Privacy Policy

At POSTERA, we take the protection of your personal data seriously. This Privacy Policy explains what personal data we process, why we process it, who we may share it with, how long we keep it and what rights you have.

Data controller

Postera ApS is the data controller responsible for the processing of your personal data when you use our online store, place an order with us or otherwise interact with POSTERA.

Postera ApS
Lerbakken 25
DK-8410 Rønde
Denmark
Danish company registration no. (CVR): 41678453
Phone: +45 28 74 82 72
Email: info@postera.art

Applicable data protection laws

Postera ApS is established in Denmark and is subject to the EU General Data Protection Regulation (GDPR) and applicable Danish data protection law.

Where we offer goods or services to individuals in the United Kingdom, UK data protection law may also apply. If you are located elsewhere, additional or different privacy laws may apply to you. Nothing in this Privacy Policy is intended to limit any mandatory rights you have under applicable data protection or privacy law.

Where this Privacy Policy refers to legal bases under Article 6 of the GDPR, the same or equivalent legal basis will be applied where required under the UK GDPR or other applicable privacy legislation.

What personal data do we process?

The personal data we process depends on how you use POSTERA. It may include:

• your name,
• email address,
• telephone number,
• billing and delivery address,
• order details and purchase history,
• payment and transaction information,
• information associated with a customer account,
• communications with customer service,
• information relating to returns and complaints,
• images, text and other material uploaded through Create Your Own,
• IP address and device and browser information,
• information about how you use our website,
• cookie, advertising and marketing identifiers,
• information about your consent choices and marketing preferences.

We aim to collect and process only the personal data that is necessary for the relevant purpose.

Most of the information we process is provided directly by you. Certain information may also be received or recorded through your device or browser, payment providers, carriers, Shopify, advertising platforms and analytics services.

When you place an order with POSTERA

When you make a purchase, we process the information necessary to receive and manage your order, process payment, produce the goods and deliver them to you.

This will typically include your name, contact details, billing and delivery address, information about the products ordered, the order value, payment status and other information required to complete the purchase.

Where the GDPR or UK GDPR applies, this processing is primarily necessary for the performance of our contract with you, under Article 6(1)(b).

Certain order, payment and transaction information is also processed and retained because POSTERA is subject to legal obligations, including accounting and tax requirements, under Article 6(1)(c).

If you do not provide the information that is necessary to place and fulfil an order, we may be unable to enter into or perform the purchase agreement with you.

Customer accounts

You may choose to create a customer account with POSTERA. Our customer account functionality is provided through Shopify.

In connection with a customer account, we may process information such as your name, email address, contact details, order history and other information associated with your account.

The purpose is to provide the features associated with your customer account, including access to previous orders and relevant account information.

Where the GDPR or UK GDPR applies, processing takes place as part of providing the account functionality you choose to use under Article 6(1)(b), and where relevant on the basis of our legitimate interest in administering and securing our customer systems under Article 6(1)(f).

Create Your Own and uploaded images

When you use Create Your Own, you may upload an image, add text and make other design choices in order to create a personalised product.

Uploaded material may contain personal data relating to you or other individuals, for example where a person can be recognised in an image.

We process uploaded material in order to:

• display and process your design,
• create the necessary production file,
• produce the product you ordered,
• carry out necessary quality checks,
• handle questions or complaints relating to the product.

Where the GDPR or UK GDPR applies, the processing is necessary to produce and deliver the personalised product you ordered under Article 6(1)(b).

The original image and other material that you upload through Create Your Own are linked to the relevant order in Shopify and remain stored with the order information.

For production purposes, POSTERA downloads the necessary material and processes it using our own production systems. All printing and production are carried out by POSTERA and are not outsourced to an external printing or production partner.

Local working files, downloaded image files, AI-processed files, production files and generated print files are used for production purposes and are deleted once production has been completed and the files are no longer required for that purpose.

The original upload linked to the Shopify order may continue to be accessed after production where necessary for purposes such as documentation, customer service or handling a complaint relating to the order.

POSTERA employees may access uploaded material where this is necessary for production, quality control, customer service or handling a complaint. Access is limited to individuals who have a work-related need to access the information.

POSTERA does not use uploaded images for advertising, publication, resale or training our own AI models.

We do not use uploaded images for facial recognition, identification of individuals or profiling based on a person's appearance.

If the material you upload contains personal data relating to other individuals, you are responsible for ensuring that you are entitled to use that material for the intended purpose.

AI image enhancement

When using Create Your Own, you may choose to enhance selected images using AI-based image processing. This feature is optional.

