Privacy notice

Who we are

The company responsible for your data is Magnolia OÜ: registry code 16040295, Merimetsa tn 53, 80028 Pärnu, info@pildiprint.ee, 53853054.

What we collect and why

• Photos – only to print them. We never publish them or use them for ads, AI training or face recognition.
• Photo files can also contain the place where the photo was taken and camera details – these are deleted together with the photo.
• “Send files” – your name, e-mail, message and the files you send us, so we can make your custom order.
• Name and e-mail – for the order, the invoice and e-mails about your order; your e-mail also for aggregated sales statistics (e.g. how many customers ordered again).
• Phone and parcel locker – for delivery: the carrier texts the code to your phone.
• Google sign-in – your name, e-mail and Google account ID, so you can use your account and discount.
• IP address – to protect the shop from abuse.

The legal basis is our contract with you and, for invoices, the Accounting Act. For IP addresses and logs, it's our legitimate interest in keeping the shop safe and working – you can object to this.

We need your name, e-mail and, for a parcel locker, your phone to fulfil the order.

How long we keep it

• Ordered photos – until the order ships or is collected. Only the file name stays with the order, for as long as the invoice.
• Photos you don't order – about 3 days after your last upload.
• Unpaid order – cancelled after about 3 days, photos deleted at once; name, contact details and file names after 2 months.
• Phone and parcel locker – 3 months after delivery. Log of sent e-mails – 3 months.
• Invoice (name, e-mail, items, amount) – 7 years after the end of the financial year, because the Accounting Act requires us to keep them.
• Google account – until you ask us to delete it.
• Your e-mails to us and any photos in them – until the matter is resolved.
• Files and messages sent via “Send files” – 30 days, unless we delete them sooner.
• Files we share with you by link – until the link expires or is closed, plus 7 days.
• IP address and technical server logs – up to 7 days.

Who else sees it

• Cloudflare – website, image processing and e-mail; we store photos and files in the EU.
• Neon – database in Frankfurt.
• The carrier (Omniva, Smartposti or DPD) – gets your name, phone and parcel locker to deliver the parcel.
• Montonio Finance OÜ (Estonia) – registering and tracking parcels (processor): we send your name, phone, e-mail, parcel locker and order number.
• Our e-mail provider – stores the e-mails you send us.
• Google – only if you sign in with Google.
• Montonio Finance UAB (Lithuania) – payments. Montonio is responsible for payment data itself; we send it your name, e-mail, phone, order number and amount. We never see your card details. Montonio's privacy policy

Cloudflare, Neon and Google are US companies. When data leaves the EU, it's protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses – ask us for a copy.

Cookies and statistics

We only use cookies the shop can't work without: your photos and cart session (30 days) and Google sign-in (30 days, plus one for 10 minutes while you sign in); only if you ask, also the “don't count” cookie (see below).

If you ask it to, your browser remembers your checkout details (name, e-mail, phone, parcel locker) for 90 days. It also remembers a few settings and unfinished uploads. All of this stays on your device – clear it in your browser settings.

Opening a password-protected file link sets an access cookie for 4 hours.

We keep only anonymous statistics: how many times a day pages were opened, checkout was reached and photos were uploaded – by language, device type (phone, tablet, computer) and type of source (direct, search, social media, e-mail, school system, other). We derive these types from the browser's ordinary request (opening a page, sending a photo); checkout is only counted when there is something in the cart. For statistics we set no cookies and store nothing on your device, and we store no IP address, browser details or anything else that could identify you – only daily totals are kept. The legal basis is our legitimate interest in understanding how the shop is used. No tracking or ads – so no cookie pop-up either.

You can object to the statistics: open the link (questions? write to us) – your browser then keeps the cookie rf_nostats (400 days) and visits from this browser are no longer counted (until the cookie is deleted). We only set this cookie when you ask: Don't count my visits

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and get it as a file to take elsewhere. Write to info@pildiprint.ee – we reply within a month.

If you think we've got something wrong, you can complain to the Data Protection Inspectorate (aki.ee).