Privacy Policy

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how PrintHappy (“PrintHappy,” “we,” “us,” or “our”) collects, uses, stores, shares, and otherwise processes personal data when you visit printhappy.co, place an order, upload photographs or other content, communicate with us, or otherwise use our services.

We process personal data in accordance with applicable data-protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Data Controller

The controller responsible for the processing of your personal data is:

JDG Kobernyk Oleksandra
NIP: 5833484007
Przemyska 31/26
80-180 Gdańsk
Poland

Trading as PrintHappy

Email: support@printhappy.co

You may contact us at the above email address regarding this Privacy Policy or the processing of your personal data.

2. Personal Data We Collect

Depending on how you interact with PrintHappy, we may process the following categories of personal data.

a. Contact and order information

When you place an order or contact us, we may collect information such as:

  • Your name.

  • Email address.

  • Telephone number, where provided.

  • Billing and shipping addresses.

  • Order number and order details.

  • Products, sizes, options, and personalization selections.

  • Communications relating to your order or customer-support requests.

b. Customer-provided photographs and personalization content

When you create or order a personalized portrait, we process the photographs and other content that you submit to us.

This may include:

  • Uploaded photographs.

  • Images of you or other identifiable people.

  • Text, names, dates, instructions, and other personalization information.

  • Information and instructions required to generate your personalized portrait.

  • The resulting generated portrait or artwork.

Photographs containing identifiable people constitute personal data. You should only upload photographs that you are legally entitled to provide to us and for which you have obtained any permissions required by applicable law.

c. Payment information

Payments are processed through third-party payment service providers.

We may receive information relating to your payment, such as payment status, transaction identifiers, payment method type, and limited payment information necessary to administer your order.

We do not receive or store complete payment-card numbers where these are processed directly by our payment service providers.

d. Website and technical information

When you visit our website, certain technical information may be collected automatically, including:

  • IP address.

  • Browser type and version.

  • Device type.

  • Operating system.

  • Website activity and interactions.

  • Referring pages or websites.

  • Approximate location derived from technical information such as an IP address.

  • Cookie and similar technology identifiers.

The exact information collected depends on the technologies and services used when you visit our website and your cookie choices.

e. Communications

If you contact us, we may process your name, email address, order information, the contents of your message, attachments, and any other information you choose to provide.

3. How and Why We Use Personal Data

We process personal data only where we have an appropriate legal basis under applicable data-protection law.

Processing and fulfilling your order

We process your contact information, order details, photographs, personalization instructions, generated artwork, and other information necessary to create, produce, deliver, and administer your personalized product.

The legal basis for this processing is generally Article 6(1)(b) GDPR — processing necessary to perform a contract with you or to take steps at your request before entering into a contract.

Generating personalized portraits

Where the product you select involves AI-generated artwork, the photographs and instructions you submit are processed using artificial-intelligence image-generation technology to create your requested personalized portrait.

For this purpose, relevant photographs, prompts, instructions, and other information necessary for generation are transmitted to and processed by our AI technology provider, OpenAI.

This processing is carried out for the purpose of providing the personalized product or service you have requested and is generally based on Article 6(1)(b) GDPR.

Processing payments

We and our payment service providers process information necessary to accept, verify, administer, refund, and otherwise manage payments.

Depending on the processing concerned, the legal basis is Article 6(1)(b) GDPR, where processing is necessary for the contract, and Article 6(1)(c) GDPR where processing is necessary to comply with legal obligations.

Shipping and order delivery

We process and disclose relevant contact, shipping, and order information to delivery and logistics providers where necessary to deliver your order.

The legal basis is Article 6(1)(b) GDPR.

Customer service and communications

We process information necessary to answer questions, resolve problems, administer complaints, process requests, and communicate with you concerning your order.

Depending on the circumstances, this processing is based on Article 6(1)(b) GDPR or our legitimate interests under Article 6(1)(f) GDPR in operating our business and providing effective customer support.

Legal, accounting, and tax obligations

We may retain and process certain transaction, invoice, accounting, and order information where necessary to comply with applicable tax, accounting, consumer-protection, and other legal obligations.

