Privacy
What we do with personal data, why, and how to get it back or have it removed.
Who is responsible
SIA RKS-Int, Garkalnes iela 4, Garkalne, Garkalnes pag., Ropažu nov., LV-2137, is the controller for the data described below. Reach us at billing@tullunprint.com.
There are two different relationships here and they matter, because they decide who you ask for what:
- Merchants — the shops that use us to print. We are the controller of their account data.
- Buyers — the people who order from those shops. For their details we are the processor, acting on the shop's instructions. The shop is the controller, and a buyer wanting their data removed should ask the shop they bought from. We act on what the shop tells us.
What we hold, and why
If you have a merchant account
- Your name, email and password, to let you in — because we cannot run the account otherwise (performance of a contract).
- If you sign up or sign in with Google: your name, email address and the identifier Google gives your account, so that the same Google account lets you in next time. Never your Google password, your contacts or anything else in your Google account.
- Company name, address, registration and VAT numbers, because an invoice is not lawful without them (legal obligation).
- Your designs, products and templates, because they are the work you came here to do.
- Invoices, payments and wallet entries, kept as accounting records (legal obligation).
- Any notices we have sent you about your account.
If you bought from a shop we print for
- Your name, delivery address, and what was ordered, so the parcel can be made and sent.
- Any artwork or text you personalised the item with.
We hold these on the shop's behalf. We do not market to buyers, and we do not use their details for anything but making and delivering the order.
Cookies
We keep only what the site needs to work, all of it strictly necessary: a cookie that keeps you signed in, one that protects forms from being submitted from somewhere else, your cookie choice, and — only if you arrived through a referral link — who sent you. www.tullunprint.com asks before anything that would measure your visit, and today nothing does. The full list, with how long each is kept, is on the Cookies page.
We run no analytics, no advertising pixels and no third-party trackers. The fonts and scripts these pages use are served from our own domain, so loading a page here does not announce your visit to anybody else.
Who else sees it
Only the companies that have to, to get an order made and paid for:
- Carriers, to deliver a parcel — they get the delivery address.
- Our payment provider, to take a payment. Card details go to them and never to us; we never see or store a card number.
- The shop you bought from, where you bought through one — they were always the seller.
- Our hosting provider, on whose servers the system runs.
- Google, only if you choose to sign in with it — Google then knows you signed in to TullunPrint.
Still to be completed before launch. Article 13(1)(e) requires the recipients to be named or described by category, and where any of them process data outside the EU, the safeguard relied on has to be stated. The full sub-processor list, with names and locations, belongs here — as does the data processing agreement offered to merchants under Article 28.
How long we keep it
- Accounting records — invoices and the details on them — for as long as tax law requires them kept.
- Buyer details on an order — anonymised on a schedule after the parcel ships, so what remains is the order rather than the person.
- Merchant accounts and artwork — while the account is open, and removed when it is closed, other than what the law requires kept.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to what we do with it, or take it elsewhere. We answer within one month.
Merchants do not have to ask. Your Your data page hands over a complete copy immediately, and starts a deletion request the same way.
Some data cannot be deleted on request: an issued invoice is kept because the law requires it (Article 17(3)(b) of the GDPR). When you ask, we tell you exactly what was removed and what was kept, and under what obligation — before you decide as well as after.
Complaining
Tell us first — most things are quicker to fix than to escalate. You also have the right to complain to a supervisory authority. Ours is the Data State Inspectorate of Latvia (Datu valsts inspekcija), and you may instead complain to the authority where you live.