Privacy policy

Who is responsible

SB Digital, Gripvelden 14, 4707 ZD Roosendaal, Netherlands, KvK 90232119, hello@curveandclimb.eu, is responsible (the “controller”) for the personal data described here.

What we use, and why

• Your order. Name, delivery address, email address, the prints you ordered, any personalisation text you enter, and the order history. We need these to make, deliver and support your order (performance of a contract), and we keep order records because tax law requires it (legal obligation).
• Payment. Payments are handled by Stripe. We receive the payment status and method, never your full card or bank details.
• Emails you send us. To answer your question.
• Server logs. Technical logs (IP address, time, requested page) are kept briefly to keep the site secure and working (legitimate interest).
• Country check. To keep automated traffic out, the server looks up the country of your IP address in a local copy of a geolocation database and refuses requests from China, Russia, Singapore, Taiwan, India, Malaysia and Hong Kong, where we do not deliver. The address is not sent anywhere or stored for this (legitimate interest). IP geolocation by DB-IP (CC BY 4.0).

Cookies and your browser

We do not use tracking or advertising cookies. Your bag, a personalisation draft and your light or dark theme are saved in your own browser (local storage) so they are still there when you come back. We receive the bag’s contents only when checking prices and when you check out. Stripe’s checkout page (on stripe.com) uses its own cookies to prevent fraud.

Who helps us (processors)

We share personal data only with the companies we need to run the shop, and never sell it:

• Stripe (Stripe Payments Europe Ltd., Ireland): payments. Stripe may also process data in the United States, under the EU–US Data Privacy Framework and standard contractual clauses.
• Prodigi (United Kingdom): prints and ships your order through its print network and receives your name, delivery address and order details. The United Kingdom has an adequacy decision of the European Commission.
• The carrier that delivers your parcel receives your name and delivery address.
• Brevo (France): sends the emails about your order.
• Hetzner (Germany): hosts the website, the database and the backups.
• OVHcloud (France): domain names and the business email inbox.

How long we keep it

• Order and invoice records: 7 years, because Dutch tax law requires it.
• Emails with questions: as long as needed to answer and follow up, then deleted.
• Server logs and backups: only as long as needed for security, recovery and maintenance.

Your rights

You may ask to see, correct or delete your data, to limit its use, to receive it in a common format, or object to its use. Email hello@curveandclimb.eu; we reply within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Security

The site uses an encrypted connection. Access to order data is restricted to the people and service providers who need it to run the shop.