Our privacy policy

Data controller

Miron Digital (trading as Studio Miron)

Address

Deken Darraslaan 5 bus 101, 8700 Tielt, Belgium

Company number

0793239175

VAT number

BE0793239175

Email

hello@studiomiron.com

Phone

+32 (0)51 58 40 52

We are based in Belgium and work from our own studio there. We deliver throughout the European Union, the United Kingdom, the United States and Canada. What you order is designed, printed and packed by us, so your details do not go to an external print shop.

• Order details: your name, email address, billing and delivery address, phone number if you provide it, order number, chosen products, version and quantities.
• Customer account: your sign-in status and the profile, contact and address details you view or save in your account. Your account lives in the same secured store environment as your orders; our site itself only stores the strictly necessary cookies that keep you signed in.
• Personalisation details: the text you have printed on a card, game, invitation, poster or sign. Usually that is a name, a date or a short sentence. If you choose the personalised version, that text travels with your order exactly as you typed it. A note you add to your order is also stored with that order. Only enter details you want processed on the product and in your order.
• Payment details: we see whether a payment succeeded and with which method. Your full card or account details never reach us. The payment provider processes those.
• Communication: your name, email address and whatever you email us or send through the contact or cancellation form, including order number and return details when they are needed.
• Newsletter details: your email address, confirmation status and unsubscribe status.
• Technical data: IP address, time, browser and request data and limited server logs for security and troubleshooting. Your cart uses two necessary cookies and temporary session storage to restore focus. We also store in your browser your cookie choice and a list of the products you recently viewed; that list stays in your browser for at most 30 days and is not sent to us. See our Cookie Policy.
• Statistics data: pages visited, the page you came from, country, device type and browser type, plus a few store steps such as adding something to the cart. This measurement is cookieless, places nothing on your device and cannot be traced back to your name, account or order.
• Advertising data, only with your separate consent: Google would then link your visit and a few store steps to the ad that brought you to us, with its own cookies and identifiers. At the moment we do not advertise yet; even with a yes, nothing from Google loads and no advertising cookie reaches your device. Exactly what happens once we do advertise is explained in our Cookie Policy.

• Processing your order, making and printing it in the studio, sending it and invoicing it. Legal basis: performance of the contract.
• Letting you sign in and showing and updating your profile, addresses and order details in the customer account. Legal basis: performance of the contract about the customer account that you conclude with us when you create the account.
• Answering your questions and complaints. Legal basis: performance of the contract or our legitimate interest.
• Meeting our legal obligations, such as the retention requirement for invoices. Legal basis: a legal obligation.
• Sending you a newsletter, but only if you consent yourself. Legal basis: your consent. You first confirm through a link and a button. After that you can unsubscribe with one click.
• Limiting form abuse, duplicate submissions and technical attacks and fixing outages. Legal basis: our legitimate interest in keeping the store and mail service secure and available.
• Understanding which pages and products help visitors and improving the store with that knowledge, through cookieless, anonymous visitor statistics. Legal basis: our legitimate interest in improving the store; the measurement places nothing on your device and cannot be traced back to you. Questions or objections: email us.
• Measuring whether our ads bring visitors and orders, so we can pay for advertising by its results. Legal basis: your separate consent to ad measurement, through the cookie banner. At the moment we do not advertise and therefore measure nothing; we already ask for your choice so we can respect it right away once that changes. You can withdraw this choice at any time with the Cookie settings button.

We do not use your data to build profiles, and we do not sell your personal data to third parties.

• Shopify, the platform behind our store: that is where your customer account, the cart, checkout, payment and order management run. Shopify receives your profile, address, order and contact details and, for a personalised product, the text that goes on it, so your order can be made.
• Payment providers at checkout: process the data needed for the payment method you choose. Which provider that is depends on the method and is shown at checkout. We never receive a full card or account number.
• The carrier: receives your name, delivery address and the necessary delivery details.
• Vercel, the company that hosts our site: this means technical data is processed, such as your IP address, the time and browser data. What you enter in a form or your cart also passes through those servers.
• Vercel Web Analytics, our visitor statistics: the same company that hosts our site adds up the statistics data above for us. No cookies are set for this, nothing is stored on your device and no visitor profile is built.
• Google (ad measurement), only with your separate consent: would receive through its advertising tag which ad brought you to our site and which store steps followed. Google is independently responsible for that and acts according to its own privacy policy. As long as you have not said yes, we load nothing from Google: there is no Google code on the page, so Google does not receive a single signal and learns nothing about your visit. If you withdraw a yes you gave earlier, the code loaded at that moment immediately receives a denial signal, and after that nothing loads anymore. And because we do not advertise at the moment, even with a yes nothing goes to Google.
• Judge.me, our review platform: manages the reviews customers write about our products and our store, and requests them by email after an order. If a review includes a photo, that photo loads directly from the Judge.me servers; at that moment Judge.me receives your IP address and browser data. The review texts themselves we collect when building the site, not from your browser, and of each review we only show the display name its author chose.
• Resend, our mail provider (United States): sends our email and processes recipient, sender, subject, message content and delivery metadata for that. This includes newsletter confirmations, contact and cancellation messages and the confirmation of receipt of a cancellation. Contact and cancellation emails also arrive in our own mailbox.