If you select AI enhancement, the relevant image is sent through an API connection to Topaz Labs, which performs the technical image enhancement.

The purpose is to improve aspects such as image resolution and sharpness before production. Where the GDPR or UK GDPR applies, this processing is carried out in order to provide the AI enhancement that you actively selected as part of your personalised product under Article 6(1)(b).

According to Topaz Labs' current privacy terms, media content such as images and videos is not used to train its artificial intelligence models without prior consent.

For its API service, Topaz Labs states that input media and processed output may be temporarily stored on its servers and are subject to automatic deletion after a limited period. Residual copies may remain for a limited period in backup or archival systems where necessary for compliance, auditing or dispute resolution.

POSTERA does not give Topaz Labs permission to use customer images for training AI models.

Once the enhanced image is returned to POSTERA, we use it to produce the product you ordered. Local copies and production files are deleted once production has been completed and they are no longer necessary for production purposes.

As Topaz Labs is an external technology provider based outside the EU/EEA, the processing may involve an international transfer of personal data. You can read more about international transfers below.

Payment

When you pay for an order, the necessary payment and transaction information is processed by our payment infrastructure and the relevant payment providers.

POSTERA uses QuickPay as a payment gateway, together with the payment methods and payment providers available at checkout.

Depending on the payment method you choose, payment information may be processed by card issuers, acquiring banks, banks, wallet providers or other payment service providers.

POSTERA receives the transaction information necessary to record and administer your payment, such as payment status, amount, currency and a transaction reference. POSTERA does not store your full payment card number.

Where the GDPR or UK GDPR applies, processing takes place in order to complete your purchase under Article 6(1)(b), and where relevant to comply with legal obligations under Article 6(1)(c).

Delivery

In order to deliver your order, we share the information necessary for shipment with our shipping management system and the carrier responsible for delivering your parcel.

POSTERA uses Webshipper to manage shipments and shipping information.

Depending on the delivery method, information such as your name, address, email address, telephone number and order or shipment information may be shared with Webshipper and the relevant carrier.

The information is used to create the shipment, deliver the parcel, provide delivery updates and manage any delivery-related issues.

Where the GDPR or UK GDPR applies, this processing is necessary to perform our purchase agreement with you under Article 6(1)(b).

Customer service, returns and complaints

When you contact our customer service team, we process the information you provide in connection with your enquiry.

This may include your name, email address, order number, photographs, correspondence and information relating to the product or issue concerned.

The purpose is to respond to your enquiry, administer our customer relationship, process returns or complaints and document relevant circumstances where questions may subsequently arise.

Depending on the nature of your enquiry, the legal basis may be performance of our contract with you, compliance with a legal obligation or our legitimate interest in providing customer service and documenting the handling of a case under Article 6(1)(b), (c) or (f).

We currently use business email services including Google Workspace/Gmail in connection with customer service and business communications.

Trustpilot and review invitations

Following a purchase, POSTERA may invite you to review your shopping experience on Trustpilot.

For this purpose, we may provide Trustpilot with the information necessary to send the invitation, such as your name, email address and a reference such as your order number. Trustpilot may then send the review invitation on POSTERA's behalf.

The purpose is to collect authentic customer feedback, help verify that reviews relate to genuine purchasing experiences and improve our products and services.

Where the GDPR or UK GDPR applies, this processing is based on our legitimate interest in collecting and managing customer feedback under Article 6(1)(f).

Review invitations are sent in connection with a specific purchasing experience. If an electronic message also contains direct marketing, this will only be done where we have a lawful basis to do so under the applicable electronic marketing rules.

If you choose to create a Trustpilot account or publish a review, Trustpilot will also process personal data about you in accordance with its own privacy policy.

Newsletter and email marketing

If you subscribe to POSTERA's newsletter or otherwise provide valid permission for us to send you email marketing, we process your email address and relevant information about your marketing preferences in order to send you news, inspiration, offers and other marketing from POSTERA.

Where permitted by applicable law, we may also use information such as previous purchases, products in your basket, your use of our online store and your interaction with our emails to segment and personalise marketing.

This may include automated marketing flows such as:

• welcome emails,
• abandoned basket or checkout reminders,
• product-related follow-up emails,
• win-back emails,
• segmented offers and campaigns.

Electronic marketing is sent only where we have a lawful basis to do so under applicable marketing laws. Where the processing of personal data is based on consent, the legal basis under the GDPR or UK GDPR is Article 6(1)(a).

