Privacy policy

This page sets out what personal data we collect, what we use it for, and what rights you have over it. We collect only what we actually need in order to fulfil your order.

Data controller

The data controller is Crafty Prints OÜ, registry code 17450241, address Kuldnoka 6, 10619 Tallinn, Estonia. For any data protection question, write to info@creativecanvas.ee.

What we collect

Order details: name, email address, telephone number, the parcel locker or delivery address you chose, the items ordered and the amount.
Payment confirmation: the fact that payment succeeded, the amount and a reference. Card and bank details go straight to the payment provider — we neither see nor store them.
Correspondence: if you write to us, we keep the message so that we can reply and check the context later if needed.
Account details: if you create an account, we store your email address and order history. An account is not required in order to buy.
Back-in-stock alerts: if you ask to be told when an item is back in stock, we store your email address and the item you asked about.
Reviews: if you write a review, we store the name you enter, your email address, rating and text, optionally your size and height, and your IP address to fight spam. The name, rating, text, size and height are published on the product page; your email address is not.
Custom design files: if you use the Create your design page, we store the pictures you upload and the finished design (print file, preview and layout). The files are kept on our own server, not in public; location data and other metadata are removed from pictures on upload. Designing places no cookie on your device.
Newsletter: if you sign up for the newsletter, we store your email address, your language (Estonian or English) and when you signed up and confirmed. We do not store your IP address; to limit repeated sign-up attempts we keep a hash derived from it for ten minutes.

Why, and on what basis

To fulfil your order — performance of a contract. Without this data we cannot accept an order or deliver it.
For accounting — compliance with a legal obligation. Sales documents must be retained by law.
For customer support and handling complaints — our legitimate interest in answering questions and putting problems right.
For back-in-stock alerts and reviews — your consent, given by sending the form. Reviews are published after we have read them.
For the feedback email — our legitimate interest in asking customers for feedback. After an order is completed we send one email; you can opt out at checkout or through the link in the email.
To make a product with your own design — performance of a contract. Without the uploaded file we cannot print your design.
For the newsletter — your consent, which you confirm through the link in the email we send you. You can withdraw it at any time through the link at the end of every newsletter.

We do not sell or trade your data with anyone, and we do not use it for automated decision-making or profiling.

Who we share it with

Only those needed to fulfil your order, and only to the extent needed:

Montonio Finance OÜ — to process payment.
Omniva, DPD and SmartPost — to deliver the parcel. The carrier receives your name, telephone number and chosen parcel locker.
Elkdata OÜ (Veebimajutus.ee) — web hosting and email. The data is held in Estonia.

All of these providers are in the European Union. We do not transfer personal data outside the European Economic Area.

How long we keep it

Orders and sales documents: seven years, as required by the Estonian Accounting Act.
Correspondence: up to three years from the last message.
User account: until the account is deleted. Write to us to have it deleted.
Back-in-stock alerts: until the alert is sent, and no longer than 180 days.
Reviews: for as long as the review is published. Write to us to have it removed.
Feedback-email opt-out: we keep a hash derived from your email address (not the address itself), so that we never send you these emails again.
Custom design files: designs and pictures that are never ordered are deleted automatically after 48 hours; the files of an ordered design 7 days after the order is completed. The order keeps only a note that it was a custom design.
Newsletter: until you unsubscribe — we delete the address as soon as you do. Sign-ups that are never confirmed are deleted automatically after 7 days.

Cookies

We use no tracking or advertising cookies and no third-party analytics. Browsing the shop places no cookie on your device at all, which is why this site shows no cookie banner.

Cookies appear only once you start using the shop: to remember what is in your basket and to recognise you when you are signed in. These are strictly necessary for the service to work and disappear when the basket is emptied or you sign out.

On the checkout page one further cookie is set by our payment partner Montonio, and the bank logos on that page are loaded from Montonio’s server. We use no other external service on any page. For card payments you are redirected to Montonio’s secure page — card details are never entered or processed on our website.

Your rights

You have the right to:

ask what data we hold about you and receive a copy of it;
have inaccurate data corrected;
have data erased, where we have no legal obligation to keep it;
restrict processing, or object to it;
receive your data in a machine-readable form.

To exercise any of these, write to info@creativecanvas.ee. We reply within one month.

If you believe we are handling your data unlawfully, you have the right to complain to the Estonian Data Protection Inspectorate: Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee.

Changes

If we change these principles, we will publish the new version on this page. Where a change is significant, we will tell regular customers by email.