Privacy policy
Privacy policy
How customers' and visitors' personal data is handled, under the General Data Protection Regulation.
Who the controller is
The controller is Maximiliano Ioan Biatturi Anton EI, whose address and contact details are in the legal notice.
For any question about your data, write to furandinkshop@gmail.com.
What data is handled
Order data: name, delivery address, email address, what was ordered and what was paid. Card details are never received or stored by the seller; the payment provider handles them.
The photo the customer sends and the portrait generated from that photo.
The email address, if the customer asks for their preview to be sent or signs up for emails.
Technical browsing data: IP address, device type, pages viewed. Analytics and advertising pixels are switched on only after consent.
Providing the photo and the delivery details is necessary to perform the contract; without them the preview or the order cannot be processed. The email address is necessary to place an order; it is optional for receiving the preview or marketing emails.
Purposes and legal bases
Processing the order, having the portrait printed and delivering it: performance of the contract.
Generating the preview from the photo: performance of the contract, or a pre-contractual step the visitor asked for when there is no order yet.
Sending marketing emails: consent, which can be withdrawn at any time with the unsubscribe link.
Measuring site traffic and how well adverts work: consent, collected before any tracker is set.
Meeting accounting and tax obligations: legal obligation.
Answering complaints and defending the seller's rights: the seller's legitimate interest.
Processors and recipients
Shopify (Ireland, Canadian group): the online shop, payment and order management. Payment goes through Shopify Payments and, if the customer chooses it, Shop Pay.
To provide the shop, payment and certain protection and improvement features, Shopify may process your data together with that of other merchants using Shopify. Shopify’s privacy policy (https://www.shopify.com/legal/privacy/customers) describes this processing, and the Shopify privacy portal (https://privacy.shopify.com/) is where you exercise your rights over it.
Gelato (Norway, printing in the European Union and the United States): printing and shipping. Receives the file to print and the delivery address.
Google (Gemini, Google Cloud): generating the portrait and analysing the image. The photo is sent to the model for the generation. Google keeps requests and responses for a limited period, solely to detect and prevent violations of its prohibited-use policy, and does not use them to improve its products (paid service).
Cloudflare R2: storage of the photo and the generated files, in an EU jurisdiction.
Klaviyo (United States): sending emails, only if the customer signed up.
Meta (United States): advertising measurement, only after consent. No photo, no email address and no pet name is sent to it.
None of these providers is allowed to use this data for its own purposes.
Transfers outside the European Union
The photo is stored in the European Union. To generate the portrait, it is sent to Google (Gemini model), whose processing may take place outside the European Union.
Some providers are established in the United States or process data there. Those transfers rely on the European Commission's standard contractual clauses or on the adequacy decision that applies to the provider concerned.
An order delivered in the United States means the delivery address goes to the printer there, which is necessary to perform the contract.
To get a copy of the safeguards applied to a transfer, write to furandinkshop@gmail.com.
How long data is kept
The photo sent and the portrait generated are deleted thirty days after delivery. With no order, they are deleted thirty days after the photo was uploaded.
Order data and invoices are kept for ten years, the retention period for accounting records and their supporting documents under article L123-22 of the French commercial code.
An email address signed up for emails is kept while the subscription lasts. After unsubscribing, only the note needed to stop writing to you is kept. Contacts with no interaction for three years are deleted.
Your choice in the cookie banner (accept or refuse) is kept for at most twelve months before you are asked again. If a consent-exempt analytics tool is installed, its trackers will last at most thirteen months and its data will be kept at most twenty-five months, following the CNIL's recommendations.
A low-resolution copy of the approved preview is kept for two years after delivery, to handle complaints and defend the seller's rights (legitimate interest).
The database is backed up every night, and each backup is kept for thirty days, then deleted. Data erased from the database therefore stays in these backups for at most thirty days. Photos and portraits are not in them.
What is not done with the photo
The photo is never used to train an artificial-intelligence model, by the seller or by any provider.
The photo and the portrait are never published or used in marketing without the customer's express agreement, given by ticking a box for that purpose.
The photo is never sold or passed to a third party.
The "Your photo" page says the same thing in plain language and links here.
Your rights
You have the right of access, rectification, erasure and restriction, the right to data portability, and the right to object to processing based on legitimate interest.
Where processing rests on your consent, you can withdraw it at any time, as simply as you gave it.
To exercise these rights, write to furandinkshop@gmail.com. You get an answer within one month.
You may be asked for something to verify your identity, but only if there is a reasonable doubt.
Complaining to a supervisory authority
If the answer does not satisfy you, you can complain to the Commission nationale de l'informatique et des libertés, the CNIL, the authority competent for the controller, at cnil.fr.
You can also go to the authority of your country of habitual residence. For a resident of Spain that is the Agencia Española de Protección de Datos, at aepd.es.
Trackers and cookies
Trackers strictly necessary to run the shop and the cart are set without consent.
Analytics and advertising trackers are set only after your consent, collected by the banner shown on a first visit.
The categories, and how to change your mind, are on the cookies page.
Changes
This policy may change. The version that applies is the one published on this page on the date of the visit; a substantial change is flagged on the site.