Effective from: 24 July 2026
1. Who we are
Bluezon Limited trading as You Said It is responsible for You Said It Connect.
Company number: 06479756. Registered office: Unit 12 Currock Road, Carlisle, Cumbria, England, CA2 5AD.
For merchant account and website information, Bluezon Limited generally acts as controller. For customer and recipient information supplied by a merchant for fulfilment, the merchant is normally the controller and Bluezon Limited acts as processor or service provider.
2. Scope
This policy applies when you visit the Connect website, create or use an account, place or fulfil orders, upload artwork, contact us, or install and use a supported store integration, including the You Said It Connect Shopify app.
Merchants must provide their own customers with appropriate privacy information explaining that order information may be shared with fulfilment providers such as Connect.
3. Information we collect
Account information: name, business name, email address, contact details, billing details, account preferences, security information, support messages and account activity.
Order and fulfilment information: recipient name and UK delivery address, order details, product and SKU information, artwork, images, personalisation, inner messages, dispatch status, delivery service and tracking information.
Payment information: payments may be processed by providers such as PayPal or a card-payment provider. We do not store complete payment-card details.
Technical information: IP address, browser and device details, cookie identifiers, application logs, security events and information about how the website and integrations are used.
4. Shopify and other integrations
When a merchant installs or connects the Shopify app, the merchant authorises the permissions shown during installation. Depending on the approved permissions, Connect may access shop details, products, SKUs, eligible orders, line items, recipient details, order notes and fulfilment status.
Protected customer data is used only to import, match, print, dispatch, support and update orders requested by the merchant. It is not sold, used for unrelated advertising or used to market directly to a merchant's customers.
Connect supports Shopify's mandatory customer-data request, customer-data erasure and shop-erasure processes through Shopify privacy webhooks.
Equivalent order, product, customer and fulfilment information may be processed through WooCommerce, eBay or another integration where the merchant enables it.
5. How and why we use information
We use personal information to operate accounts, provide the service, import and match orders, print and dispatch cards, provide support, communicate about fulfilment, secure the service, prevent fraud and misuse, improve reliability, and meet tax, accounting, legal and platform obligations.
6. Lawful bases
Where UK GDPR applies, we rely on one or more of the following lawful bases: performance of a contract, compliance with a legal obligation, our legitimate interests in operating and securing Connect, and consent where the law requires it, including for non-essential cookies.
Where we process recipient information on a merchant's instructions, the merchant is responsible for identifying the lawful basis for that processing.
8. International transfers
Some suppliers may process information outside the UK. Where required, we use a lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another legally recognised safeguard.
9. How long we keep information
We keep information only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, resolving disputes, preventing fraud and meeting legal, tax and accounting requirements.
Account and integration information is generally retained while the account remains active and for a limited period after closure. Order and transaction records may be retained for up to six years after the relevant accounting period where required for tax, accounting or legal purposes. Artwork and personalisation may be retained while needed to fulfil orders, support repeat orders or resolve issues, and may be removed earlier at the merchant's request where no legal or operational reason requires retention.
Security logs and analytics information are retained for shorter periods determined by operational need and the settings of the relevant service.
10. App uninstall and account closure
When the Shopify app or another integration is disconnected, API access is revoked. Integration data that is no longer needed is deleted or anonymised within a reasonable period, subject to order, accounting, fraud-prevention, dispute and legal-retention requirements.
Shopify privacy webhook requests are handled in accordance with Shopify's requirements.
11. Your privacy rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, request portability and withdraw consent.
A customer whose information was supplied by a merchant should normally contact that merchant first. We assist merchants with valid requests and respond directly where Bluezon Limited is the controller.
You may complain to the UK Information Commissioner's Office if you are unhappy with how your information has been handled.
12. Security
We use measures including HTTPS, access controls, secure password handling, restricted staff access, monitoring, logging, data minimisation, backups and supplier controls. No online service can be guaranteed completely secure.
14. Children
Connect is a business fulfilment service and is not directed at children. We do not knowingly allow children to create Connect accounts.
15. Changes to this policy
We may update this policy when our services, suppliers, legal obligations or platform requirements change. The latest version and effective date will be shown on this page.
16. Contact
Privacy questions and requests can be sent through our contact page.