Legal
Privacy
Controller
KCraft Studio LTD (PK Gallery)
Neofytou Nikolaidi & Theod. Kolokotroni
Onisiforou Center, 2nd floor
8011 Paphos, Agios Theodoros
Cyprus
No tracking cookies
We do not use cookies for analytics or advertising, and we use no social media services. Your cart is stored only in your browser’s local storage and is not sent to us until you proceed to checkout. Fonts are served from our own server.
Orders
To process your order we use your name, shipping address (not for collection), email address, a phone number for questions about delivery or collection, and the works and amounts ordered (Art. 6(1)(b) GDPR). We only pass your shipping address to the carrier we use for delivery. Paid orders are retained for as long as tax and commercial law requires (Art. 6(1)(c) GDPR). Unfinished checkouts are deleted after 30 days. To stop anyone from blocking originals without buying, we store a non-reversible hash of your IP address while a checkout is open and delete it as soon as the checkout is completed or has expired (Art. 6(1)(f) GDPR).
Payment via Stripe
Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details directly with Stripe; we never receive them. Stripe receives the data required for the payment. Stripe’s privacy policy applies (stripe.com/privacy).
AI assistance in shop administration
To manage the shop we use AI services from Anthropic PBC, USA. They process photos of the works to suggest shop texts, photos of postal receipts to read the tracking number (these may show the recipient’s name and address), and order contents without names or addresses to draft emails to you. We do not store receipt photos. Anthropic processes the data as a processor under a data processing agreement with EU standard contractual clauses (Art. 6(1)(b) and (f), Art. 28 and 46 GDPR).
Emails
After your purchase we send you an order confirmation and a shipping notification. Stripe also sends you the payment receipt and, where enabled, the invoice. We do not send newsletters.
Hosting and server logs
The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you visit, technically necessary data (IP address, time, page requested, browser type) is processed to deliver the website securely (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object. You may also lodge a complaint with a supervisory authority, for example the Commissioner for Personal Data Protection of the Republic of Cyprus.