, payment processing, email delivery, support administration and accounting. Some providers act as our processors; payment providers and professional advisers may act as independent controllers for their own legal purposes. We may disclose relevant records where required by law or to establish or defend legal claims.
Our service providers and relevant locations are:
| Service | Provider and location | Information involved |
|---|---|---|
| Website and licence-service hosting | Krystal Hosting, UK website hosting | Website, account, licence and connection records |
| Payments | Stripe. See Stripe’s privacy policy for its payment, security and international processing practices. | Checkout/payment information and transaction references |
| Email and support | Fell & Harbour handles email and support on our own website/server, hosted by Krystal in the UK. | Contact details, service messages and support correspondence |
| Backups | Krystal Hosting manages our website backups. | Copies of website, account, order, licence and correspondence records held on the server |
| Accounting | Xero. See Xero’s privacy notice for its processing locations and safeguards. | Customer billing details, invoices, payment and refund records needed for our accounts |
Card details submitted to a payment provider are handled through that provider's checkout or payment integration. PressFlow's licence manager does not store full card numbers or card security codes. We do not sell customer contact lists or licence records.
International transfers
Using an overseas service provider can involve transferring personal information outside the UK. Where a restricted transfer occurs, we use an applicable adequacy arrangement or appropriate contractual safeguards and the required assessment of protection. We do not rely on your acceptance of this policy as blanket consent to overseas transfers.
Our website, email, support records and backups are hosted with Krystal in the UK. Stripe and Xero may process payment and accounting information internationally. Their privacy notices linked above explain processing locations and applicable transfer safeguards. Email us if you need further information about a transfer involving your information or a copy of relevant safeguards, with confidential information redacted where necessary.
Where EU/EEA data-protection law applies to our activities, its applicable transfer and individual-rights requirements also apply. Customers elsewhere may have additional rights under their local law.
How long we keep information
We keep information for the purpose it was collected and apply the following retention periods:
| Record | Retention approach |
|---|---|
| Accounting, payment and tax records | Normally six years after the end of the relevant tax year; longer if an applicable legal requirement or an active investigation requires it |
| Cancellation and refund records | Normally up to six years after the matter is resolved, with essential accounting records retained under the accounting period above; longer where needed for an active legal claim |
| Licence and entitlement records | While the entitlement or an unresolved activation remains active, then normally up to six years to resolve contractual and accounting matters |
| Unconverted enquiries | Normally 12 months after the last meaningful contact |
| Support correspondence | Normally two years after the issue closes; essential financial or dispute records may be retained separately for the relevant longer period |
| Support access credentials and diagnostic copies | Access removed when the task finishes; temporary copies normally deleted within 30 days, unless continued retention is specifically agreed or needed for an unresolved security incident |
| Routine website/security logs | Normally 30 days; incident evidence may be kept longer while it is investigated or a claim remains active |
| Marketing records | Until consent is withdrawn or the mailing list is no longer used; minimal suppression details may remain to respect an unsubscribe request |
| Backups | Krystal manages backup rotation under our hosting service. Deleted information may remain in restricted backups until the backup containing it expires; contact us for the retention applicable to your information. Backups are used for recovery and are not a source for routine customer contact. |
| Test artwork and demonstrations | Do not upload confidential artwork or use real customer information in the public demonstration. Test artwork follows the demonstration’s configured PressFlow cleanup period; the plugin default is 90 days from upload, with cleanup dependent on scheduled tasks. Test account and job records are separate from artwork cleanup. Contact us to request removal of test information you have submitted. |
Account deletion does not require us to erase records we must retain for tax, a live entitlement, fraud investigation or a legal claim. We restrict retained records to those purposes. If a backup is restored, applicable deletion requests must be reapplied.
The artwork-retention setting on a merchant's own installation is separate from this table. The plugin's default is 90 days from upload, including abandoned baskets, with scheduled cleanup dependent on working WordPress cron. It does not automatically delete every order, quote or customer-account record after 90 days.
Cookies and browser storage
WordPress/WooCommerce use browser storage for functions such as sign-in, basket sessions and security. PressFlow can also remember print choices and read a VAT display preference. Browser storage is covered by the same privacy considerations as cookies.
Our cookie notice explains the technologies actually used and the choices available. Optional technologies that require consent must remain disabled until you choose them. Refusing optional technologies does not prevent you from purchasing a licence.
Security and decisions
We use appropriate access restrictions and technical and organisational measures to protect personal information. No website or transmission can be guaranteed completely secure. If a breach creates a legal notification duty, we will notify the appropriate authority and affected people as required.
Automated licence checks assess activation limits, credentials and expiry. If an activation is refused, contact us for human review. We do not use these checks to make decisions with legal or similarly significant effects about individuals or to build customer advertising profiles.
Your rights and complaints
Subject to the applicable law and relevant exceptions, you can ask for access, correction, deletion, restriction or transfer of your personal information, and object to certain uses. You can withdraw consent at any time. Rights vary with the processing basis; retaining a legally required invoice may still be necessary after an account is closed.
Email contact@press-flow.co.uk to exercise a right. We may request proportionate evidence of identity. We normally respond to data-protection rights requests within one calendar month; any lawful extension or pause will be explained. Ordinary requests are free of charge.
You can also send a data-protection complaint to that address. We acknowledge complaints within 30 days, investigate them and communicate the outcome without undue delay. This complaint acknowledgement period is separate from the response deadline for a rights request.
You may complain to the Information Commissioner's Office or, where applicable, your local data-protection authority. You do not give up that right by contacting us first.
Our services are intended for people able to enter into a purchase contract, rather than services directed at children. If a child's information has been submitted unnecessarily, contact us so we can assess and remove it appropriately.
Changes to this policy
We will update the date above when this policy changes and provide an appropriate notice of material changes. A new processing purpose requiring your consent will not be authorised merely by updating this page.
Verified product support
Support requests are stored privately on our website/server and emailed to our support team. They include your licence email, any related order and licence record references, message and any shop URL or software version you provide. Your full licence key is checked transiently and is not saved in the support request or email. Support correspondence follows the retention approach described above.