Privacy notice

Gus McEwan Photography, Ryesgade 62, 2100 København Ø, Denmark. CVR 34922993. Email: · · ·.

Orders

Name, email, delivery address, the products you buy, the order amount and invoice. Purpose: to make, deliver and invoice your order and handle complaints. Legal basis: performance of the contract (GDPR art. 6(1)(b)) and our legal duties under the Danish Bookkeeping Act (art. 6(1)(c)).

VAT evidence

Your country (derived from your IP address at checkout), the IP address itself, and the country of your card. Purpose: to determine and document which VAT applies. Legal basis: legal obligation under VAT law (art. 6(1)(c)).

Business buyers

Your EU VAT number, business name and address, and the result of the check in the EU Commission’s VIES system. Legal basis: legal obligation (art. 6(1)(c)).

Payment

Payment is handled by Stripe. We receive the payment status, card type, the last four digits and the issuing country — never the full card number. Legal basis: contract (art. 6(1)(b)).

Downloads

A download link, passcode and a technical record of the order, so you can fetch your files. Legal basis: contract (art. 6(1)(b)).

Messages

What you write in the contact or licensing form, and your name and email. Purpose: to answer you. Legal basis: our legitimate interest in answering enquiries (art. 6(1)(f)), or steps before a contract (art. 6(1)(b)).

Connection data

Your IP address is used when you load the site and at checkout (to work out which VAT applies). We keep no server logs of our own. Legal basis: legitimate interest (art. 6(1)(f)) and legal obligation under VAT law (art. 6(1)(c)).

We do not use your data for marketing, profiling or automated decisions, and we do not sell it.

We use these processors and partners only as far as needed for the purposes above:

Stripe

Payments. Stripe Payments Europe Ltd., Ireland; may transfer data to Stripe, Inc. in the USA (EU–US Data Privacy Framework / standard contractual clauses). For fraud prevention and its own legal duties Stripe is an independent controller — see stripe.com/privacy.

Prodigi

Printing and shipping of prints and posters: your name, delivery address and email, and the products. Prodigi Group Ltd, United Kingdom, and its operating companies, including Prodigi BV in the Netherlands, where orders for EU addresses are normally printed. The United Kingdom is covered by an EU adequacy decision. Prodigi passes your name and address to the carrier that delivers the parcel.

Apple (iCloud Mail)

Sending order confirmations, download links and replies by email. Apple Distribution International Ltd., Ireland.

Cloudflare

Network, security and caching between your browser and our server, and a backup copy of the site. Cloudflare, Inc., USA (EU–US Data Privacy Framework).

Formspree

Delivers messages from the contact and licensing forms to us. Formspree, Inc., USA — your message is transferred to the USA so that it can reach us.

European Commission (VIES)

Validation of EU VAT numbers for business purchases.

Authorities

Tax authorities (Skattestyrelsen), when required by law.

The site and order records are hosted on our own server in Denmark.

• We keep as little as possible. Our own server deletes each order record, including the download link and passcode, 30 days after purchase.
• The only thing we keep after that is the invoice, because the Danish Bookkeeping Act requires us to keep accounting records for 5 years from the end of the financial year.
• Messages from the contact and licensing forms are deleted once your enquiry has been dealt with.
• We keep no server logs or analytics of our own.
• Stripe and Prodigi keep the records of your payment and of your print order under their own retention rules (see their privacy policies).

We do not use analytics, advertising or tracking cookies. The site only stores what is strictly necessary for the service you ask for, so no consent banner is needed:

NEXT_LOCALE (cookie)

Remembers the language you chose. Deleted when you close the browser.

gmp-cart (local storage)

Keeps the contents of your cart on this device until you check out or empty it.

dl_<order> (cookie)

Set only after a purchase: proves that this browser has unlocked your downloads. Expires after 30 days.

Stripe (cookies)

Set by Stripe only when the payment form is loaded, for fraud prevention and to complete the payment securely.

preserveMobileMenu (session storage)

Keeps the mobile menu open when you change language. Deleted when you close the tab.

You have the right to access the data we hold about you, to have it corrected or erased, to restrict or object to processing, and to receive your data in a portable format. Some data must be kept by law (for example invoices) and cannot be erased before the retention period ends.

To use your rights, email · · ·. You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.