Version: 1.0. Effective from 1 May 2026.
This notice describes the categories of recipients that may process or receive Merchant Customer Data when Prodigi provides print-on-demand and fulfilment services to its merchants. It is published in connection with, and forms part of, the Prodigi Group Data Processing Addendum (the "DPA").
Capitalised terms used and not defined in this notice have the meaning given in the DPA.
1. How to read this notice
Prodigi operates a distributed global fulfilment network of group companies, third-party production and fulfilment partners, logistics providers and technology providers. To provide the Services, Prodigi may share Merchant Customer Data with the categories of recipients listed in section 3, in the locations listed.
Prodigi limits the data shared with each recipient category to what is reasonably necessary for that recipient to perform its role. For production and delivery in particular, Prodigi typically shares only the limited fulfilment data described in section 2.
Prodigi does not sell Merchant Customer Data and does not use Merchant Customer Data to market directly to Merchant customers.
2. Limited fulfilment data
For production and delivery, Prodigi typically discloses only limited fulfilment data, such as:
- recipient name;
- delivery address;
- contact details where required for delivery or support;
- order details;
- product configuration;
- image or artwork file required to manufacture the product;
- shipping and tracking information.
3. Recipient categories
Some recipients act as subprocessors to Prodigi, while others may act as independent controllers depending on their role, the service provided and applicable law. For example, shipping carriers, payment service providers, tax authorities and professional advisers typically act as independent controllers in respect of the personal data they process for their own purposes. The table below describes both types of recipient where relevant.
| Recipient category | Purpose | Typical data processed | Typical locations |
|---|---|---|---|
| Prodigi group companies | Platform operation, fulfilment, customer support, billing support, administration and group services. | Merchant account data, order data, limited fulfilment data, support data and technical data. | UK, EEA, US and other group locations. |
| Cloud hosting and infrastructure providers | Hosting, storage, compute, networking, security and platform operation. | Platform data, order data, image and artwork files, logs and technical data. | UK, EEA, US and other service regions. |
| Software and technology providers | Platform tools, monitoring, analytics, workflow tools, email, authentication and internal systems. | Merchant account data, support data, order references, technical data and limited Merchant Customer Data where required. | UK, EEA, US and other service regions. |
| Production and fulfilment partners | Manufacturing, printing, finishing, packing, dispatch, quality control and reprints. | Recipient name, delivery address, order details, product configuration, image or artwork file and shipping data. | UK, EEA, US, Australia and other fulfilment regions. |
| Logistics, postal and carrier providers | Delivery, shipping, tracking, customs, returns and delivery support. | Recipient name, delivery address, contact details where required, shipment contents information, tracking data and customs data where required. | Destination and transit countries. |
| Payment, billing and fraud providers | Payment processing, billing, fraud prevention and financial administration. | Merchant account data, payment information, transaction data, order references and fraud-prevention data. | UK, EEA, US and other service regions. |
| Professional advisers and compliance providers | Legal, accounting, audit, insurance, compliance and dispute handling. | Relevant account, order, support or transaction data where required. | UK, EEA and other relevant locations. |
4. Production and fulfilment partners
Prodigi engages production and fulfilment partners to manufacture and dispatch orders, particularly in countries where Prodigi does not operate its own production facility. Partners receive only the information reasonably necessary to produce and ship each relevant order.
In line with clause 8.11 of the DPA, Prodigi publishes recipient categories and typical processing locations rather than a public list of named production partners. Production routing changes over time, and partner identity, capacity, capability and routing logic form part of Prodigi's commercial and operational infrastructure. Where required by applicable Data Protection Laws, or where agreed under an enterprise or strategic platform agreement, further information about the production and fulfilment partners applicable to a Merchant's orders may be made available subject to confidentiality obligations and reasonable scope limits.
5. International transfers
To provide the Services, Prodigi may transfer Merchant Customer Data internationally between group companies and to subprocessors and fulfilment partners. Where a Restricted Transfer requires appropriate safeguards, Prodigi uses appropriate transfer mechanisms as required by Data Protection Laws. These may include adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful transfer mechanism.
Further information about international transfers is available on request to dpo@prodigi.com.
6. Notice of changes
Prodigi may update this notice from time to time as its business, fulfilment network and service providers evolve. Where required by applicable Data Protection Laws, Prodigi will provide notice of material changes to subprocessors. Notice may be given by updating this page, by email, through the dashboard or by another reasonable method.
Merchants who would like to be notified by email of material changes can subscribe by writing to dpo@prodigi.com.
Merchants may object to a material new subprocessor on reasonable data protection grounds within thirty (30) days of the relevant notice, in accordance with clause 8.8 of the DPA.
7. Contact
Questions or notifications relating to this notice should be addressed to dpo@prodigi.com.