Privacy Policy

This notice explains how Signature Scouts Ltd (“we”, “us”) uses personal information when you browse our website, contact us, book a signing or use our staff administration area. We are the controller of this information. Our company number is 17286860, registered in England and Wales, and our registered office is 167-169 Great Portland Street, London, England, W1W 5PF.

We handle personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, and applicable privacy and electronic communications rules. Where the EU GDPR applies to our activities, the relevant protections also apply. For privacy matters, email Signaturescoutshq@gmail.com or write to our registered office, marked “Privacy”.

1. Information we collect and where it comes from

• Enquiries: the name, email address, optional subject and message you submit through our contact form, and subsequent correspondence. Form submissions are stored in our website database as well as sent to our business mailbox.
• Bookings: your name, email, return address, event and creator selection, item description, declared value, postage, add-ons, grading choices and optional instructions or personalisation names. A booking record is created when checkout begins, even if payment is not completed.
• Transactions: order and payment references, amounts, payment status, refunds and related correspondence. Stripe collects your payment-card details directly on its hosted checkout. We do not store full card numbers or security codes in our website database.
• Fulfilment: information about signing, grading, dispatch, tracking and claims that you, our team, delivery providers or service partners supply. Item photographs or personalisation instructions may contain personal information.
• Staff administration: authorised users’ names, email addresses, roles, password hashes and login-session information. Team-member information and payment-account references are also used to administer services and payments.
• Technical information: requests, timestamps, error and security records. Hosting and network providers may process IP addresses, browser information and connection details to deliver and protect the site.

Most information comes directly from you; payment updates come from Stripe and fulfilment updates may come from our team, couriers or grading partners. If you provide someone else’s details, tell them about this notice and ensure you are entitled to provide them. Please do not include payment-card details, identity documents, health information or other sensitive information in messages or booking notes.

2. Purposes and lawful bases

• Steps towards a contract and performing a contract (Article 6(1)(b)): answering booking enquiries at your request, creating and fulfilling orders, taking payment, returning your items and resolving service issues.
• Legal obligations (Article 6(1)(c)): maintaining required accounting and tax records, responding to lawful authority requests and meeting applicable consumer and data-protection duties.
• Legitimate interests (Article 6(1)(f)): responding to general enquiries, securing the website, administering staff access, preventing abuse or fraud and establishing or defending legal claims. These interests are running a reliable service and protecting customers and the business; they must be balanced against your rights and reasonable expectations. You can object to this processing.
• Consent (Article 6(1)(a)): the optional sharing with Fantasy Road described below, and any optional marketing or non-essential tracking that requires consent if introduced in future. Consent must be a separate choice, not assumed from using the site or accepting our terms.

Required booking fields are needed to arrange payment, fulfil the service and return your item. Required enquiry fields let us understand and answer your request. If you do not provide them, we cannot complete that booking or respond through the form. Optional fields can be left blank.

We do not use booking or enquiry details for advertising campaigns, sell personal information, or operate advertising trackers in this website. Service and payment emails are not marketing consent. We do not make solely automated decisions with legal or similarly significant effects about you; Stripe may carry out its own fraud checks under its privacy notice.

3. Who receives information

Information is shared for the purposes above with the people and providers who need it:

• Authorised staff and event proxies: booking and contact details needed to administer and fulfil your order.
• Stripe: your email, transaction references and payment information for hosted checkout, payment processing, refunds and fraud prevention. Stripe also supports payments to participating team members. See Stripe’s privacy notice; it acts as an independent controller for some payment and legal-compliance purposes.
• Replit and its infrastructure providers: application hosting, database, sessions, operational logs and file storage. The storage integration uses Google Cloud Storage. These services process data needed to run the site.
• Resend and our business email provider (Google/Gmail): enquiry messages, customer email addresses and booking details needed to deliver correspondence, confirmations and service notifications. See Resend’s privacy notice and Google’s privacy notice.
• Couriers: recipient name, address and parcel information needed for delivery, insurance and customs, with relevant contact details where required.
• Fantasy Road and grading/authentication providers: where you select the optional service and agree to sharing, as explained below.
• Professional advisers, insurers, banks and public authorities: relevant records when necessary for advice, claims, payment disputes or legal obligations.

Providers that act as independent controllers are responsible for their own processing. Other providers process information on our behalf. You can ask us for details about recipients relevant to your booking.

