Privacy Policy

Last updated: 8 June 2026

Printfly Corporation, trading as Ninja Transfers (“we”, “us”, “our”) operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”). Our store is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. It is written to meet our obligations under UK data protection law, including the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

For the purposes of UK data protection law, we are the data controller of your personal information. Our contact details are set out in the “Contact” section at the end of this policy.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described here.

When we use the term “personal information,” we mean information that identifies or can reasonably be linked to you or another person. It does not include information collected anonymously or that has been de-identified so that it cannot identify or be reasonably linked to you. Depending on how you interact with the Services, we may collect or process the following categories of personal information, including inferences drawn from it:

•     Contact details including your name, billing address, shipping address, phone number, and email address.

•     Financial information including payment card information, financial account information, transaction details, form of payment, and payment confirmation. We do not store full payment card details; these are handled by our payment processors.

•     Account information including your username, password, security questions, preferences and settings.

•     Transaction information including the items you view, add to your cart or wishlist, or purchase, return, exchange or cancel, and your past transactions.

•     Communications with us including the information you include when you contact us, for example a customer support enquiry, and any images or artwork you upload for your order.

•     Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.

•     Usage information including how and when you interact with or navigate the Services.

We may collect personal information from the following sources:

•     Directly from you, including when you create an account, visit or use the Services, communicate with us, or otherwise provide us with your personal information.

•     Automatically through the Services, including from your device when you use our products or visit our website, and through the use of cookies and similar technologies (subject to your consent — see “Cookies” below).

•     From our service providers, including when we engage them to enable certain technology or when they collect or process your personal information on our behalf.

•     From our partners or other third parties.

We only use your personal information where UK data protection law gives us a lawful basis to do so. The table below sets out our purposes and the lawful basis we rely on for each.

Purpose	Lawful basis under UK GDPR
Provide the Services: process payments, fulfil and ship your orders, handle returns, exchanges and cancellations, create and manage your account, and remember your preferences	Performance of a contract
Send service messages, such as order confirmations and dispatch and delivery updates	Performance of a contract
Provide customer support and maintain our business relationship with you	Performance of a contract / Legitimate interests
Tailor and improve the Services, including recommending products and improving how the Services work	Legitimate interests / Consent (for non-essential cookies)
Send marketing, advertising and promotional communications, and show you relevant online advertising	Consent (or the soft opt-in for existing customers)
Authenticate your account, secure the Services, and detect, investigate and prevent fraud or unsafe activity	Legitimate interests
Comply with applicable law, respond to valid legal process, and establish, exercise or defend legal claims	Legal obligation / Legitimate interests

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for more information about that assessment at any time using the contact details below.

We will only send you marketing communications where you have opted in, or where you are an existing customer and we are contacting you about similar products (the “soft opt-in”), unless you have told us you do not want to hear from us.

You can withdraw your consent or unsubscribe at any time using the “unsubscribe” link in any marketing email or by contacting us at service@ninjatransfers.com. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal. If you opt out of marketing, we may still send you non-promotional messages, such as those about your account or orders you have placed.

We disclose your personal information to the following categories of recipient for the purposes described in this policy. Where these recipients act as our processors, they are bound by data processing agreements and may only use your information on our instructions.

•     Shopify, which hosts our Services and store data (see “Relationship with Shopify” below).

•     Payment processors (for example, Shopify Payments), who process your payments securely.

•     Shopify Email, part of the Shopify platform, to send service and marketing communications.

•     Shopify Inbox, our customer support tool, to manage and respond to your enquiries.

•     Cross-border, customs and shipping providers, including Shopify Managed Markets / Global-e (which acts as merchant of record for international orders) and our delivery carriers, to calculate duties and taxes and to fulfil and ship your order.

•     Imgix, our image processing and delivery provider, to handle the artwork and images you upload for your order.

•     Analytics and advertising partners, where you have consented, to help us understand and improve the Services and to deliver relevant advertising. These partners use your information in accordance with their own privacy notices.