We currently use Shopify's email functionality to send and manage email marketing.

You can unsubscribe from email marketing at any time by using the unsubscribe link included in our emails or by contacting us. Withdrawing your consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

Cookies, analytics and advertising

POSTERA uses cookies, pixels, tags, API-based conversion measurement and similar technologies on our websites.

Some technologies are necessary for the online store to function, for example to:

• keep track of the contents of your shopping basket,
• complete checkout,
• maintain security and prevent misuse,
• remember relevant settings and functionality,
• manage login and customer accounts.

Other technologies are used where you have provided the required consent, including for:

• statistics and analysis of website use,
• campaign and conversion measurement,
• personalisation,
• advertising and retargeting on other platforms.

We use services and technologies including:

• Google, including Google Analytics 4 and Google Ads,
• Meta, including Meta Pixel and conversion measurement,
• TikTok,
• Pinterest,
• Snapchat.

Depending on your consent choices and the technology concerned, information such as your IP address, device, browser, page views, clicks, products viewed, basket activity, purchases, order value and other events on the online store may be processed.

For certain forms of server-side tracking or conversion measurement, contact information or other identifiers may be hashed or otherwise protected before being sent to an advertising platform for matching and measurement purposes.

We use Pandectes GDPR to manage cookie and consent choices. Through our cookie banner, you can choose which non-essential categories you wish to accept and you can subsequently change or withdraw your choices.

More detailed information about individual cookies and technologies, their providers, purposes and lifetimes is available through the cookie information accessible from our cookie banner.

Profiling and automated processing

We may use automated processing to group customers and visitors into different audiences based on information such as purchasing history, activity on our online store or interaction with marketing.

The purpose is, among other things, to make our communications and advertising more relevant and to measure the effectiveness of our marketing.

Where this processing depends on cookies or other consent-based advertising technologies, it is carried out only where the required consent has been provided.

POSTERA does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Fraud prevention, misuse and security

We may process relevant technical, order and transaction information in order to protect POSTERA, our customers and our systems against fraud, misuse, security incidents and other unlawful activity.

Where the GDPR or UK GDPR applies, this processing is based on our legitimate interest in protecting our business, systems and customers under Article 6(1)(f), and where relevant to comply with legal obligations under Article 6(1)(c).

Recipients and external service providers

POSTERA uses a number of external service providers in order to operate our online store and provide our services. Personal data is shared only to the extent necessary for the relevant purpose.

These providers and categories of recipients may include:

• Shopify – online store platform, checkout, order processing, customer accounts, hosting and email functionality,
• QuickPay and other payment providers – payment processing and administration,
• Webshipper and carriers – creation, administration and delivery of shipments,
• Google Workspace/Gmail – business email and customer service communications,
• Trustpilot – sending and managing review invitations,
• Topaz Labs – optional AI image enhancement,
• Pandectes – management of cookie and consent choices,
• Google, Meta, TikTok, Pinterest and Snapchat – analytics, conversion measurement and advertising where the relevant processing is permitted,
• providers of IT services, online store functionality, order tracking, wish lists, analytics, upselling and other technical services used to support our online store.

Some providers process personal data as processors acting on POSTERA's instructions. Other providers may act as independent controllers or joint controllers for particular processing activities. Their role depends on the particular service and how the personal data is processed.

Where required, we enter into appropriate data processing agreements and require suitable safeguards for personal data.

We may also disclose personal data to authorities, courts or other parties where we are legally required to do so or where this is necessary to establish, exercise or defend legal claims.

POSTERA does not sell personal data in exchange for direct monetary payment. Certain disclosures to advertising platforms may, however, be treated as “sharing”, “sale”, targeted advertising or a similar concept under privacy laws in some jurisdictions. Where such laws apply to POSTERA, we provide the rights and choices required by applicable law.

International transfers of personal data

Some of the providers and technologies we use are established outside the EU/EEA and the United Kingdom, or use group companies, subprocessors or technical infrastructure located in other countries. Your personal data may therefore in some circumstances be processed or transferred internationally.

This is or may be relevant in connection with Shopify, Topaz Labs and certain analytics, advertising, marketing, email and technology providers.

Where data protection law requires specific safeguards for an international transfer, we use an appropriate transfer mechanism.

Depending on the transfer, this may include:

• an adequacy decision recognising that the destination provides an adequate level of protection,
• the European Commission's Standard Contractual Clauses (SCCs),
• the applicable UK international data transfer mechanism or UK Addendum,
• approved Binding Corporate Rules (BCRs),
• or another lawful transfer mechanism recognised under applicable data protection law.

