GDPR Compliance

This page explains how GreetingStudio meets its obligations under the EU General Data Protection Regulation (GDPR) and the UK GDPR, and how you can exercise your data protection rights. It supplements, and should be read alongside, our Privacy Policy.

1. Who This Applies To

If you are located in the European Economic Area (EEA), the UK, or Switzerland, the rights and safeguards described on this page apply to the personal data we process about you.

2. Legal Basis for Processing

We only process personal data where we have a valid legal basis to do so:

• Performance of a contract — to create your account, save and deliver your greeting cards, and process payments.
• Consent — where you upload a photo to add to a card, and for any optional marketing communications you opt into.
• Legitimate interests — to keep the service secure, prevent fraud and abuse, and improve reliability, balanced against your rights and interests.
• Legal obligation — where we're required to retain certain records, such as for tax and payment compliance.

3. Your Rights Under GDPR

Subject to applicable exceptions, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your account and associated personal data.
• Restrict processing — ask us to limit how we use your data in certain circumstances.
• Data portability — receive your data in a structured, commonly used, machine-readable format, or have it transferred to another provider.
• Object — object to processing based on legitimate interests, including profiling.
• Withdraw consent — where processing is based on consent (such as uploaded photos), withdraw it at any time without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us at [email protected]. We aim to respond within one month, as required by GDPR.

4. Sub-processors and International Transfers

We share limited personal data with the sub-processors listed in our Privacy Policy (currently Creem for payments and Cloudflare for hosting and storage) strictly to provide the service. Where personal data is transferred outside the EEA or UK, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, to ensure it remains protected.

5. Data Retention

We keep personal data only for as long as needed to provide the service and meet legal obligations, as described in our Privacy Policy. You can request deletion of your account and associated data at any time.

6. Cookies

We use a single, secure, HTTP-only session cookie to keep you signed in; it is essential to the service and needs no consent. We do not use advertising cookies.

We also offer optional analytics through Google Analytics 4. It is loaded only if you click "Accept" in our cookie banner, which is your consent under GDPR. You can withdraw or change it at any time through "Cookie settings" in the footer, and declining does not limit your use of the site. When enabled, it sets first-party cookies (_ga, _ga_…) and sends usage data to Google; advertising and ad-personalization features are turned off.

With "Accept all", we additionally load the Meta Pixel and the TikTok Pixel to measure the performance of our advertising on Facebook, Instagram and TikTok. This is also based on your consent (Art. 6(1)(a) GDPR), may involve transfers of personal data outside the EEA to Meta and TikTok, and can be withdrawn at any time through "Cookie settings" in the footer. Choosing "Analytics only" or "Decline" keeps these pixels off.

7. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with your local data protection supervisory authority, in addition to contacting us directly.

8. Contact Us

For any GDPR-related request or question, email us at [email protected].