Who is responsible
The controller for personal data processed through this website is 9 Dijital Ltd. Şti., Istanbul, Türkiye, which operates the brand 9 Packaging (“we”, “us”). For any privacy question or request, write to hello@packaging9.com.
This policy explains which personal data we process when you visit packaging9.com, request a quotation or send an order request through our shop. Our website is aimed at business customers, so the data we receive is usually the business contact details of people who work for them.
Quotation and contact requests
When you use the quotation form on our contact page or the quotation panel on other pages, we process the details you enter: name, company, business email, phone number (optional), job title, country, product and specification details, quantities, delivery details, your message and any files you attach, such as artwork, drawings, photos or PDFs. With your request we also receive the page you sent it from, the site language, the time of submission and, if they are present in the link you followed, campaign parameters (UTM tags).
We use this data to answer your request, prepare a quotation and communicate with you about it. The legal basis is the taking of steps at your request before entering into a contract, and the performance of a contract (Art. 6(1)(b) GDPR and UK GDPR). Where you contact us on behalf of your company, we also rely on our legitimate interest in communicating with business customers and their staff (Art. 6(1)(f)).
Form submissions, including any files you attach, are received and stored by our form service provider Formspree, which forwards them to us by email (see “Service providers and international transfers” below).
Shop order requests
When you send an order request through our shop, we process your contact and company details (including a VAT or tax ID if you provide one), delivery details, the products you configured, quantities, your notes and any artwork files you upload. We store your order, together with any uploaded files, on our web server. The order details and files are also sent to us through our form service provider Formspree. After submitting, you can follow the status of your order on a page reached through a private link.
No online payment takes place on this website and we do not process payment card data. We use order data to check your order, send you a proforma invoice and a digital proof, produce and deliver the goods, and keep the business records we are required to keep. The legal basis is the performance of a contract and pre-contractual steps (Art. 6(1)(b)). Where needed for delivery, we pass delivery details to the transport company handling the shipment.
Cookies and browser storage
Google Analytics cookies are only set if you agree to them (see “Website analytics” below). Apart from that, we do not set cookies for visitors, and we do not use advertising tools, tracking pixels or social media plug-ins.
To make the website work, a small amount of information is saved in your browser, such as the contents of your shopping cart, whether you have already seen the intro animation on our homepage, and your choice about analytics. This information contains no contact details and stays on your device; your cart contents are used only to show prices and to send your order request. You can delete it at any time in your browser settings.
Website analytics (Google Analytics)
We use Google Analytics 4, a service provided by Google, to understand how our website is used and to improve it. We use Google’s consent mode, so what Google Analytics does depends on your choice under “Privacy settings” at the bottom of every page:
- Until you choose: Google Analytics sets no cookies and stores nothing on your device. It receives cookieless measurement signals about the page you view and interactions such as requesting a quotation or sending an order request, together with technical information such as your browser and device type and the approximate location Google derives from your connection. These signals carry no identifier stored on your device, so your visits are not linked to each other.
- If you accept analytics: Google Analytics also sets its cookies (such as _ga) and recognises returning visits pseudonymously.
- If you reject: Google Analytics is switched off and no analytics data is sent.
Google Analytics never receives the content of forms, names, email addresses, phone numbers or files. We do not use Google’s advertising features.
Google may process this data in the United States or other countries. For more information, see Google’s privacy policy.
The legal basis for cookieless measurement is our legitimate interest in understanding and improving our website (Art. 6(1)(f) GDPR and UK GDPR); for analytics cookies it is your consent (Art. 6(1)(a)). Analytics data is kept for the period set in our Google Analytics data retention settings. You can change your choice at any time through “Privacy settings”; withdrawing consent does not affect processing that took place before.
Hosting, security and spam protection
Our website runs on the servers of a hosting provider. When you visit the site, the hosting provider processes the technical connection data needed to deliver it, such as your IP address, the date and time of the request, the page requested and information about your browser. Our forms also use technical measures against automated spam. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f)).
Service providers and international transfers
Formspree, Inc. (United States) receives and stores our form submissions as our service provider (processor) and forwards them to us by email. According to Formspree, its services are hosted with Amazon Web Services in the United States, and it uses further sub-processors, which it lists on its website. Data you submit through our forms is therefore processed in the United States. For international data transfers, Formspree states that it relies on Standard Contractual Clauses (SCCs) as a data processor. More information: Formspree privacy policy.
Within our company, only the people who handle your request or order have access to your data. We also use the hosting provider mentioned above and, for deliveries, transport companies. We disclose data to authorities only where we are legally required to do so. We do not sell personal data.
How long we keep data
We keep personal data only for as long as it is needed for the purposes described above: to handle your request and any business relationship that follows, and for as long as statutory retention obligations, for example under commercial and tax law, require. After that, the data is deleted.
Your rights
Under the GDPR and UK GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing and to receive it in a portable format. You can object at any time to processing based on our legitimate interests (Art. 21 GDPR). To exercise your rights, write to hello@packaging9.com.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where you believe your rights were infringed. In the United Kingdom, this is the Information Commissioner’s Office (ICO).
For visitors in Türkiye, our information notice under the Turkish Personal Data Protection Law is available in Turkish. Visitors from other countries, including the United States, may have similar rights under their local laws; contact us and we will respond in line with the law that applies.
Providing your data is voluntary, but we cannot answer a request or process an order without the contact details required in the form. We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you.
Changes to this policy
We update this policy when our website, our services or the legal requirements change. The current version is always published on this page, with the date of the last update shown above.