Privacy Policy

How we collect, use, and protect your personal data.

This policy explains our data processing practices, your privacy rights, and how we handle the information you provide when using our custom print platform.

1. Data Controller Identity and Commitment

Protecting your personal data and digital assets is a primary operational mandate for Example Store. This Privacy Policy outlines the architecture of our data processing operations, ensuring total transparency regarding how we collect, process, and protect your personal data in strict compliance with the General Data Protection Regulation (GDPR - EU 2016/679).

The Data Controller legally responsible for determining the purposes and means of processing your personal data on this platform is:

Your Company Ltd

Your registered office address

Your country of registration

Company Number: 00000000

Data Protection Inquiries: your-email@example.com

2. Categories of Data Processed and Legal Basis

To operate a highly functional web-to-print SaaS platform, we are required to collect and process specific datasets. Processing is strictly limited to the data necessary for the performance of our services.

Data Category Description of Processed Elements GDPR Legal Basis for Processing
Identity and Contact Data First name, last name, billing address, delivery address, email address, and telephone number. Contractual Necessity (Article 6(1)(b)). Required to fulfill orders and ship products.
Financial and Transaction Data Order history, invoices, and anonymized payment gateway tokens. (Full credit card numbers are never stored on our servers). Legal Obligation (Article 6(1)(c)). Required to comply with Your country of registration tax and accounting laws.
User-Generated Content Digital assets uploaded to the platform (PDF, SVG, JPEG, PNG files). If these files contain identifiable images of persons or personal text, they are treated as highly sensitive personal data. Contractual Necessity (Article 6(1)(b)). The core function of the service is to print these assets.
Technical and Network Data IP address, browser type, device information, authentication tokens, and session data. Legitimate Interests (Article 6(1)(f)). Required to maintain cybersecurity, prevent fraud, and ensure platform stability.

3. Data Processors and Third-Party Sub-Processors

To provide Example Store, we rely on an advanced white-label web-to-print SaaS infrastructure provider. This provider acts as our Data Processor. They host the application, store your uploaded artwork assets, and manage the database infrastructure purely on our behalf. We have executed a strict Data Processing Agreement (DPA) under Article 28 of the GDPR with this provider, which mandates state-of-the-art encryption, rigorous access controls, and strict limitations against using your data for their own purposes.

Additionally, to fulfill your contract, we share highly restricted datasets with:

  • Logistics and courier partners strictly for the physical delivery of your printed goods.

  • Regulated payment service providers to securely authenticate and process transactions.

    We unequivocally do not sell, rent, or monetize your personal data or uploaded design assets to third parties for marketing purposes.

4. Data Retention Architecture

We apply the principle of data minimization, retaining your personal data only for as long as is necessary to fulfill the purposes for which it was collected. User accounts and uploaded design assets (PDF, SVG, JPEG, PNG) are stored securely to facilitate easy re-ordering and template modification; however, you maintain the autonomy to delete these assets from your digital library at any time. Financial records related to your transactions will be retained in an archived state for the duration mandated by national tax laws (typically 6 to 10 years depending on the jurisdiction).

5. Cybersecurity and Breach Notification

We implement robust technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of data at rest and in transit. In the highly unlikely event of a personal data breach that poses a significant risk to your rights and freedoms, Your Company Ltd is legally obligated under Article 33 of the GDPR to notify the competent supervisory authority within 72 hours, and we will communicate the breach to affected users without undue delay, providing transparent guidance on protective measures.

6. Your Fundamental Data Protection Rights

Under Chapter III of the GDPR, you possess extensive fundamental rights regarding your personal data:

  • Right of Access (Article 15): You may request a comprehensive copy of the personal data we process about you.

  • Right to Rectification (Article 16): You may request the immediate correction of inaccurate or incomplete data.

  • Right to Erasure (Article 17): Often referred to as the "Right to be Forgotten," you may request the deletion of your personal data, provided there are no overriding statutory obligations requiring us to retain it (e.g., tax invoicing).

  • Right to Restriction of Processing (Article 18): You may request the suspension of processing under specific legal disputes.

  • Right to Data Portability (Article 20): You possess the right to receive your data in a structured, machine-readable format.

  • Right to Object (Article 21): You may object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, please submit a written request to our data protection team at your-email@example.com. We process all requests free of charge and within the statutory 30-day timeframe.

7. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes upon data protection laws, you retain the fundamental right to lodge a formal complaint with the competent supervisory data protection authority in Your country of registration, or in the EU Member State of your habitual residence or place of work.