Privacy Statement

Pawtrait Atelier — Chamber of Commerce (KvK) registration being finalised (number to follow here), established in Nederland. Contact: info@pawtraitatelier.com.

• A photograph of your cat or dog that you upload for the making of a preview and final product.
• Order details: name, email address, billing and delivery address, payment information (processed by Shopify Payments).
• Session data: a temporary cookie ID and a hashed IP for abuse prevention.
• Visitor statistics via Plausible Analytics (cookieless, anonymised).
• Contact details you enter yourself via the contact form: your name, email address and the message you write.
• Email address when you subscribe to our newsletter.
• Market stand (Mini Pawtrait): when you scan the QR code at our stand we process your pet’s name, your e-mail address and the photo you upload so we can e-mail you the portraits for free; your stand number, the frame you choose and — if you buy a print — the amount. If you leave the “gallery” box ticked, we record that too: that your portrait may hang at the stand and on our website. The moment you pick the photo it is checked automatically: once to determine whether it shows a cat or a dog (so we can show you the right examples) and once to block inappropriate imagery. No human sees it for that, and the photo is not stored separately for it.

• Performance of your order — legal basis: contract.
• The making of your AI preview and final work — legal basis: explicit consent, which you may withdraw before your order goes into production.
• Showing your portrait in our gallery — at the stand and on pawtraitatelier.com, as an example for other customers — legal basis: consent, via the tick box at the stand. You may withdraw that consent at any time by e-mail; it changes nothing about your portrait or your order.
• Abuse prevention and fraud detection — legal basis: legitimate interest.
• Anonymous statistics — legal basis: legitimate interest.
• Replying to your contact message — legal basis: legitimate interest.
• Sending our newsletter — legal basis: consent (double opt-in); you may unsubscribe at any time via the link at the foot of every newsletter.

We share your data with the following processors, all under a data processing agreement:

• Shopify International (Ireland) — checkout, payments and orders.
• OpenAI Ireland (Ireland) — image generation via gpt-image-2. Your photograph is sent encrypted; under the current API policy OpenAI does not retain it for training.
• Supabase (EU-Frankfurt region) — storage of your photograph and preview.
• Resend (EU) — sending of transactional emails and, after your subscription, our newsletter.
• Cloudflare — CDN and DDoS protection.
• Vercel (EU region) — hosting of our preview app.
• Plausible Analytics (Germany) — cookieless web statistics.
• Sentry (Functional Software, Inc., US — EU ingest de.sentry.io, under SCCs) — technical error monitoring (may include IP address and URL).
• hCaptcha (Intuition Machines, Inc., US — under SCCs) — bot protection on the upload form in the atelier; receives your IP address and loads a script from hcaptcha.com.
• PostNL — parcel delivery.

• Uploads without an order: a maximum of 7 days, after which they are deleted automatically.
• AI previews without an order: a maximum of 30 days, after which they are deleted automatically.
• Photographs and previews tied to a placed order: a maximum of 90 days after delivery, after which they are deleted automatically from our storage.
• Order information (administration): 7 years, in accordance with the fiscal retention obligation.
• Newsletter subscription: until you unsubscribe.
• Market stand: we keep your photo for a maximum of 35 days — long enough to redo a portrait if something went wrong — and not beyond that. The portraits we made we keep without a fixed end date, so that you can reorder a print later and we can help you if something about the portrait is not right. We use them for that alone, and — only if you ticked the box at the stand — to show them in our gallery, at the stand and on pawtraitatelier.com, without your photo, names or e-mail address. You withdraw that consent with one e-mail to info@pawtraitatelier.com; we then take the portrait down within four weeks. The download link in your e-mail works for 30 days; after that we send you a new one on request. Your pet’s name and e-mail address are part of the sales record, which we keep for 7 years — for as long as the fiscal retention obligation requires us to keep that record. Would you like us to delete your portraits sooner, or everything we are not legally required to keep? One e-mail to the same address is enough.

You have the right of access, rectification, erasure, restriction, objection and portability of your data. Email us at info@pawtraitatelier.com. Do we fail to respond within four weeks? Then you may lodge a complaint with the Dutch Data Protection Authority.

We may amend this statement. The latest version is always at pawtraitatelier.com/privacy. In the event of significant changes we will inform you by email.