Privacy Policy
This policy explains what personal data we process when you visit vallora.art or order from us, why we do it, who we share it with and what rights you have. We keep things lean: there are no customer accounts, no newsletter, no analytics and no advertising trackers on this website.
Who is responsible
The controller for the processing described here is:
- Company details will be published shortly.
- Email: [email protected]
For any question about your data or to exercise your rights, simply write to [email protected] or use our contact form. We have not appointed a data protection officer because we are not legally required to.
Which law applies
We are a company established in the United Kingdom, so our processing is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Because we also offer our products to people in the European Union, the EU General Data Protection Regulation (GDPR) applies as well when we process the data of people in the EU. The two regulations give you essentially the same rights. Where this policy refers to an article of the GDPR, the corresponding article of the UK GDPR applies in the same way.
Summary
- We use your data to handle your order: to confirm it, have it printed and delivered, answer your questions and meet our accounting duties.
- Your order is printed and shipped by our fulfilment partner, who receives only what is needed to produce and deliver it.
- The website only stores what it needs to work (cart, language, currency and your cookie choice). There is no tracking.
- We do not sell your data and we do not use it for advertising or profiling.
What we process and why
Visiting the website
When you open a page, your browser sends technical data to the server: your IP address, the date and time of the request, the page requested, the referring page and information about your browser and operating system. Our website is hosted and delivered by Cloudflare, which processes this data to deliver the pages, protect the website against attacks and abuse, and keep it stable. We do not use this data to identify you or build visitor profiles.
Legal basis: our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR).
Storage in your browser
To make the shop work, we store a few items in your browser: your cart, your chosen language and currency and your cookie choice (in local storage), plus a first-party cookie vallora_lang that remembers your language. These items are strictly necessary for the service you request, so they do not require consent. They stay on your device and are not used for tracking. Details, including how long each item is kept, are on our cookie page.
If we ever introduce optional cookies or similar technologies, we will only use them with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings.
Orders
You order by sending an order request through the checkout on our website. We store your order request in our order database, which Cloudflare hosts for us within the European Union. To process your order we need:
- your first and last name, email address and phone number (the carrier may need the phone number for delivery),
- your delivery address and, if different, your billing address,
- your comment on the order, if you write one, and the time at which you accepted our terms of sale and privacy policy,
- the order details (artworks, sizes, frames, prices, delivery method),
- payment information such as the payment method, payment status and transaction reference,
- for business customers, the company name and VAT ID,
- our correspondence about the order.
We use this data to check your order request, send you a payment link, take payment, have the poster printed and delivered, inform you about the shipment, and deal with returns, complaints and warranty claims.
Legal basis: performance of the contract and steps taken at your request before entering into it (Art. 6(1)(b) GDPR).
Spam protection at checkout (Cloudflare Turnstile)
To keep automated spam out of our order requests, the checkout uses Cloudflare Turnstile. It checks whether the request comes from a person and, for this, processes technical data such as your IP address and information about your browser and device. Turnstile does not show advertising and is not used to track you across websites.
Legal basis: our legitimate interest in protecting the shop against spam and abuse (Art. 6(1)(f) GDPR).
Payment through a payment link
We do not collect payment details on our website. You pay through a payment link that we send you by email; it leads to the payment page of our payment provider, where you enter your payment details directly. We never see your full card number. From the payment provider we receive the information we need to match the payment to your order, for example the amount, the payment status and the payment method. The payment provider also processes payment data as an independent controller, for example to prevent fraud and to meet its own legal obligations as a regulated payment provider; its own privacy policy applies to that.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR); for fraud prevention, our and the payment provider's legitimate interest in secure payments (Art. 6(1)(f) GDPR).
Questions, the contact form and other messages
If you write to us by email or through the contact form, we process your message, your name, your email address, your order number if you give it, and any information you choose to share, in order to answer you. Messages sent through the contact form are delivered to our email inbox through Cloudflare's email service; they are not stored on the website.
Legal basis: where your message relates to an order or a planned purchase, Art. 6(1)(b) GDPR; otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Please do not send payment card details or other sensitive information by email. Ordinary email is not end-to-end encrypted.
Accounting and tax
Invoices, payment records and other business documents must be kept under accounting and tax law, and we may have to provide them to tax authorities on request.
Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR together with the applicable national accounting and tax laws).
Legal claims
Where necessary, we use order and correspondence data to establish, exercise or defend legal claims.
Legal basis: our legitimate interest in protecting our rights (Art. 6(1)(f) GDPR).
