Privacy policy

This policy explains what personal data we collect when you visit museartis.com or buy from us, why we collect it, who receives it and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023) and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who is responsible

Digiboo GmbH, Schiffliweg 9, CH-8700 Küsnacht ZH, Switzerland. Museartis is a shop of Digiboo GmbH.
Email: info@museartis.com

We have not appointed a data protection officer; the size and nature of our processing do not require one. For any question about your data, write to the address above.

2. What we collect

When you browse. Your IP address, browser and device type, referring page, the pages you view and how you interact with them. Our shop platform records this in server logs and through cookies and similar technologies (see section 7).

When you order. Your name, billing and delivery address, email address, telephone number if you give it, and the contents of your order. Payment card details are entered directly with the payment provider; we never see or store the full card number.

When you review a purchase. After delivery we may email you once to ask for a review. If you write one, we store your name as you give it, your email address, your rating, your text and any photo you add. Published reviews show your name in the form you choose. Every request contains a link to stop further requests.

When you contact us or subscribe. Your email address and whatever you choose to write to us.

You are not obliged to give us any data. Without your name, address and email address we cannot, however, accept or deliver an order.

3. Why we process it, and on what basis

Purpose	Legal basis (GDPR / UK GDPR)
Performing the contract — processing, printing, shipping and invoicing your order	Contract, Art. 6(1)(b)
Answering your enquiries	Contract or legitimate interest, Art. 6(1)(b) or (f)
Fraud prevention and site security	Legitimate interest, Art. 6(1)(f)
Keeping accounting records	Legal obligation, Art. 6(1)(c); Swiss law (Art. 958f CO) requires ten years
Asking for and publishing reviews	Legitimate interest, Art. 6(1)(f); publication with your consent, Art. 6(1)(a)
Newsletter, if you have subscribed	Consent, Art. 6(1)(a), withdrawable at any time
Analytics, reach measurement and advertising (Google, Pinterest)	Consent, Art. 6(1)(a), where the law requires it; otherwise legitimate interest

Our legitimate interests are running a secure shop, improving it, and learning whether our prints satisfy those who buy them. We do not take decisions about you by automated means alone.

4. Who we share it with

We pass on only what each recipient needs for its task:

Shopify International Limited (Ireland) and its group companies, including Shopify Inc. (Canada) and Shopify (USA) Inc. — operate our online shop, checkout and customer emails and host this site. Where we have enabled it, Shopify also uses shop data, combined with data from its other services, to improve its products and to offer features such as fraud protection and audience insights (Shopify Network Intelligence); Shopify does not pass your data to other merchants. Shopify's own processing is described at shopify.com/legal/privacy; you can exercise your rights against it at privacy.shopify.com.
Gelato ASA (Norway) and its printing partners in the country of delivery (for example Germany or the United States) — receive your name, delivery address and order details in order to print and dispatch your prints.
Prodigi Global Ltd (United Kingdom) and its printing partners — the same, for products made by Prodigi.
Payment providers (Shopify Payments, PayPal and the card networks) — process your payment.
Judge.me — sends review requests and hosts reviews.
Google (Google Ireland Limited and Google LLC, USA) — analytics (Google Analytics), product listings and advertising measurement (Google & YouTube, Merchant Center), and our business email.
Pinterest Europe Ltd (Ireland) and Pinterest, Inc. (USA) — product pins and advertising measurement.
Postal and courier services and customs authorities — receive the data needed to deliver your parcel and, where necessary, clear it through customs.
Our accountant and, where the law requires it, the tax authorities.

We do not sell your personal data, and we do not pass it to third parties for their own advertising.

5. Transfers abroad

Data are processed in Switzerland, the European Economic Area, the United Kingdom, Canada and the United States. Switzerland, the EEA, the United Kingdom and Canada are recognised as providing adequate protection. For the United States we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework (with the UK Extension) where the recipient is certified, and otherwise on the standard contractual clauses of the European Commission, recognised by the Swiss Federal Data Protection and Information Commissioner, together with the UK addendum. You may ask us for a copy of these safeguards.

6. How long we keep it

Order and invoice data: ten years, as Swiss accounting law requires. Enquiries: as long as needed to deal with them, then up to two years. Reviews: as long as they are published, or until you ask us to remove them. Newsletter data: until you unsubscribe. Server logs: a few months at most.

7. Cookies and similar technologies

Necessary cookies keep your cart, checkout and session working; they are set without consent. If you visit from the EEA or the United Kingdom, analytics and marketing cookies and pixels are set only after you agree in the cookie banner. In other countries, including the United States and Switzerland, they are active by default; you can object at any time through the cookie settings on this site (where shown), the "Your privacy choices" page, your browser settings, or Google's opt-out tools.

8. Your rights

You may ask us for a copy of the data we hold about you, have inaccurate data corrected, have data deleted, object to processing based on legitimate interest, restrict processing, and receive your data in a portable format. Where processing rests on consent, you may withdraw it at any time with effect for the future. Residents of certain US states may opt out of targeted advertising and the "sale" or "sharing" of personal data through the "Your privacy choices" page.

Write to info@museartis.com. We answer within thirty days and may ask you to identify yourself first, so that we do not hand your data to someone else.

If you are unhappy with how we handle your data, you may complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch), to the supervisory authority of your EEA country, or, in the United Kingdom, to the Information Commissioner's Office (ico.org.uk).

9. Security

We use TLS encryption for all traffic on this site and choose providers who maintain appropriate technical and organisational security measures. No system is perfect, and we cannot guarantee absolute security.