Privacy policy

Last updated: 15 September 2026

This policy explains what Era Manufacturing Ltd ("Era Pack", "we") does with your personal information when you use erapack.uk. It is written to describe this website specifically, rather than to cover everything a shop could possibly do, so where it says we do not do something, we do not do it.

We are the data controller for the information described here. Our contact details are at the bottom.

The short version

We collect what you type into our forms, and nothing you have not typed.
We count page views, using Vercel Web Analytics. We run no advertising pixels, we do not profile you, we do not build an audience from you, and we do not sell or share your information for anyone else's marketing.
We set two cookies ourselves, both strictly necessary to make the site work.
Your card details never reach our servers. Stripe takes them directly.
Your information is stored in the European Economic Area.

What we collect, and when

We collect personal information at six points, and only at those six points.

When you contact us — your name, email address, and if you give them, your phone number, company name, what your enquiry is about, and the message itself.
When you request samples — your name, email address, delivery address, and if you give them, your company name, phone number, the sizes and wall type you are interested in, a message, and any artwork file you attach.
When you ask for help with a design — your email address, your name if you give it, the design you built in our online designer, a preview image of it, and any artwork file you attach.
When you place an order — your name, email address, delivery address, company name if you give one, what you ordered, the artwork for it, and a reference that lets us match the order to the payment. We do not receive or store your card number, expiry date or security code at any point.
When you create an account — your email address and password, and anything you choose to save to your profile: your name, company name and delivery address, so you do not have to type them again.
When you sign up to our newsletter — your email address, and which page you signed up from.

Separately, our servers keep short-lived technical logs of requests, which include your IP address. We also hold your IP address briefly in memory to limit how many times a form can be submitted per minute, which is how we stop the forms being abused. Neither is used to identify you or to build a profile.

Measuring how the site is used

We use Vercel Web Analytics to count page views, so we can see which pages people actually use. For each page view it records the page address, the site you arrived from, your country, your device type, your browser and operating system, any campaign tags in the link you followed, and a device identifier generated by the service.

We use this only to understand how the site is used. It is not linked to your account or your orders, it is not used to advertise to you, and it does not follow you to other websites. We do not add any tracking of our own on top of it — there are no custom events in this site's code.

If you would rather not be counted, a browser set to send a "Do Not Track" signal, a tracker blocker, or private browsing will all prevent it. Nothing on this site stops working if you block it.

Cookies and what is kept on your device

We set two cookies of our own, and both are strictly necessary for the site to work:

A session cookie, set when you sign in, so that you stay signed in. It is removed when you sign out.
A maintenance preview cookie, which only exists for our own staff and only while the site is behind a holding page.

Your basket and any design you are working on are kept in your own browser's storage, on your own device. They are not sent to us unless and until you place an order or ask us for help with the design. Clearing your browser data removes them and we never see that they existed.

We do not use advertising cookies and we load no fonts, images or third-party tracking technology as you browse. The one script we load besides our own is the Vercel Web Analytics script described below, and it is served from this domain rather than from somewhere else.

Why we use it, and on what legal basis

To fulfil your order — printing your cups, delivering them, taking payment, handling a problem with a job. Legal basis: performance of our contract with you.
To answer you — replying to an enquiry, sending samples, checking artwork before it goes on a press. Legal basis: our legitimate interest in responding to people who contact us, or steps taken at your request before entering a contract.
To keep our records — accounts, VAT, and being able to evidence what was agreed. Legal basis: compliance with our legal obligations, and our legitimate interest in defending a claim.
To send our newsletter — only if you have asked for it. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in any newsletter or by emailing us.
To keep the site working and secure — request logs and rate limiting. Legal basis: our legitimate interest in running a site that is not abused.

We do not use your information for advertising or for automated decision-making, and we do not carry out profiling.

Who else sees it

We use four service providers. They process personal information on our instructions and for no purpose of their own.

Vercel — hosts the website, runs its code, and provides the page-view analytics described below.
Supabase — provides the database where orders, enquiries and accounts are stored, and the service that signs you in. Our database is hosted in Ireland.
Stripe — takes the payment. You enter your card details into Stripe's own payment form, which is embedded in our checkout page; those details go to Stripe and never pass through our servers. Stripe tells us only whether the payment succeeded and gives us a reference.
Resend — sends the emails we send you, such as an order confirmation.

Your order also passes into our own internal production system so the job can be made. That system is ours, run by us, in the same database.

Beyond those, we disclose personal information only to our couriers so that your cups can be delivered, to our accountants and professional advisers where they need it, and where we are required to by law or to establish or defend a legal claim. We do not sell your personal information, and we do not share it with anyone for their own marketing.

Where your information is held

The database holding your orders, enquiries and account is in Ireland, within the European Economic Area.

Some of our providers are US companies and may access data from outside the UK in the course of supporting their services. Where that happens, the transfer is covered by the UK's International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, or by an adequacy decision, as applicable.

How long we keep it

Orders and their invoices — six years from the end of the accounting period they fall in, because UK tax law requires us to keep business records for that long.
Artwork you send us — six years, so that a repeat order can be printed from the file you already approved rather than set up again. Tell us and we will delete it sooner.
Enquiries, sample requests and design enquiries — 24 months from our last contact with you about them.
Your account — until you ask us to close it.
Newsletter subscription — until you unsubscribe.
Server request logs — a short period set by our hosting provider, measured in days.
Page-view analytics — retained by Vercel for the period their plan provides. It is counts, not records about you.

Your rights

Under UK data protection law you have the right to ask us for a copy of the personal information we hold about you, to have it corrected if it is wrong, to have it deleted, to ask us to restrict how we use it, to object to our using it where we rely on legitimate interests, and to receive it in a portable form. Where we rely on your consent — which is only for the newsletter — you can withdraw it at any time, and that does not affect anything we did before you withdrew it.

Some of these rights have limits. We cannot delete an order record we are legally required to keep, for example, though we can stop using it for anything else.

To exercise any of them, email us at the address below. We will respond within one month. We do not charge for this, and we will not treat you any differently for asking.

If you are not satisfied with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Security

The site is served over HTTPS. Passwords are hashed by our authentication provider and we never see them. Card details never reach us. The database role the website uses can reach only the website's own tables, so a compromise of this site cannot reach our production records. Our forms are rate-limited against abuse.

No system is perfectly secure, and email in particular is not a secure channel — please do not send us anything confidential by email that you would not want read in transit.

Children

This site sells printed packaging to businesses. It is not intended for children and we do not knowingly collect information about them. If you believe a child has given us their information, contact us and we will delete it.

Changes

If we change how we use your information, we will update this policy and change the date at the top. If the change is significant we will tell the people it affects.

Contact

Era Manufacturing Ltd, Unit 7c Britannia Estate, Luton, LU3 1RJ, United Kingdom.
Email: Hello@erapack.uk
Telephone: 020 3051 3982

We are the data controller for the personal information described in this policy.