Privacy policy
Last updated: 4 October 2026
Who is responsible for your data
The data controller is the business identified on our Legal notice, trading as Marti & Rok. Contact: info@martiandrok.com.
We are established in Sweden, and this policy is written to the EU General Data Protection Regulation (GDPR).
The short version
We hold as little as posting you a print requires: what you bought, where to send it, and how to reach you about it. We do not build profiles of you, sell your data, or share it for advertising.
What we collect, and why
If you buy something
We are the seller, so we hold the order. Payment card details are handled by our payment processor and we never see your card number.
To send you a print we must pass your name and delivery address to the press that produces it. That is the whole reason we hold it, and it is not used for anything else.
| Data | Purpose | Legal basis |
| Name, delivery address | Produce and deliver your order | Contract (Art. 6(1)(b)) |
| Email address | Order confirmation, tracking, support | Contract |
| Order and payment records | Accounting and tax | Legal obligation (Art. 6(1)(c)) |
If you contact support
We keep your message and our reply, so that we have the context to help you and so we can tell whether a recurring problem exists. Legal basis: legitimate interest (Art. 6(1)(f)) in operating and improving the product.
Support may be drafted with the assistance of automated tools. A human is responsible for what is sent, and no decision affecting you is made by automated means alone.
If you visit the website
Shopify sets the cookies the shop needs in order to work: a cart that remembers what you put in it, a session, and Shopify's own analytics. The notice on your first visit controls the analytics. Choose Decline and they are switched off for you.
We run no advertising network, no third-party trackers, and nothing that follows you to other sites. We do not sell or share your data.
How long we keep it
| Record | Retention |
| Accounting records | 7 years, as bokföringslagen requires |
| Order and delivery records | 7 years, as part of the accounting record |
| Support correspondence | 24 months from last contact |
Who else sees it
We use a small number of providers, each doing one job:
| Provider | Role | Where |
| Shopify | Storefront, checkout and order records | EU / US |
| Gelato | Printing and shipping. Receives your name and delivery address | EU, local to you |
| Shopify Payments | Card payments | EU / US |
| Infomaniak | Order and support email | Switzerland |
Where a provider is outside the EU/EEA, transfers rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision.
Your rights
Under the GDPR you may request access to your data, correction of it, erasure of it, restriction of processing, portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time.
To exercise any of these, email info@martiandrok.com. We respond within one month.
If you believe we have handled your data unlawfully you may complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the authority where you live.
Changes
We will post any change here and update the date above. Where a change materially affects how we use data you have already given us, we will contact you.