Privacy Policy

Effective 2026-06-27.

This policy explains what personal data we collect about you, why we collect it, who we share it with, and what rights you have. It is written for the General Data Protection Regulation (GDPR, EU Regulation 2016/679), the Czech adaptation Act No. 110/2019 Coll., and applicable consumer-privacy laws in other countries where we sell.

If anything here is unclear, email us at team@printsforwall.com and we will explain.

1. Who is responsible for your data (Controller)

The data controller is Denis Stefanides — printsforwall, IČO 17167795, registered at Příčná 1892/4, 110 00 Praha - Nové Město, Czechia. Contact: team@printsforwall.com.

We are below the threshold that requires a Data Protection Officer, so we have not appointed one. team@printsforwall.com is the address for all privacy-related questions.

2. What personal data we collect

You give us:

• Name, email, shipping and billing address, phone (if you choose to provide it).
• Order content (which prints, which sizes, quantities).
• Any messages you send us through email or contact forms.
• If you sign up to a newsletter: your email and consent.

We collect automatically when you visit the store:

• IP address, browser type, device type, language, referring URL.
• Pages viewed, time on page, items added to cart.
• Cookies and similar technologies. Details in our Cookie Policy.

We receive from third parties:

• Payment confirmation from Shopify Payments (we never see your card number).
• Fulfillment status from Gelato.
• Delivery status from carriers (DHL, PostNL, USPS, and others Gelato routes to).

3. Why we process it, and our legal basis

Under GDPR Art. 6, every processing activity needs a legal basis. Ours:

Purpose	Legal basis
Process your order, take payment, ship the print	Contract (Art. 6(1)(b))
Send you order confirmations and shipping updates	Contract (Art. 6(1)(b))
Keep accounting records for tax and audit	Legal obligation (Art. 6(1)(c)) — Czech Act on Accounting §31
Detect and prevent fraud	Legitimate interest (Art. 6(1)(f))
Reply to customer-support emails	Contract or legitimate interest (Art. 6(1)(b)/(f))
Marketing emails about new prints or sales	Consent (Art. 6(1)(a)) — only if you signed up
Improve the store, fix bugs, understand what people view	Legitimate interest (Art. 6(1)(f))

You can withdraw consent for marketing at any time by clicking unsubscribe in any marketing email, or by emailing team@printsforwall.com. Withdrawing consent does not affect orders we are already processing.

4. Who we share your data with

We use the following companies to run the store. Each is a "processor" or independent controller under GDPR, with appropriate contracts in place.

Shopify International Limited

• What they do: Host the store, run checkout, store order data, process card payments through Shopify Payments.
• Address: 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland.
• What they get: Everything you submit through the store (name, email, address, order, IP, browser info).
• Their privacy notice: https://www.shopify.com/legal/privacy

Shopify Payments uses Stripe Payments Europe Ltd (Ireland) as a sub-processor for card processing in the EU.

Gelato ASA

• What they do: Print your order and ship it to you. They run a network of local printers worldwide, so production happens close to your delivery address when possible.
• Address: Dronning Eufemias gate 8, 0191 Oslo, Norway.
• What they get: Your name, shipping address, order content, and email (for shipment notifications).
• Their privacy notice: https://www.gelato.com/legal/privacy

Because Gelato may produce your order at a printer outside the EEA (for example, in the United States, United Kingdom, or Australia), your shipping data may be transferred outside the EEA. Gelato relies on the EU-US Data Privacy Framework (where applicable) and on the European Commission's Standard Contractual Clauses to make these transfers lawful.

Tax authorities and courts

We share data only where the law requires (for example, a court order, tax audit, fraud investigation).

Future processors (not active yet)

The following tools are listed in advance so we can activate them later without rewriting this policy. None of them are active as of 2026-06-27. We will update this policy and re-prompt your cookie choices before any of them go live.

• Meta Pixel (Meta Platforms Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland) — ad measurement and audience building.
• PostHog — product analytics, hosted in the EU at eu.posthog.com so data stays in the EEA.

5. International transfers

If we transfer your personal data outside the EEA, we rely on one of:

• An adequacy decision by the European Commission.
• Standard Contractual Clauses (SCCs).
• The EU-US Data Privacy Framework where the receiving party is certified.

The main case where this happens is Gelato producing your order at a printer outside the EEA (see section 4 above).

6. How long we keep your data

Data	Retention
Order details, invoices	10 years from the end of the accounting year — Czech Act on Accounting §31
Customer-support emails	2 years from your last contact
Marketing consent	Until you withdraw it
Account data	Until you ask us to delete (orders may be kept under the 10-year rule above)
Cookies / analytics	See Cookie Policy — varies by cookie

When the retention period ends, we delete the data or anonymize it.

7. Your rights

Under GDPR you have the right to:

• Access — get a copy of the data we hold about you.
• Rectify — fix inaccurate data.
• Erase — ask us to delete your data (with exceptions, e.g., we cannot delete invoice data before the 10-year tax retention period ends).
• Restrict — limit our processing while a dispute is resolved.
• Port — receive your data in a machine-readable format, or have it sent to another controller.
• Object — to processing based on legitimate interest.
• Withdraw consent — at any time, where processing is based on consent.

To exercise any of these, email team@printsforwall.com. We respond within one month. There is no charge.

We may ask you to verify your identity before acting on a request, to make sure we are not handing your data to someone else.

8. Right to complain

If you believe we have not handled your data correctly, you can complain to your local data protection authority. In the Czech Republic, that is Úřad pro ochranu osobních údajů (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, Czechia, https://www.uoou.gov.cz.

If you live elsewhere in the EEA, you can complain to your national authority. A list is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

9. California residents (CCPA)

If you live in California, US:

• We do not sell your personal information for money.
• We do not "share" it for cross-context behavioral advertising (currently — see section 4 about future Meta Pixel activation).
• You have the right to know, delete, correct, and opt out of sale or sharing.
• We respect the Global Privacy Control browser signal.

To exercise these rights, email team@printsforwall.com.

10. Children

The store is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, email team@printsforwall.com and we will delete it.

11. Security

Data in transit is encrypted with TLS. Data at rest is encrypted by Shopify and Gelato within their infrastructure. We never receive or store your full payment card number — that goes directly from your browser to Shopify Payments.

No system is perfect. If we ever experience a breach affecting your data, we will tell you and the data protection authority within 72 hours, as required by GDPR Art. 33.

12. Changes to this policy

If we change this policy, we update the effective date at the top and announce material changes by email or banner. The latest version is always at this URL.

13. Contact

Email: team@printsforwall.com Postal: Denis Stefanides — printsforwall, Příčná 1892/4, 110 00 Praha - Nové Město, Czechia