Who we are

This site is operated by Penned Ltd (company no. 12989856), registered in England & Wales, registered office Polhill Business Centre, London Road, Polhill, Halstead, TN14 7AA ("Penned", "we", "us"). We are the data controller for personal data collected through penned.uk. We are registered with the Information Commissioner's Office (registration no. ZC202297). You can contact us at [email protected] or 0333 090 9406.

When we produce and post letters on behalf of a business client, we act as a data processor for the recipient data that client provides, and process it only on their instructions under our service agreement.

The information we collect

  • Information you give us — when you request a sample pack or contact us: your name, company, work email, phone number, postal address, and the details of your enquiry or message.
  • Recipient data (as processor) — names and addresses our clients provide so we can write and post their letters, processed on their instructions.
  • Information collected automatically — with your consent, analytics data about how you use the site (pages viewed, device and browser, approximate location) via cookies. See our cookie policy.

How we use it, and our lawful bases

  • To respond to your enquiry and provide a sample pack — our legitimate interests, and taking steps at your request before entering a contract.
  • To provide and administer our service — performance of a contract.
  • To send marketing, where you've asked us to — your consent.
  • Analytics and advertising measurement — your consent (managed via the cookie banner).
  • To meet legal, accounting and regulatory obligations — legal obligation.

Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf under appropriate agreements, including: Google (analytics and advertising), Zoho (email), Twilio SendGrid (email delivery), Vercel (website hosting), Cloudflare (DNS and security) and MongoDB (database). We may also disclose data where required by law.

International transfers

Some of our providers are based outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses.

How long we keep it

We keep personal data only for as long as necessary for the purposes above, to run our business, and to meet legal or accounting requirements, after which it is securely deleted.

Your rights

Under UK data protection law you have the right to access, correct, erase, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Cookies

How we use cookies, and your choices, are set out in our cookie policy.

Changes

We may update this policy from time to time; changes will appear here with a revised date.

Contact

Email [email protected] or call 0333 090 9406.