Where appropriate, additional safeguards are assessed or implemented in connection with international transfers.

How long do we keep your personal data?

We retain personal data only for as long as it is necessary for the purposes for which it was collected, or for as long as we are legally required or otherwise lawfully entitled to retain it.

The retention period therefore depends on the type of information and the purpose for which it is processed.

Order and accounting information

Order information and other records that constitute or form part of accounting records are retained in accordance with applicable Danish accounting requirements. Such records are generally retained for 5 years from the end of the financial year to which the records relate.

Create Your Own and uploaded images

The original image and other material that you upload through Create Your Own remain linked to the relevant order in Shopify and are stored together with the order information.

The upload may be retained for purposes including documenting the personalised product ordered and handling customer service enquiries, complaints or other questions relating to the order.

We do not retain uploaded material longer than necessary for these purposes and the retention periods applicable to the associated order. Where the information is no longer required and there is no other lawful reason to retain it, it may be deleted or anonymised.

Local working files, downloaded image files, AI-processed files, production files and generated print files used by POSTERA for production are deleted once production has been completed and the files are no longer necessary for production purposes.

Customer service, returns and complaints

Customer service correspondence and case information are retained for as long as necessary to handle the enquiry and document the matter.

Information may be retained for longer where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.

Customer accounts

Information associated with a customer account is generally retained for as long as the account remains active or the information continues to be necessary to provide the functions associated with the account.

Order, transaction and accounting information may be retained for longer even if a customer account is closed or deleted.

Newsletter and marketing

Information used for email marketing is generally processed until you withdraw your consent, unsubscribe or the information is otherwise no longer necessary.

Information required to document a previous consent, unsubscribe request or objection to marketing may be retained for longer where necessary to demonstrate compliance with applicable law.

Cookies and tracking

Retention periods for cookies and similar technologies vary. The specific periods are shown in the cookie information available through our cookie banner.

Your privacy rights

Depending on where you live and the privacy law that applies, you may have a number of rights in relation to your personal data.

Where the GDPR or UK GDPR applies, these may include the right to:

• access the personal data we process about you,
• rectify inaccurate or incomplete personal data,
• erase your personal data in certain circumstances,
• restrict processing in certain circumstances,
• data portability in relation to certain personal data,
• object to processing based on our legitimate interests,
• object to direct marketing at any time,
• withdraw consent where processing is based on your consent.

The right to erasure is not absolute. For example, we may be legally required to continue retaining certain order, payment or accounting records even if you request deletion.

If a request for deletion relates to an image or other material linked to a Create Your Own order, we will assess whether the material remains necessary and whether we have a lawful basis or legal obligation to continue retaining it.

If you live outside the EU/EEA or United Kingdom, you may have additional or different rights under the privacy law applicable in your country, state or province. Where such laws apply to POSTERA, we will honour the rights required by those laws.

To exercise a privacy right, please contact:

info@postera.art

We may ask you for additional information where reasonably necessary to verify your identity and protect personal data against disclosure or alteration at the request of an unauthorised person.

Withdrawing consent

Where our processing of your personal data is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.

You can withdraw consent to email marketing using the unsubscribe link in our emails. Cookie and tracking choices can be changed or withdrawn through our cookie settings.

Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal data is limited as far as reasonably possible to employees and service providers who have a legitimate work-related need to access the information.

Data protection complaints

If you have concerns or wish to make a complaint about the way POSTERA processes your personal data, please contact us first so that we have the opportunity to investigate and address the matter.

Data protection complaints may be sent to:

info@postera.art

We will handle data protection complaints in accordance with the data protection laws that apply to the matter.

EU/EEA residents

If the GDPR applies to you, you have the right to lodge a complaint with a competent data protection authority, including the authority in the country of your habitual residence, your place of work or the place where you believe an infringement occurred.

As Postera ApS is established in Denmark, you may also contact:

The Danish Data Protection Agency (Datatilsynet)
Carl Jacobsens Vej 35
2500 Valby
Denmark

United Kingdom residents

If UK data protection law applies to you, you may also lodge a complaint with the UK Information Commissioner's Office (ICO).

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Residents of other countries

If you live outside the EU/EEA or United Kingdom, you may have the right to complain to a privacy, data protection or consumer authority in your country, state or province where applicable.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example if we change our services, introduce new technology or service providers, or if applicable laws change.

The current version will always be made available on our website. Where changes are material, we may also notify you in another appropriate manner where this is relevant or required by law.