Last reviewed: 28 September 2026.
Doodles & Scribble is the data controller for the personal information described in this policy, subject to the trader details shown on this page. This policy applies when you browse the site, place an order, track an order, contact us or join the Doodle Dispatch.
Information we collect
Depending on how you use the site, we may collect:
- your name, email address, delivery and billing information;
- order details, products, sizes, colours, prices, fulfilment status and customer-service history;
- payment and transaction references supplied by our payment provider, but not the full card details handled inside Stripe;
- messages you send through our contact or support forms;
- newsletter subscription information and your marketing preferences;
- order-reference and email details submitted to the Track Order tool;
- technical, security and diagnostic information such as IP address, browser information, request logs and session identifiers where required to operate and secure the service;
- country or storefront preferences saved on your device; and
- customer-supplied artwork or instructions if a custom-product feature is made available and you choose to use it.
Why we use it and our lawful bases
- To take and fulfil orders: because processing is necessary to perform our contract with you or take steps you request before entering into a contract.
- To process payments and prevent fraud: for performance of the contract, legal obligations and our legitimate interests in operating a secure store.
- To provide support, manage returns and resolve disputes: for the contract, legal obligations and our legitimate interests in keeping accurate customer-service records.
- To keep accounting, tax and compliance records: because we may be legally required to do so.
- To secure, diagnose and improve the website: where necessary for our legitimate interests in maintaining a reliable and secure service, balanced against your rights.
- To send marketing: where you have consented, or where another lawful electronic-marketing route applies and you are given the required opportunity to opt out.
Payments
Payments are processed using Stripe. Payment fields may be provided directly by Stripe, which means sensitive card information is handled by Stripe rather than stored as full card data by Doodles & Scribble. Stripe processes information under its own privacy arrangements as well as acting as a service provider for parts of the payment process.
Who we share information with
We share only what is reasonably necessary with categories of recipients involved in running the store, including:
- payment and fraud-prevention providers such as Stripe;
- production, fulfilment and delivery providers, including Printful where it fulfils an order;
- website hosting, infrastructure, email and technical-service providers;
- professional advisers where reasonably necessary; and
- regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.
We do not sell your personal information to advertisers.
International processing
Some service providers may process personal information outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, we use or rely on an appropriate legal mechanism, such as an adequacy regulation or approved contractual safeguards, as applicable to the provider and destination.
Data retention - how long we keep information
Our retention approach is to keep personal information only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, tax, fraud-prevention and dispute periods. Order and transaction records are retained for the period needed to meet those obligations. Support records are kept for a reasonable period after the issue is resolved. Marketing subscription information is kept until you unsubscribe or it is no longer needed, subject to keeping a minimal suppression record where necessary to respect an opt-out.
Marketing choices
If you join Doodle Dispatch, you can unsubscribe using the option provided in marketing messages or by contacting us. Withdrawing marketing consent does not affect the lawfulness of processing that happened before withdrawal and does not stop service messages needed for an order.
Cookies and device storage
We use cookies and similar storage where needed to operate the site, remember a preference or provide checkout functionality. See our Cookie Policy for current details.
Your data protection rights
Depending on the circumstances, UK data protection law can give you rights to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask for deletion in circumstances where the law gives you that right;
- ask us to restrict processing;
- object to certain processing, including direct marketing;
- receive certain information in a portable format; and
- withdraw consent where consent is the lawful basis.
These rights are not absolute in every situation. We may need to verify your identity before acting on a request. To exercise a right, contact us.
Automated decisions
We do not currently use solely automated decision-making about customers that produces legal or similarly significant effects.
Security
We use technical and organisational measures intended to protect personal information, including access controls, secure session handling, encrypted HTTPS connections and restricted administrative access. No internet service can promise absolute security, so we also monitor and improve controls as the site changes.
Children
We sell products that may be intended for children, but the website and checkout are intended for adults making purchases. We do not knowingly ask children to create customer accounts or provide payment information.
Complaints
Please contact us first if you have a privacy concern so we can try to resolve it. You also have the right to complain to the UK Information Commissioner's Office. Information about making a complaint is available at ico.org.uk.
Changes to this policy
We may update this policy when our services or legal obligations change. The review date at the top tells you when this version was last checked. Material new uses of personal information will be brought to people's attention where the law requires it.