Privacy Policy
Last updated: 14 October 2026 · Policy version 1.1.2
FORM & FIELD is operated by KINGDOM CREST GROUP LTD, a company registered in England and Wales under number 17124303. Registered office: 20 Wenlock Road, London, England, N1 7GU, United Kingdom.
Website: formfield.net
Customer support: support@formfield.net
KINGDOM CREST GROUP LTD is the controller for customer and website information processed for the purposes below. This notice explains current browsing and correspondence, and order processing when you make a purchase. It covers this store, not the independent privacy practices of your chosen printer or payment provider. You can contact us through Contact or our registered office.
1. Information and its sources
- Website information: IP address, browser and device information, requested pages, request times, basic referral information where received, and security or error logs generated in providing the website.
- Basket information: the selected product identifiers stored on your device. Selecting a work or saving a basket does not by itself submit a paid order.
- Correspondence: name, email, message and attachments you choose to send, together with the support history.
- Order information when sales open: name, email, necessary billing or tax details, products and amounts, payment status and reference, refund or dispute records, confirmation of digital-delivery consent and download-access records.
- Account information if you choose an account: login identifiers and information needed to provide account access. You should not send us your password.
We obtain information from you, your browser, the store platform and payment or service providers involved in the transaction. We do not require a personal photograph, biometric information or a passport to purchase a standard poster. Please avoid sending sensitive material that is unnecessary for your request.
2. Why we use information
| Purpose | Basis where UK GDPR applies |
|---|---|
| Responding to an order enquiry; taking payment, supplying files, providing account access and resolving a purchase problem | Steps at your request before a contract, or performing the purchase contract |
| Keeping necessary tax, accounting and regulatory records | Compliance with legal obligations |
| Protecting the website, preventing misuse, investigating disputes and maintaining proportionate customer-support records | Legitimate interests in operating a secure store, handling legitimate claims and providing reliable support, balanced against your rights |
| Optional marketing or non-essential tracking, if introduced | Consent where required; not general acceptance of purchase Terms |
Providing essential purchase information is necessary to fulfill an order; without it we may be unable to process payment or deliver files. You do not have to send optional correspondence or agree to marketing to buy a product.
3. Providers and recipients
Information may be processed by providers of website hosting and security, transactional email, store functionality, payment processing, accounting and professional advice, limited to what their function needs. A payment provider may handle payment and fraud information as an independent controller under its own notice. Card entry occurs through the payment system; our store is not intended to retain full card numbers or security codes.
Our formfield.net store uses Hostinger for hosting and mailbox services and Stripe for payment processing when checkout is available.
- Website hosting & security: Hostinger — website hosting and security
- Order and support email: Hostinger Email — support mailbox and email services
- Payment processing: Stripe — payment processing
Provider notices: Hostinger · Stripe.
We may disclose proportionate information to a competent authority when legally required, or to professional advisers or a payment provider to establish, exercise or defend a legal claim. If the business is transferred, relevant records may be transferred subject to appropriate protections and notice. We do not sell customer personal information or share it for cross-context behavioral advertising.
4. International processing
We are a UK company, and a provider may process information in the UK or other countries. Applicable transfer protections depend on the actual recipient and route. Where a transfer requires safeguards under UK data-protection law, we must use a valid adequacy arrangement or another lawful safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, as appropriate. Where EU rules also apply, their relevant safeguard is required. Contact us for information or an available copy of safeguards for a relevant transfer, subject to lawful redaction.
5. Retention
- Orders, invoices and necessary payment/refund records: normally six years after the end of the relevant accounting period, where necessary for bookkeeping, tax and legal claims.
- Ordinary support correspondence: normally up to two years after resolution, unless a purchase record, unresolved dispute or legal duty requires longer.
- Accounts: while requested account access remains active, then only as necessary for associated records, security or legal duties.
- Technical and security logs: retained according to the period needed to investigate errors, maintain security and handle identified incidents; relevant records may be kept longer for a substantiated incident or claim. The actual provider’s logging settings also govern its retention.
- Local basket: on your device until you remove it or clear the website’s local storage.
We review the need for continued retention. Removing an account or closing a download window does not automatically delete an invoice we must retain. Backups can take a further period to expire through the provider’s backup cycle and are not intended for new marketing or unrelated uses.
6. Security
We use HTTPS and controlled administrative access and aim to limit provider access to its purpose. No network or storage system can be guaranteed risk-free. Protect your device, account and download links. A rights or support request should not include full card details or unnecessary identity documents.
7. Your rights
Depending on the law and processing basis, you may request access, correction, deletion, restriction, a portable copy or withdrawal of consent. These rights have conditions; for example, necessary tax records may remain after a deletion request. Withdrawal of consent does not invalidate earlier lawful processing and does not cancel a separate contractual or legal basis.
Right to object: where we rely on legitimate interests, you may object on grounds relating to your situation. You may object to direct marketing at any time. We currently do not send marketing merely because someone has purchased a poster.
Send a request through Contact or by post. We may seek proportionate verification that protects the information from disclosure to the wrong person. We will respond within the deadline required by applicable law, explain any lawful extension and not charge a fee except where the law allows it. Where applicable US state privacy law grants additional access, correction, deletion or appeal rights, we will handle eligible requests under that law without unlawful discrimination.
You can complain to the UK Information Commissioner’s Office or another competent authority. You do not have to contact us first to make a complaint.
8. Cookies, decisions, children and updates
See Cookies & Website Technology for local storage and store cookies. Our store does not carry out automated decision-making intended to produce legal or similarly significant effects; a payment provider may run its own fraud controls. Purchase access is for adults. If you believe a child has sent unnecessary information, contact us so we can review and handle it.
The date and policy version identify this notice. We will update it as the store and providers change, and provide additional notice where a material change requires it.