Privacy
The document
Last updated: 26 August 2026
Who is responsible for your data
The data controller is the business identified on our
Legal notice, trading as Marti & Rok. Contact:
info@martiandrok.com.
We are established in Sweden, and this policy is written to the EU General Data
Protection Regulation (GDPR).
The short version
We hold as little as posting you a print requires: what you bought, where to
send it, and how to reach you about it. **We do not build profiles, we do not
sell data, and we do not share it for advertising.**
We do not sell personal data. We do not share it for advertising. We do not
profile you.
What we collect, and why
If you buy something
We are the seller, so we hold the order. Payment card details are handled by
our payment processor and we never see your card number.
To send you a print we must pass your **name and delivery address to the press
that produces it**. That is the whole reason we hold it, and it is not used for
anything else.
| Data | Purpose | Legal basis |
| Name, delivery address | Produce and deliver your order | Contract (Art. 6(1)(b)) |
| Email address | Order confirmation, tracking, support | Contract |
| Order and payment records | Accounting and tax | Legal obligation (Art. 6(1)(c)) |
If you contact support
We keep your message and our reply, so that we have the context to help you and
so we can tell whether a recurring problem exists. Legal basis: legitimate
interest (Art. 6(1)(f)) in operating and improving the product.
Support may be drafted with the assistance of automated tools. **A human is
responsible for what is sent**, and no decision affecting you is made by
automated means alone.
If you visit the website
Shopify sets the cookies the shop needs in order to work: a cart that remembers
what you put in it, a session, and Shopify's own analytics. The notice on your
first visit controls the analytics — choose Decline and they are switched
off for you.
We run no advertising network, no third-party trackers, and nothing that follows
you to other sites. We do not sell or share your data.
How long we keep it
| Record | Retention |
| Accounting records | 7 years — required by bokföringslagen |
| Order and delivery records | 7 years, as part of the accounting record |
| Support correspondence | 24 months from last contact |
Who else sees it
We use a small number of providers, each doing one job:
| Provider | Role | Where |
| Shopify | Storefront, checkout and order records | EU / US |
| Gelato | Printing and shipping — receives your name and delivery address | EU, local to you |
| Shopify Payments | Card payments | EU / US |
| Infomaniak | Order and support email | Switzerland |
Where a provider is outside the EU/EEA, transfers rely on the European
Commission's Standard Contractual Clauses or an applicable adequacy decision.
Your rights
Under the GDPR you may request access to your data, correction of it, erasure of
it, restriction of processing, portability, and you may object to processing
based on legitimate interest. Where processing rests on consent, you may
withdraw it at any time.
To exercise any of these, email info@martiandrok.com. We respond within one
month.
If you believe we have handled your data unlawfully you may complain to the
Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) —
imy.se — or to the authority where you live.
Changes
We will post any change here and update the date above. Where a change
materially affects how we use data you have already given us, we will contact
you.