•     Professional advisers and authorities, such as accountants, auditors, lawyers, regulators, and law enforcement, where required by law or to protect our rights.

•     In connection with a business transaction, such as a merger, acquisition, financing, or insolvency.

•     When you direct or consent to disclosure to a third party, for example through your use of social media widgets or login integrations.

We do not sell your personal information.

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you.

In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over the use of your personal information for these purposes.

To learn more about how Shopify uses your personal information and any rights you may have, including rights related to data processed by Shopify, you can visit the Shopify Consumer Privacy Policy at https://privacy.shopify.com/en.

We are based in the United States, and some of our service providers are located in the United States and other countries outside the UK. This means your personal information will be transferred to, stored, and processed outside the UK.

Where we transfer your personal information out of the UK, we rely on a recognised safeguard to protect it, namely:

•     transfer to a country covered by UK adequacy regulations; or

•     the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

You can request a copy of the safeguards we use by contacting us at service@ninjatransfers.com.

We use cookies and similar technologies on our website. Strictly necessary cookies are essential for the Services to work and are set automatically. We only set non-essential cookies — such as analytics and advertising cookies — with your consent, which you give through our cookie banner and can change or withdraw at any time. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

The Services are intended for adults and are not directed at children. We do not knowingly collect personal information from children under the age of 13. If you are the parent or guardian of a child who has provided us with their personal information, please contact us using the details below and we will delete it.

We use appropriate technical and organisational measures to protect your personal information, including encryption, access controls, and supplier due diligence. However, no security measures are perfect or impenetrable, and we cannot guarantee absolute security. Any information you send to us may not be secure while in transit, so we recommend you do not use unsecure channels to send us sensitive or confidential information.

How long we keep your personal information depends on the purpose for which we hold it:

•     Order and transaction records — 6 years, to meet our tax and accounting obligations.

•     Account information — for as long as your account remains active, then deleted within 12 months of closure.

•     Marketing information — until you unsubscribe or withdraw consent, after which your details are suppressed or deleted.

•     Customer support records — typically up to 2 years after your enquiry is resolved.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office and, where required, you.

Under UK data protection law you have the following rights in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and may be subject to exceptions under applicable law:

•     Right to be informed about how we use your personal information.

•     Right of access to a copy of the personal information we hold about you.

•     Right to rectification of inaccurate or incomplete personal information.

•     Right to erasure of your personal information (“right to be forgotten”) in certain circumstances.

•     Right to restrict processing in certain circumstances.

•     Right to data portability — to receive a copy of your personal information in a portable format and, where technically feasible, to have it transferred to a third party.

•     Right to object to processing based on our legitimate interests, and to direct marketing at any time.

•     Right to withdraw consent at any time, where we rely on consent. This does not affect the lawfulness of processing before withdrawal.

•     Rights relating to automated decision-making and profiling, where applicable.

To exercise any of these rights, contact us at service@ninjatransfers.com. We will respond within one month, as required by law. We may need to verify your identity before acting on your request. You may also designate an authorised agent to make a request on your behalf, in which case we will require proof of that authorisation.

We will not discriminate against you for exercising any of these rights.

If you have a complaint about how we process your personal information, please contact us first at service@ninjatransfers.com so we can try to resolve it.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

•     Website: ico.org.uk

•     Helpline: 0303 123 1113

•     Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated with or controlled by us, you should review their own privacy and security policies. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on them. Our inclusion of such links does not imply any endorsement of those platforms or their operators, except as disclosed on the Services.

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the “Last updated” date above, and provide notice where required by applicable law.

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of your rights, please contact us:

Printfly Corporation DBA Ninja Transfers

2727 Commerce Way, Philadelphia, PA 19154, US

Email: service@ninjatransfers.com

For the purposes of applicable UK data protection law, Printfly Corporation, trading as Ninja Transfers, is the data controller of your personal information.

UK representative (UK GDPR Article 27): [TO BE CONFIRMED — see note]

ICO registration number: [TO BE CONFIRMED — see note]