Who receives your data
We only share your data where this is needed for the purposes above. Some recipients act on our behalf under a data processing agreement (processors); others process the data for their own purposes under their own responsibility.
| Recipient | Role | Data | Purpose |
|---|---|---|---|
| Cloudflare, Inc., USA | Processor | IP address and technical request data; order requests; contact form messages | Hosting, content delivery, security and spam protection (Turnstile); storing order requests (database in the EU); delivering contact form messages to our inbox |
| Our fulfilment partner (print on demand) | Processor | Name, shipping address, email and/or phone, order contents | Printing, framing, packing and dispatch |
| Carriers and postal services | Independent controllers | Name, shipping address, email and/or phone where needed | Delivery and delivery notifications |
| Email provider | Processor | Email content and contact details | Sending and receiving email |
| Payment provider | Processor and, in part, independent controller | Payment data, order amount, contact details | Payment processing, fraud prevention |
| Tax advisor or accountant | Bound by professional confidentiality | Invoices and accounting records | Bookkeeping and tax returns |
| Authorities, courts, legal advisors | Independent controllers | Data required in the specific case | Only where we are legally required to or to protect our rights |
The carrier depends on the destination and the shipping method; the fulfilment partner hands your parcel over to it.
International transfers
We are based in the United Kingdom, and some recipients are based in, or use service providers in, other countries. We only allow this where your data remains adequately protected:
- From the EU to the United Kingdom: if you live in the EU, your data is transferred to us in the UK. The European Commission has recognised the UK as providing an adequate level of data protection (adequacy decision under Art. 45 GDPR).
- From the United Kingdom to the EU/EEA: our fulfilment partner prints EU orders within the EU. The UK recognises the EU/EEA countries as adequate (UK adequacy regulations).
- USA: Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision. Where a recipient is not certified, we rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Our fulfilment partner may produce and ship orders from facilities in different countries. For customers in the UK, transfers from the UK are protected in the same way under the UK GDPR (UK adequacy regulations, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum).
You can ask us for more information about these safeguards at [email protected].
How long we keep your data
We keep personal data only as long as we need it for the purposes above or as the law requires.
| Data | Retention |
|---|---|
| Invoices, payment and accounting records | For the statutory retention period, as a rule 6 years from the end of the financial year (see below) |
| Other order data and order correspondence | Until claims under the contract are time-barred, as a rule 3 years after the end of the year of delivery |
| Order requests that were never paid | Deleted 6 months after the request |
| Other email correspondence | Deleted once it is no longer needed, at the latest 24 months after our last exchange |
| Technical request data at Cloudflare | Kept only briefly in line with Cloudflare's retention practices; we do not keep separate logs |
Browser storage and the vallora_lang cookie |
On your device until it expires or you delete it (see the cookie page) |
As a UK company, we keep accounting and tax records as required by UK company and tax law, as a rule for 6 years from the end of the financial year to which they relate. If we are registered for VAT in an EU country, that country's retention rules may require us to keep records relating to it for longer.
When a retention period ends, we delete the data or anonymise it. If data is needed to defend a specific legal claim, we keep it until the matter is closed.
Do you have to give us your data?
You are free to browse the website without giving us any personal data. To place an order, however, we need your name, contact details, shipping address and the order details. Without them we cannot accept, deliver or invoice your order. Some of this information (for example your name and address on an invoice) is also required by tax law.
No automated decisions or profiling
We do not make decisions about you based solely on automated processing, and we do not create profiles. Our payment provider may automatically screen payments for fraud, and Cloudflare Turnstile automatically checks order requests for spam. If a payment is declined, you can contact us and we will look at it personally.
Your rights
Under the UK GDPR and, if you live in the EU, the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy (Art. 15),
- have inaccurate data corrected (Art. 16),
- have your data erased, unless we still have to keep it, for example for tax reasons (Art. 17),
- restrict the processing in certain cases (Art. 18),
- receive the data you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability, Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw your consent at any time with effect for the future, where processing is based on consent (Art. 7(3)).
To exercise your rights, write to [email protected]. It is free of charge. We reply within one month; in complex cases this can be extended by up to two further months, in which case we will let you know. We may ask you to confirm your identity before we disclose any data.
Your right to object
Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
Right to lodge a complaint
If you think we are processing your data unlawfully, please tell us first so we can put it right. You also have the right to lodge a complaint with a data protection supervisory authority. Our supervisory authority in the UK is the Information Commissioner's Office (ICO). If you live in the EU, you can complain to the authority in the country where you live or work or where the alleged infringement took place:
| Country | Supervisory authority |
|---|---|
| United Kingdom | Information Commissioner's Office (ICO), ico.org.uk |
| Czech Republic | Úřad pro ochranu osobních údajů (ÚOOÚ), uoou.gov.cz |
| Slovakia | Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk |
| Germany | The data protection authority of the relevant federal state (Landesdatenschutzbehörde) |
| Austria | Datenschutzbehörde (DSB), dsb.gv.at |
| Sweden | Integritetsskyddsmyndigheten (IMY), imy.se |
In other EU countries, you can contact your national data protection authority.
Security
We protect your data with appropriate technical and organisational measures. The website is only served over an encrypted connection (HTTPS), access to order data is limited to the people who need it, and our accounts with service providers are protected with strong passwords and two-factor authentication. No transmission over the internet can be completely secure, which is why we ask you not to send sensitive information by email.
Changes to this policy
We will update this policy when our processing changes, for example when a service provider changes. The current version is always available on this page. If a change significantly affects you as a customer with an ongoing order, we will inform you directly.
Effective date
The effective date will be published together with our company details.