4. Optional Fantasy Road grading and authentication

If you choose grading or authentication, checkout asks separately whether we may share your name, email address, shipping address, item description, declared value and booking notes with Fantasy Road to arrange the selected service. Relevant information may then be needed by the selected grading or authentication provider, such as CGC or JSA.

You can decline and continue with a signing-only booking. To withdraw your sharing consent, email us. Withdrawal does not affect processing already lawfully carried out. If sharing has not yet happened, we can stop it; if the partner already has the information, we will explain the next steps and any independent legal or contractual retention. Withdrawing may mean the optional grading service cannot proceed; any cancellation or refund is considered under your statutory rights and our Refund Policy.

5. International processing

Our hosting, payment and email providers may process information outside the UK, including in the United States. The locations and safeguards depend on the provider and service. A restricted transfer requires an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with any required transfer assessment and supplementary measures. EU transfer requirements also apply where relevant.

You can contact us to ask where information relating to your booking is processed and request details or a copy of the applicable safeguards, with confidential information removed where necessary.

6. How retention is determined

Retention depends on the purpose of the record, applicable legal requirements and any unresolved dispute; it is not determined simply by whether you have an active booking.

• Accounting and transaction records: normally six years from the end of the company financial year they relate to, or longer where a legal requirement or unresolved investigation applies.
• Operational booking information, addresses, notes and item records: for fulfilment and resolution of delivery issues, refunds or claims. The need for these details is assessed separately from financial records, so unnecessary details should not be retained just because an invoice must be kept.
• Enquiries and correspondence: for answering the enquiry, handling follow-up and any associated complaint or claim. Relevant correspondence forming part of a booking or dispute may need to be kept with that record.
• Unpaid or abandoned bookings: for resolving payment attempts or related enquiries and investigating suspected abuse, rather than automatically treating them as completed-sale accounting records.
• Staff access and technical records: for active access, session security and investigation of incidents. Our login cookie has a maximum lifetime of 14 days; provider logs and backups follow the relevant service’s retention arrangements.

These are retention criteria, not a claim that every record is automatically deleted on a fixed date. Deletion or anonymisation needs to cover database records, correspondence, exports and files, subject to legal holds and backup cycles. Contact us for the retention assessment for your information or to request erasure.

7. Your rights and how to use them

• Ask for a copy of your personal information and information about its use.
• Ask us to correct inaccurate or incomplete information.
• Ask for erasure or restriction of processing where the conditions apply.
• Object to processing based on legitimate interests. An objection to direct marketing must be honoured.
• Request portability of information you supplied where processing is automated and based on consent or contract.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Ask for human involvement and challenge a decision if the applicable automated-decision protections apply.

Email Signaturescoutshq@gmail.com or write to our registered office. There is no need to create an account or use a special form. We may request proportionate information to verify identity; do not send identity documents unless requested through an agreed secure method.

We respond without undue delay, normally within one month. If a lawful extension or clarification is necessary, we will explain why and the applicable timetable. Requests are normally free. Rights are not absolute: for example, required accounting records may be retained despite an erasure request. If we cannot meet a request, we will explain the reason and how to challenge it.

8. Privacy complaints

Please send privacy complaints to the contact address above. We will acknowledge and investigate them and explain our response without undue delay. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint, or telephone 0303 123 1113. You do not have to contact us first to exercise that right. Where EU GDPR applies, you may also contact your relevant EU supervisory authority.

9. Security and keeping information private

Staff administration is access-controlled and login sessions use protected cookies. No internet service can promise absolute security. Keep booking-confirmation links private, as they may allow the holder to view order information. Public event and creator images are intended to be publicly accessible; do not use public image uploads for customer documents or private correspondence.

We only need information relevant to your enquiry or booking. Our service is not directed at children; if a child’s information is supplied unnecessarily, contact us so we can assess and remove it where appropriate.

10. Cookies and changes to this notice

See our Cookie Policy for the storage used by this website, its purpose and duration. A privacy notice is information for you, not a request for blanket consent.

We update this notice when our practices or legal requirements change and show the revision date above. Material changes affecting existing customers will be highlighted through an appropriate notice. If a new use requires consent, we must ask before starting it.

Company and contact details

Signature Scouts Ltd 2026 © Registered in England and Wales (Company Number: 17286860). Registered office: 167-169 Great Portland Street, London, England, W1W 5PF

Email: Signaturescoutshq@gmail.com. Use this address for customer service, privacy questions and data-rights requests.

The registered office is for legal correspondence. Please do not send items for signing there; use the delivery instructions supplied with your booking.