Last reviewed: September 2026
The Pen Company is committed to preserving the privacy of all our visitors. This policy provides a brief overview of how we protect the information you provide to us during your usage of our website. We aim to collect as little information as is necessary to provide a secure, reliable and satisfying service.
We will only collect personal information if it is required to:
We will not share this data with third parties, unless:
Unless we have received your consent we will not engage in:
We will never sell your data, even in an aggregated or anonymised state.
How to manage cookies and revoke permissions is explained in this policy.
| Data type | When is this data collected? | Who processes this data? |
|---|---|---|
| Browsing Data | When the website is used | The Pen Company. Analytics Vendor. Website hosting & security providers |
| Email Address | When you place an order, email us or contact us through our website | The Pen Company. Email Providers, Review Services. Google (a hashed version, only with advertising consent) |
| Name | When you place an order, email us or contact us through our website | The Pen Company. Couriers |
| Address | When you place an order | The Pen Company. Couriers |
| Engraving text | When you order an engraved item | The Pen Company |
| Payment Information | When you make a purchase (no card details stored on or passed through our servers) | The Pen Company. Payment Gateway |
| Phone Number | When you place an order, call us or share with us through our website | The Pen Company. Couriers |
Browsing data includes IP address, browser type and any other information passed to us via your browser when you use our service. It is also processed by the companies that host, protect and monitor our website.
Our analytics provider is Google Analytics, acting strictly as our processor (see Cookies below).
Deliveries are made by Royal Mail or another courier, who receive the details needed to deliver your order. Our payment provider is Stripe. We also use trusted providers for email delivery, address lookup and customer reviews.
After a purchase we may email you once inviting you to review your experience. We do this in our legitimate interest to gather honest feedback — and to give you a direct way to tell us if something went wrong. You are free to ignore it, and you can object to review invitations at any time.
Glyph Retail Ltd is the company that operates the thepencompany.live brand.
We will take all reasonable precautions to ensure your information is processed securely and that any processors we use apply at least the equivalent (or stronger) protections required by UK data protection law.
Some of the information we collect may be stored outside the UK — for example by US-based providers such as Google and Stripe. Where that happens, we make sure your data receives the same protection it would at home, using safeguards recognised under UK data protection law: UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the ICO’s approved international transfer agreements.
Your information will enable us to provide you with access to all parts of our website and to supply the goods or services you have requested. It will also enable us to bill you and to contact you where necessary concerning your orders. We will also use and analyse the information we collect so that we can administer, support, improve and develop our business.
In particular, we may use your information to contact you for your views on our services and to notify you occasionally about important changes or developments to the website or our services.
If our business enters into a joint venture with, is sold to, or merged with another business entity, your information may be disclosed to our new business partners or owners.
Why we are allowed to use your data (our legal bases):
For all visitors;
| Data Type | Retention Period |
|---|---|
| Browsing statistics (Google Analytics) | Event data 2 months; user data 14 months. Aggregate statistics that cannot identify anyone may be kept longer |
For customers that have placed an order;
| Data Type | Retention Period |
|---|---|
| Order records (name, address, email address, phone number, engraving text, items bought) | Kept with our billing records for 6 years from the end of the financial year of your order, as tax law requires |
For customers who have consented to marketing or phone contact;
| Data Type | Retention Period |
|---|---|
| Contact details used for marketing | Retained until consent is withdrawn |
We keep our use of cookies deliberately minimal, and we never sell your personal information.
These make the site work: keeping your basket as you browse, remembering your session, processing secure payments (Stripe), and remembering your cookie choices. The site cannot function without them, so they do not require consent. Our reviews widget (Reviews.io) sets its own security cookies on its domain to tell bots from people; they do not identify you. If you play the video on our home page, YouTube sets its own cookies.
We collect statistics about how the site is used (which pages are visited and how people move between them) so we can improve it. We use Google Analytics for this, acting strictly as our processor: the information is used only on our behalf, we do not combine it with other data, and we do not use it to identify you. Google Analytics sets a cookie containing a random number so that it can tell repeat visits from new ones; that number is not linked to your name, email address or order. In the UK this is permitted for statistical purposes and you may opt out at any time, free of charge; use the Manage your cookie preferences panel or the Cookie settings link in the footer. In the EU we ask for your consent first.
In the UK and EU we ask for your consent before using advertising cookies. They help us understand which of our adverts brought you to us, measure their effectiveness in Google Ads, and let Google show you our adverts after you have visited us. If you complete a purchase having consented, we send Google a privacy-protecting hashed (irreversibly scrambled) version of your email address to improve conversion measurement - Google cannot read the address itself. With the same consent we may also share that hashed version with Google Ads so we can show our adverts to existing customers, and to people with similar interests, on Google’s services. You stay in that audience for up to 540 days. Switching advertising cookies off stops any further sharing; emailing us removes you from the audience. If you decline, no advertising cookies are set and the site works exactly the same. For visitors outside the UK, EU and California, these cookies are on by default. You can switch them off at any time via Manage your cookie preferences.
Manage your cookie preferences - you can change your mind at any time, and your choice is remembered for 180 days. Safari limits how long a website can remember a choice made in its cookie banner, so Safari may ask you again after 7 days. We honour the Global Privacy Control (GPC) browser signal as a refusal of advertising cookies: while your browser sends it, advertising cookies stay off and cannot be switched on in the preferences panel. If you are a California resident, GPC or the preferences panel serves as your "Do Not Sell or Share My Personal Information" opt-out for the advertising measurement described above.
| Cookie | Purpose | Set when | Duration |
|---|---|---|---|
| tpc_cc | Your cookie choices: whether statistics and advertising are on or off, and whether you chose or the region default applied | Always | 180 days |
| PHPSESSID | Your browsing session | Always | Until the browser closes |
| jwt, has_session | Session and basket continuity | Always | 14 days |
| vHash_… | Makes sure you receive the current version of our page styling after an update | With a basket or account session | Until the browser closes |
| __stripe_mid / __stripe_sid | Fraud prevention for secure payments (Stripe) | When you open the basket | 1 year / 30 minutes |
| _ga, _ga_… | Google Analytics: tells repeat visits from new ones (a random number) | Statistics on | 2 years |
| _gcl_au | Google Ads: links a purchase to the advert that brought you here | Advertising on | 90 days |
Statistics and advertising cookies are set only according to your choices above. We also use Cloudflare Web Analytics to measure page speed; it sets no cookies and uses no identifiers.
We use TLS everywhere. All data passing between you and our servers is encrypted. Payments and storage of payment information are delegated to our Payment Gateways. We do not store your payment details on our servers.
We may update this privacy policy from time to time by posting a new version on our website; the "last reviewed" date above shows when it last changed.
You may ask us to:
You can withdraw any consent at any time. We do not make automated decisions that have legal effects on you.
Using these rights is free. Email [email protected] and we will respond within one month (especially complex requests can take up to two further months — we will tell you within the first month if so). You can also complain to us directly about how we handle your data, and we will acknowledge your complaint within 30 days. If you are unhappy with our answer, you have the right to complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
The data controller is Glyph Retail Ltd (trading as The Pen Company), registered in England and Wales, company number 07849061.
Unit B2, Astonbury Farm, Astonbury Lane, Hertfordshire, SG2 7EG
All comments, queries and requests relating to our use of your information are welcomed and should be addressed to [email protected]