In short
- We collect only what we need to print and deliver your order.
- Your photos are seen only by the studio and are deleted 7 days after upload.
- We don't sell or share your data, show advertising or track you across other websites.
- Statistics and browser error reports run only if you allow them.
- You can ask for a copy of your data, have it corrected or deleted, and complain to a supervisory authority.
We follow Kosovo's Law No. 06/L-082 on the Protection of Personal Data and, where it applies to you, the EU General Data Protection Regulation (GDPR). We give everyone the rights described here, wherever they live.
1. Who is responsible
The controller of your personal data is:
[to be completed] (GiftsByFjolla)
[to be completed]
Business number: [to be completed]
Email: giftsfjolla@gmail.com
Phone: +38348860707
We have not appointed a data protection officer, because the law does not require one for a business of our kind. For anything about your data, write to giftsfjolla@gmail.com with "Privacy" in the subject line.
2. What we use, why, and for how long
| What | Why | Legal basis | How long |
|---|---|---|---|
| Photos you upload, including their file name and the information stored inside the file (for example the date or place it was taken) | To show you previews and print your order | Contract (GDPR Art. 6(1)(b)) | 7 days after upload, then deleted. See the photo retention policy. |
| Your order: name, phone number, delivery address, optional email address, the prints you chose and their price | To make, deliver and support your order, and to send you order messages | Contract (Art. 6(1)(b)) | Name, phone, address and email: erased 7 days after the order, once it is delivered or cancelled. The order number, prints and price stay as accounting records |
| Accounting records of the order (without photos) | To meet our legal obligations | Legal obligation (Art. 6(1)(c)) | The period set by Kosovo tax and accounting law |
| Unfinished order: a random code in a cookie and your print settings stored on your device | So your photos and settings are still there if you reload or come back | Necessary to provide the service you asked for | 24 hours after your last change; settings on your device until the order is sent or expires |
| Technical data: IP address, browser type, time of the request | To deliver the website, keep it secure and stop abuse (for example too many requests) | Legitimate interest in a secure service (Art. 6(1)(f)) | We store IP addresses only as a scrambled code (a keyed hash). Hosting logs are kept for a few days. |
| Your cookie choice: a random ID, the choice and the date, with no IP address | To respect and prove your choice | Legal obligation (Art. 7(1)) | Up to 3 years |
| Statistics (only if you allow them): anonymous counts of steps in the ordering process | To find and fix where ordering is difficult | Consent (Art. 6(1)(a)) | Up to 25 months, without anything that identifies you |
| Error reports from your browser (only if you allow them) | To fix technical problems | Consent (Art. 6(1)(a)) | 30 days |
| Messages you send us by phone or email | To answer you | Legitimate interest (Art. 6(1)(f)) or contract | As long as needed to deal with your request |
You don't have to give us your details, but without a name, phone number and address we can't deliver an order. An email address is optional.
3. Your photos in particular
- Only studio staff whose job needs it can open your photos. Every download of an original is logged.
- Previews shown on screen are made without the information stored inside the file, such as location. The original file is kept unchanged for printing until it is deleted.
- We never analyse faces, never use photos to train software or artificial intelligence, and never use them for advertising.
- Photos sometimes show other people or private matters. We use them only to print what you ordered.
4. Who receives your data
We use a small number of service providers who process data only on our instructions, under data processing agreements:
| Provider | What they do | Where the data is stored |
|---|---|---|
| Vercel Inc. | Hosts the website and the private photo storage | Frankfurt, Germany (EU) |
| Neon | Database | Frankfurt, Germany (EU) |
| Resend | Sends order emails | Ireland (EU) |
| Google (Google Drive, the studio's account) | A working copy of your photos for printing, in a folder named after the order; deleted together with the photos | EU / United States (Google) |
| WhatsApp (Meta), or CallMeBot | Sends the studio a message about your order with your name, phone and address | EU / United States |
| Functional Software, Inc. (Sentry) | Error monitoring; personal data is removed before sending | Germany (EU) |
Some of these companies are based in the United States and their staff may access data from there for support. Such transfers are covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
Delivery: the courier receives your name, phone number and delivery address to deliver the parcel. Authorities: we disclose data only when the law requires it. We never sell or rent personal data.
5. Your rights
You have the right to:
- access the data we hold about you and receive a copy;
- have incorrect data corrected;
- have your data deleted when we no longer need it or no longer may keep it;
- restrict how we use it;
- receive the data you gave us in a common format (portability);
- object to uses based on our legitimate interest;
- withdraw consent at any time, as easily as you gave it, through "Cookie settings" at the bottom of every page. Withdrawing doesn't affect what happened before.
Write to giftsfjolla@gmail.com. We answer within one month. We may ask you to confirm it is your order, for example with the order number and phone number.
You can also complain to a supervisory authority: in Kosovo, the Information and Privacy Agency (Agjencia për Informim dhe Privatësi, aip.rks-gov.net). If you live in the European Union, you can complain to the data protection authority where you live or work.
6. If you live in the United States
We don't sell or share personal information, we don't use it for targeted advertising, and we don't create profiles that produce legal effects. We honour the Global Privacy Control signal: if your browser sends it, optional statistics and error reports stay off. In the last 12 months we collected the categories listed in section 2 (identifiers and contact details, order information, photos you provided, and limited technical information), for the purposes listed there. You can ask to know, correct or delete your information as described in section 5, and we won't treat you differently for doing so.
7. Children
Our service is meant for adults. Children under 16 should order with a parent or guardian. We don't knowingly collect data from children under 13.
8. Security
We use encrypted connections, private storage that refuses every request without a short-lived signed link, separate access rights for each staff role, two-step sign-in for administrators, and logs of sensitive actions. Personal data is removed from error reports and technical logs.
9. Our apps for Android and iPhone
When our apps are available, this policy applies to them in the same way. The apps ask for access to your photos only to let you pick the ones you want printed, and to your camera only if you choose to take a photo. Notifications are optional and contain no personal details. The apps contain no advertising and no tracking. Apple and Google process data when you download an app, under their own privacy policies.
10. Automated decisions
We make no decisions about you based solely on automated processing.
11. Changes to this policy
We update this policy when our service or the law changes. The date of the current version is at the top of this page.