Privacy policy

This privacy policy explains what personal data PuzzleMyPhoto (puzzlemyphoto.com, “we”, “us”) collects when you visit our website or place an order, why we collect it, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

Last updated: October 2026

1. Who is responsible for your data

PuzzleMyPhoto is the controller of your personal data. If you have any questions about this policy or about your data, contact us at puzzlemyphoto@gmail.com.

2. What data we collect

  • Order details: your name, email address, phone number (if you provide it), shipping and billing address, the products you order and your order notes.
  • Photos you upload: the images you send us to make your puzzle.
  • Payment information: payments are handled by our payment providers. We only receive limited information, such as the payment status – never your full card details.
  • Messages: anything you send us by email or through the contact form.
  • Newsletter: your email address, if you sign up.
  • Technical data: IP address, browser and device type, pages visited and similar information collected through cookies.

3. Why we use your data

  • To make and deliver your order and keep you updated about it – necessary to perform our contract with you (GDPR Art. 6(1)(b)).
  • To answer your questions and handle complaints, returns and refunds (Art. 6(1)(b) and (f)).
  • To meet legal obligations, such as keeping accounting and tax records (Art. 6(1)(c)).
  • To keep our store secure, prevent fraud and improve our website – our legitimate interest (Art. 6(1)(f)).
  • To send you our newsletter and offers – only with your consent, which you can withdraw at any time (Art. 6(1)(a)).

4. Your photos

We use the photos you upload only to produce your order. We don't publish them or use them in advertising without your explicit permission, and only the people working on your order can see them. We keep uploaded photos only as long as needed to produce and deliver your order and to handle a possible reprint or complaint, and then delete them.

5. Who we share data with

We never sell your personal data. We share it only with service providers that help us run the store, and only as much as they need:

  • our e-commerce platform (Shopify), which hosts the store and processes orders;
  • payment providers, to process your payment;
  • courier and postal services, to deliver your order;
  • email and newsletter services;
  • analytics and advertising services (such as Google and Meta), only if you agree to the related cookies;
  • public authorities, where required by law.

6. Transfers outside the EU

Some of our service providers may process data outside the European Economic Area. In those cases the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

7. How long we keep data

  • Order and invoice data – as long as required by accounting and tax laws.
  • Messages – as long as needed to resolve your question or complaint.
  • Newsletter data – until you unsubscribe.
  • Uploaded photos – see section 4.

8. Cookies

Our website uses cookies – small files stored in your browser. Strictly necessary cookies make the store work (for example the shopping cart and checkout). Analytics and marketing cookies help us understand how the website is used and show relevant ads – we only use them if you agree. You can change your choice at any time in the cookie banner (where shown) or in your browser settings. Blocking cookies may affect how the website works.

9. Your rights

You have the right to:

  • access the personal data we hold about you;
  • ask us to correct inaccurate data;
  • ask us to delete your data;
  • restrict or object to how we use it;
  • receive your data in a portable format;
  • withdraw your consent at any time (for example, unsubscribe from the newsletter).

To use any of these rights, email us at puzzlemyphoto@gmail.com. We'll reply within one month. If you believe we've handled your data unlawfully, you can also lodge a complaint with a data protection authority – in Lithuania, the State Data Protection Inspectorate (vdai.lrv.lt), or the authority in your own country.

10. Security

We take reasonable technical and organisational measures to protect your data. The website uses an encrypted (HTTPS) connection, and payments are processed by certified payment providers.

11. Children

Our store is not intended for children under 16, and we don't knowingly collect their personal data.

12. Changes to this policy

We may update this policy from time to time. The latest version is always published on this page.