Privacy Policy

Last update: 26/07/2026

This Privacy Policy explains how Luca Stefanelli Studio (CVR DK45009734), operating the online shop at lucastefanelli.photography/shop ("we", "us", "our"), collects, uses, and protects your personal data when you visit our site or purchase a product. We are the data controller for the personal data described below.

‍ ‍

Contact details‍ ‍

Because we are based in Denmark, this policy is written to comply with the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

1. What personal data we collect‍ ‍

  • Order and account data: name, delivery address, billing address, email address, phone number (if provided), and order history.

  • Payment data: our payment processor handles and stores your card/payment details directly — we do not store full card numbers ourselves.

  • Technical and usage data: IP address, browser type, device information, and pages visited, collected automatically via cookies and analytics tools.

  • Communications: any messages you send us via email or contact forms.

‍ ‍

2. How we use your data

We use your personal data to:

  • process and fulfill your order, including passing your name and delivery address to our print-on-demand partner so they can print and ship your poster;

  • process payment through our payment provider;

  • respond to customer service requests;

  • comply with accounting and tax obligations under Danish law;

  • understand how visitors use our site, using aggregated analytics;

  • send you order-related communications (e.g. shipping confirmations).

We do not use your data for marketing emails unless you separately opt in, and we do not sell your personal data to third parties.

3. Legal basis for processing

We process your data on the following legal bases under GDPR Article 6:

  • Contract: to fulfill an order you place with us.

  • Legal obligation: to meet bookkeeping and tax requirements.

  • Legitimate interest: to maintain and improve our website and prevent fraud.

  • Consent: where you opt in to marketing or non-essential cookies.

4. Who we share your data with

We share personal data with the following categories of third-party processors, only as needed to run the shop:

‍ ‍

  • Printumo (print-on-demand fulfillment) — receives your name, delivery address, and order details to print and ship your poster directly to you.

  • Payment processor (Stripe/PayPal, as integrated via Squarespace Commerce) — receives payment details to process your transaction.

  • Squarespace — our website and e-commerce hosting platform, which stores order and account data on our behalf.

  • Google Analytics — receives anonymized/aggregated usage data via cookies to help us understand site traffic. You can opt out via your cookie settings or browser tools.

Some of these providers (e.g. Google) may process data on servers located outside the EU/EEA. Where this happens, we rely on their compliance with the EU-U.S. Data Privacy Framework or Standard Contractual Clauses to ensure an adequate level of protection.

We do not share your data with third parties for their own marketing purposes.

5. Cookies ‍

Our site uses cookies for essential shop functionality (e.g. cart, checkout) and, where enabled, analytics cookies (Google Analytics) to measure site traffic. Squarespace may also set its own functional cookies. You can control or disable non-essential cookies through the cookie banner on our site or your browser settings.

6. How long we keep your data‍ ‍

We retain order and invoice data for as long as required under Danish bookkeeping law (currently 5 years from the end of the relevant financial year). Account and contact data is kept for as long as necessary for the purposes described above, after which it is deleted or anonymized.

7. Your rights

‍Under GDPR, you have the right to:

  • request access to the personal data we hold about you;

  • request correction of inaccurate data;

  • request deletion of your data ("right to be forgotten"), subject to our legal retention obligations;

  • object to or request restriction of certain processing;

  • request a copy of your data in a portable format;

  • withdraw consent at any time, where processing is based on consent;

  • lodge a complaint with the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk) if you believe your data has been mishandled.

To exercise any of these rights, contact us at luca@lucastefanelli.dk.

8. Data security‍ ‍

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse, including relying on the security measures of our reputable platform providers (Squarespace, payment processor, Printumo).

9. Children's privacy‍ ‍

Our shop is not directed at children, and we do not knowingly collect personal data from anyone under 16.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be reflected on this page.

‍ ‍

11. Contact us ‍

Questions about this policy or your data can be sent to luca@lucastefanelli.dk or by post to the address above.