Privacy

Who is responsible

SIA RKS-Int, Garkalnes iela 4, Garkalne, Garkalnes pag., Ropažu nov., LV-2137, is the controller for the data described below. Reach us at support@tullunprint.com.

There are two different relationships here and they matter, because they decide who you ask for what:

• Merchants — the shops that use us to print. We are the controller of their account data.
• Buyers — the people who order from those shops. For their details we are the processor, acting on the shop's instructions. The shop is the controller, and a buyer wanting their data removed should ask the shop they bought from. We act on what the shop tells us.

What we hold, and why

If you have a merchant account

• Your name, email and password, to let you in — because we cannot run the account otherwise (performance of a contract).
• If you sign up or sign in with Google: your name, email address and the identifier Google gives your account, so that the same Google account lets you in next time. Never your Google password, your contacts or anything else in your Google account.
• Company name, address, registration and VAT numbers, because an invoice is not lawful without them (legal obligation).
• Your designs, products and templates, because they are the work you came here to do.
• Invoices, payments and wallet entries, kept as accounting records (legal obligation).
• Any notices we have sent you about your account.

If you bought from a shop we print for

• Your name, delivery address, and what was ordered, so the parcel can be made and sent.
• Any artwork or text you personalised the item with.

We hold these on the shop's behalf. We do not market to buyers, and we do not use their details for anything but making and delivering the order.

Cookies

We keep only what the site needs to work, all of it strictly necessary: a cookie that keeps you signed in, one that protects forms from being submitted from somewhere else, and your cookie choice. If you arrived through a referral link, who sent you is kept only if you choose Accept, and otherwise for that visit alone. www.tullunprint.com asks before anything that would measure your visit. The full list, with how long each is kept, is on the Cookies page.

Only on www.tullunprint.com and app.tullunprint.com, and only if you press Accept, we use Google Analytics and Microsoft Clarity to count visits, to see which of our ads bring people to us and where on a page people click. They receive the pages you visit and your browser's details, under their own policies. Otherwise the fonts and scripts these pages use are served from our own domain.

Who else sees it

Only the companies that have to, to get an order made and paid for:

• Carriers, to deliver a parcel — they get the delivery address.
• Our payment provider, to take a payment. Card details go to them and never to us; we never see or store a card number.
• The shop you bought from, where you bought through one — they were always the seller.
• Our hosting provider, on whose servers the system runs.
• A production partner in the EU, which makes some of our case types — for those orders it gets the name, delivery address and phone number the parcel needs.
• Google, for AI pictures — when you ask for one, Google receives the words you write and any picture you choose to send with them.
• Google, only if you choose to sign in with it — Google then knows you signed in to TullunPrint.
• Google Ireland Limited, only if you accept measuring on www.tullunprint.com or app.tullunprint.com — for Google Analytics and Google Ads.
• Microsoft Ireland Operations Limited, only if you accept measuring on www.tullunprint.com or app.tullunprint.com — for Microsoft Clarity, which sees clicks and scrolling but, in the app, none of the text on the page.

How long we keep it

• Accounting records — invoices and the details on them — for as long as tax law requires them kept.
• Buyer details on an order — anonymised 12 months after the parcel ships (30 days for orders from Amazon), or 12 months after the order last changed if it never shipped, so what remains is the order rather than the person.
• Shipping labels — deleted on the same schedule as the order's buyer details. Customs invoices are kept for as long as customs and tax law require.
• Server logs — 14 days.
• Backups — daily copies for 30 days and monthly copies for 12 months, then deleted, so details anonymised in the system leave the backups as they age out.
• Merchant accounts and artwork — while the account is open, and removed when it is closed, other than what the law requires kept.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, object to what we do with it, or take it elsewhere. We answer within one month.

Merchants do not have to ask. Your Your data page hands over a complete copy immediately, and starts a deletion request the same way.

Some data cannot be deleted on request: an issued invoice is kept because the law requires it (Article 17(3)(b) of the GDPR). When you ask, we tell you exactly what was removed and what was kept, and under what obligation — before you decide as well as after.

Complaining

Tell us first — most things are quicker to fix than to escalate. You also have the right to complain to a supervisory authority. Ours is the Data State Inspectorate of Latvia (Datu valsts inspekcija), and you may instead complain to the authority where you live.