Legal
Privacy policy
Last updated: 14 July 2026
This policy explains how ZASU OÜ (trading as “Vaelmar”), the data controller, processes your personal data under the EU General Data Protection Regulation (GDPR). Contact: hello@vaelmar.com.
What we collect, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Order & delivery details (name, address, email, phone) | To take payment, fulfil and ship your order, and contact you about it | Performance of a contract (Art. 6(1)(b)) |
| Collector inscription (when required for your destination or chosen by you) | To create the personalised print file you approve and send that file to our fulfilment partner | Performance of a contract (Art. 6(1)(b)) |
| Payment details | Stripe processes the payment and tells us whether it succeeded. We do not receive your full card number | Performance of a contract |
| Order records & invoices | Accounting and tax retention | Legal obligation (Art. 6(1)(c)) |
| Email address (newsletter, if you opt in) | To send you updates and offers | Consent (Art. 6(1)(a)). Withdrawable anytime |
| Pages viewed, device/browser details and approximate location | Google Analytics, to measure how the site is used | Consent (Art. 6(1)(a)) for visitors in the EU, EEA and UK; legitimate interest (Art. 6(1)(f)) with an opt-out elsewhere. Withdrawable anytime |
Who we share it with (processors)
- Stripe. Payment processing. (Stripe Payments Europe; transfers under the EU–US Data Privacy Framework / SCCs.)
- Gelato. Print-on-demand fulfilment; receives your shipping name and address and either the original print file or, where applicable, the finished personalised print file.
- Google (Firebase Hosting / Google Cloud). Website hosting and server logs.
- Resend. Sending your order-confirmation and transactional emails.
We do not sell your data. We give each provider only the information it needs for its part of the service.
International transfers
Where a processor stores data outside the EEA (e.g. some Stripe/Google infrastructure), the transfer is covered by EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
How long we keep it
Order and invoice records, and where applicable the approved collector inscription and its personalised print file, are kept for up to 7 years so we can document and fulfil the order, handle product claims and meet record-keeping duties. Newsletter details are kept until you unsubscribe. When analytics runs, event data is kept for no longer than 14 months. Your cart and selected delivery country remain in your browser until you clear them or your browser storage.
Cookies
Your cart and cookie choice are saved in your browser. If you are in the EU, EEA or UK, Google Analytics loads only after you press “Accept”; elsewhere it runs by default and you can opt out at any time through the “Cookies” link in the footer or your browser’s Global Privacy Control. We do not use advertising trackers.
Your rights
You have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent at any time. To exercise any of these, email hello@vaelmar.com. You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).
See also our Seller details, Terms of Sale and Returns & Refunds.