Who this notice covers
Green Cup Group Ltd operates greencupgroup.co.uk, its connected customer portal and the Green Cup mobile app. Its company number is 14219850 and its registered office is Unit 5 Evingar Industrial Estate, Ardglen Road, Whitchurch, England, RG28 7BB. The company owner personally handles privacy questions and requests at [email protected].
The mobile app connects existing customer, designer, salesperson, director and authorised staff accounts. Access depends on the account's company and permissions. A salesperson can create a customer business record; this does not itself create a new customer login. This notice covers Green Cup's direct services. A partner that provides its own branded service may also need to explain its separate responsibilities.
Information used by the services
- Account and contact details: name, email, protected sign-in information, company or customer references, contact numbers and saved delivery addresses. A business customer or authorised salesperson may provide these details for a contact.
- Orders and business records: products, quantities, agreed prices, purchase and fulfilment history, invoices, payment references and communications. Authorised sales accounts also show their commission and recorded payment information.
- Artwork and messages: files you choose to upload, project briefs, order questions, studio conversations, approvals, revision history and translations. Artwork can contain personal information; include only what is needed for the job.
- Operational information: account and record identifiers, permission and workflow records, request and error information, and network addresses handled by the service and its security providers. Optional phone notifications also use installation and notification identifiers.
Why information is used
Green Cup uses this information to authenticate accounts, apply permissions, prepare and fulfil orders, coordinate artwork, arrange delivery, provide documents and support, calculate agreed sales commissions, and keep the service secure and working.
Depending on the activity and relationship, information is used to fulfil a contract with an individual, meet relevant legal obligations, or support legitimate interests in serving business customers, coordinating authorised work and protecting the service. Where processing relies on consent, that consent can be withdrawn for future use.
Files and information on your phone
The app uses the system file picker for files you choose. The current app does not request access to your camera, microphone, device address book or device location. Business contact records entered by a salesperson are separate from the phone's address book.
The app keeps its saved sign-in token in the phone's secure storage. Temporary downloaded documents are removed from the app's document cache after sharing, and the cache is cleared on startup and sign-out. Copies you save or share outside the app remain under your control. Signing out is not a request to delete server records.
Optional AI translation
Authorised studio staff and salespeople can translate selected messages or draft replies using OpenAI. This can include a customer's original message, printing references, quoted copy and terminology needed to preserve its meaning. The selected material is sent through Green Cup's server to OpenAI; formatting protections for print values are not a removal of personal information.
Before an AI translation request in the app, the person using translation is asked whether to send the selected material to OpenAI. They can cancel, read the original or enter a reply manually. Successful translations are saved with the relevant artwork record. Staff review a prepared reply before sending it to the customer.
A customer's message may therefore be translated by the studio even when the customer does not press a translation button. Please leave out sensitive personal information that is not needed for the artwork or order.
Optional phone notifications
Authorised designer, sales and owner accounts can choose to enable phone alerts. Expo's notification service and Apple Push Notification service support iPhone delivery. Registration uses an app installation identifier, a native notification token, the Expo notification token and app/project information. Green Cup links its device registration to the signed-in account.
Alert text is generic. The delivery payload can also contain record identifiers needed to open the relevant conversation or workspace; it does not include artwork files, customer names or financial figures in the displayed alert text.
Notifications can be disabled in the app or phone settings. Green Cup's delivery for that registration is then disabled. Provider-held identifiers can remain subject to the delivery service's processing and retention arrangements.
Services that help deliver the service
Information is handled by authorised Green Cup staff and the providers needed for the feature being used. Cloudflare provides website delivery and security. Expo and Apple provide optional phone notification delivery. OpenAI processes material selected for AI translation.
Stripe handles payment entry when website payment is opened. The native app does not ask for a complete card number. Green Cup receives the payment references and business records needed to process orders. Ideal Postcodes supports postcode lookup when that feature is used; addresses can also be entered manually.
Business email, accounting, delivery and professional service providers may receive the information needed for the enquiry, order, invoice or obligation they handle.
Security and operational records
The service processes request and error information, including network addresses, request paths and response status, to protect accounts, investigate faults and keep the service working. These records are separate from artwork and order records.
The current native app does not contain advertising or analytics features. Account, security and notification identifiers are still used for the purposes described in this notice.
Where information is processed
The main portal records are held on Green Cup's server. External services, including notification delivery, AI, payment and security services, can involve processing outside the UK.
The owner can be contacted for information about the providers, processing locations and safeguards relevant to your information.
How long records are kept
Records are reviewed according to their purpose: maintaining account access, completing and supporting orders and artwork, meeting financial record-keeping duties, dealing with complaints or disputes, and protecting the service. Artwork and messages are kept only while needed for those purposes, including relevant repeat orders or quality evidence.
Company accounting records normally need to remain for six years from the end of the last company financial year they relate to, with longer retention in applicable circumstances. This does not mean every artwork file or conversation must be kept for six years.
Closing an account does not automatically remove financial records or other information that must remain. A deletion request is reviewed separately from the company's need for an order history. If protected backups or provider-held records are affected, the owner will explain their handling as part of the response; deletion is not represented as immediate or automatic.
Your choices and requests
You can ask to access or correct information, request deletion or restriction, object to qualifying processing, or request a portable copy where applicable. If processing relies on consent, you can withdraw that consent for future use. Rights can have exceptions depending on the processing.
The owner personally handles requests sent to [email protected]. You can also raise a request through another contact channel; no special wording or form is required. Include enough information to identify the account and records concerned, without sending a password or payment-card details. Identity or authority may need to be checked.
The app's deletion-request button opens an email; it does not immediately delete the account. The response will explain what can be removed, any justified information that remains, and relevant backup handling. Business-managed accounts may involve the customer or employer that provided access.
Questions or complaints
The company owner also handles privacy concerns at [email protected] or through the registered office above. Explain what happened and how you would like to be contacted. You can raise a concern with the UK Information Commissioner's Office or, where applicable, the relevant EU supervisory authority.