We may also share data when the law requires it, or with professional advisers bound to confidentiality. The visitor statistics place nothing on your device; ad measurement stays off until you switch it on through the cookie banner. Without your consent there are no advertising pixels or tracking cookies on our site.

We are based in the European Union. The United Kingdom recognises the European Economic Area as offering an adequate level of protection, so your data can be transferred to and processed in our systems in the EU. Shopify, the platform behind our store, is Canadian and may process data in Canada and other countries; for Canada, UK adequacy regulations apply where relevant. For other transfers we rely on the safeguards the UK GDPR allows, such as the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses of the European Commission. Resend, our mail provider, processes data mainly in the United States and uses the Data Privacy Framework with its UK Extension alongside those contractual safeguards. Vercel, which hosts our site and adds up the visitor statistics, also uses appropriate safeguards for transfers outside the United Kingdom and the EEA. Judge.me, our review platform, may process data outside the United Kingdom and the EEA; if a review photo is shown, Judge.me receives your IP address. That transfer rests on appropriate safeguards. If we start advertising and you switch on the measurement, Google is certified under the Data Privacy Framework and its UK Extension. You can email us if you want more information or a copy of these safeguards.

• Invoices and accounting records: 10 years. That is the retention period Belgian VAT law prescribes for invoices and bookkeeping, and it applies to us because we are based in Belgium. Other order details, including the personalisation text belonging to your order, are only kept as long as they are needed for warranty, complaints and a possible dispute.
• Profile and address details in your customer account: as long as your account is active or as long as they are needed for the service. You can ask us to delete the account and this data. Data that is also part of an order or invoice is afterwards only kept as long as the legal retention requirement or an ongoing dispute demands.
• The print files we prepare in the studio for your order: no longer than needed for production, delivery, reprints and complaint handling.
• Email contact: 2 years after the last message.
• Newsletter: active until you unsubscribe. After that, our mail provider only keeps your email address and unsubscribe status on a suppression list, as long as needed to respect your unsubscribe. That data is not used to send newsletters.
• Technical logs: per the limited retention period configured at the company that hosts our site. We only keep them longer if needed to investigate a specific security incident.
• For form security we keep hashed keys for at most 24 hours and only inside the active server function. Your email address itself is not stored in that counter.
• The cart cookies: 14 days.

You have the right to access your data, have it corrected or deleted, have the processing restricted, object, and have your data transferred. If you gave consent, you can withdraw it at any time; that does not affect the lawfulness of the processing carried out on the basis of your consent before you withdrew it.

Email us at hello@studiomiron.com. We respond as soon as possible and at the latest one month after receiving your request. You can always lodge a complaint with a supervisory authority, without contacting us first: in the United Kingdom that is the Information Commissioner's Office (ico.org.uk), and you can also contact the Belgian data protection authority (Gegevensbeschermingsautoriteit, gegevensbeschermingsautoriteit.be), which supervises us because we are based in Belgium.

Our store is meant for adults ordering something for a baby shower, a birth, a wedding or another celebration. Our services are not directed at children under the age of 13 and we deliberately do not ask children for data. If you put your child's name or date of birth on a card, game or poster, we only use it to make and send that product.

Do you think we have still received data about a child that should not be with us? Email hello@studiomiron.com and we will delete it.

The site runs entirely over an encrypted connection. Your cart lives in a cookie that JavaScript in your browser cannot read (httpOnly). Payment details go directly to the payment provider and never pass through our servers.

Access to order and customer data is limited to those who need it to make your order, send it or answer your question. If you still notice something that seems wrong, let us know through our contact page.