Who is responsible for your data
The data controller is EKINSOL BV, VAT BE 0740.479.291, Pierlapont 16, 8210 Zedelgem, Belgium, trading as Steam Machine Prints.
For any question about your data, email hello@steammachineprints.com. [TODO: verify the live mailbox, and confirm whether a separate privacy address is wanted.]
What we collect
When you order or contact us, you give us: your name, address, phone number and email address; your billing and shipping address; your order details, meaning the products, the date and the amount; and whatever you write to us in an email or a form.
We receive confirmation that your payment succeeded. We never receive your full payment details, those stay with the payment provider.
When you visit the site we automatically collect your IP address, browser type, device type and operating system, which pages you visit, when and for how long, and how you move through the shop. We use cookies and similar technologies for this, as described in our Cookie Policy.
If you upload a photograph for a custom print, we store that image and process it for production. Uploaded images are treated as personal data whenever they show identifiable people.
Why we use it, and on what legal basis
To handle your order: confirming it, producing it, shipping it and keeping you informed. Legal basis: performance of our contract with you.
To provide customer service: answering questions, handling returns, warranty and complaints. Legal basis: performance of our contract, and our legitimate interest in running a shop that answers its email.
To meet legal obligations: tax law, accounting law and consumer law. Legal basis: legal obligation.
To send marketing, which is optional: news about new products or offers. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link in every message.
To keep the shop secure: preventing fraud and abuse. Legal basis: our legitimate interest in protecting the shop and our customers.
We do not sell your data to anyone, and we do not use it to build advertising profiles.
Who we share it with
We share data only with the partners who help us deliver: our payment provider, our shipping carriers, and the IT partners who host and maintain the site. They act as our processors, may use the data only for what we ask them to do, and are bound by contract to protect it.
[TODO: verify and name the actual processors used by steammachineprints.com: payment provider, hosting provider, email or newsletter provider, analytics provider, and the carriers. Naming them is expected under GDPR transparency and should not be left generic before launch.]
We may disclose data where the law requires it, for instance to a tax authority or in response to a valid court order.
Where your data is processed
We aim to keep processing inside the European Economic Area. Where a processor operates outside it, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses. [TODO: verify whether any current processor transfers data outside the EEA, and on what basis.]
How long we keep it
Order and invoice data is kept for as long as Belgian accounting and tax law requires, which is seven years from the end of the financial year.
Customer service correspondence is kept for as long as it is useful for warranty and follow-up, and then deleted.
Marketing consent is kept until you withdraw it.
Images uploaded for a custom print are kept until your order is produced and the return window has closed, then deleted from production systems. [TODO: verify the exact retention period for uploaded images once the configurator ships, and state it as a number of days.]
Data collected through analytics cookies is kept for the period set out in the Cookie Policy.
Your rights
Under the GDPR you can ask us for a copy of the data we hold about you, ask us to correct it if it is wrong, ask us to delete it, ask us to restrict or stop a particular use, object to processing based on our legitimate interest, and ask for your data in a portable format.
Where processing is based on your consent, you can withdraw that consent at any time. Withdrawing does not affect anything we did before you withdrew.
Email us and we will handle your request within one month. We may ask you to confirm your identity first, so we do not hand your data to someone else.
If you think we have handled your data badly, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorite de protection des donnees), dataprotectionauthority.be, or to the supervisory authority in the EU country where you live.
Security
We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. The shop runs over an encrypted connection and access to customer data is limited to the people who need it to do their work.
No system is perfect. If a breach occurs that is likely to put your rights at risk, we will tell you and the supervisory authority, as the GDPR requires.
Children
The shop is not aimed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy to reflect changes in how we work or in the law. The current version always sits on this page with the date it was last changed at the top.