The legal basis is Article 6(1)(c) GDPR.

Fraud prevention, security, and legal claims

We may process relevant personal data where reasonably necessary to prevent or investigate fraud, misuse, security incidents, or unlawful activity; protect our website and business; enforce our rights; or establish, exercise, or defend legal claims.

The legal basis is generally our legitimate interests under Article 6(1)(f) GDPR in protecting our customers, website, business, and legal rights.

Marketing

Where required by applicable law, we send electronic marketing communications only where you have provided the required consent.

Where processing is based on consent, the legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. AI-Generated Portraits and OpenAI

PrintHappy uses artificial-intelligence image-generation technology provided by OpenAI to generate certain personalized portraits.

When you request an AI-generated portrait, the photograph you submit and information or instructions necessary to generate the portrait are transmitted to OpenAI and processed through its services for the purpose of creating the requested artwork.

OpenAI acts as a technology service provider in connection with this processing.

We do not use customer photographs or generated portraits to train our own artificial-intelligence models.

According to OpenAI's policies applicable to its business and API services, API inputs and outputs are not used to train OpenAI's models by default unless the API customer has expressly opted into data sharing.

OpenAI may retain API inputs and outputs for a limited period for purposes such as service operation and abuse monitoring, depending on the applicable service, endpoint, account configuration, and retention settings. This retention is separate from PrintHappy's own seven-day image-retention period described below.

5. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected and to meet applicable legal obligations.

Uploaded photographs and generated portraits

Photographs uploaded for portrait generation and the associated generated portrait images stored by PrintHappy are retained for 7 days.

After this period, they are deleted from our active systems, subject to any exceptional retention that may be required by law or necessary for the establishment, exercise, or defence of legal claims.

The seven-day period applies to copies retained by PrintHappy and does not necessarily determine the separate technical retention periods applied by third-party service providers such as OpenAI.

Order, transaction, tax, and accounting records

Certain information relating to purchases, invoices, payments, and transactions may be retained for longer periods where required by applicable tax, accounting, consumer-protection, or other laws.

Customer-support communications

Customer-support correspondence is retained for as long as reasonably necessary to deal with the request, maintain appropriate business records, resolve disputes, or establish, exercise, or defend legal claims.

Marketing information

Where we process information for marketing on the basis of consent, we may retain relevant information until you withdraw your consent or unsubscribe, subject to retaining limited information where necessary to document your preferences and demonstrate compliance with applicable law.

Technical and security information

Technical, security, and website information is retained for periods appropriate to its purpose, including website operation, security, fraud prevention, analytics, and compliance, subject to applicable law.

Where a specific statutory retention period applies, we retain the relevant information for the period required by law.

6. Who We Share Personal Data With

We do not sell your personal data.

We may disclose personal data to service providers and other recipients where necessary to operate PrintHappy and provide our services, including:

  • AI technology providers, including OpenAI, for generating personalized portraits.

  • E-commerce and website platform providers, used to operate our online store and process orders.

  • Cloud hosting, infrastructure, and security providers, used to host, secure, and operate our services.

  • Payment service providers, used to process payments and refunds.

  • Printing, production, and fulfilment providers, where necessary to manufacture or fulfil an order.

  • Delivery and logistics providers, where necessary to deliver orders.

  • Analytics, cookie, advertising, and marketing providers, where applicable and subject to your cookie choices and any consent required by law.

  • Professional advisers, such as accountants, lawyers, insurers, or other advisers where reasonably necessary.

  • Public authorities, courts, regulators, or law-enforcement authorities, where disclosure is required by applicable law or legally binding process.

Service providers that process personal data on our behalf are permitted to process it only for the relevant service purposes and subject to applicable data-protection requirements.

7. International Transfers

Some of the service providers we use may process personal data in countries outside Poland or the European Economic Area (“EEA”), including countries whose data-protection laws may differ from those applicable within the EEA.

Where personal data is transferred outside the EEA, we take steps required by applicable data-protection law to ensure an appropriate level of protection.

Depending on the recipient and destination, such transfers may rely on an adequacy decision adopted by the European Commission or appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, together with additional safeguards where required.

You may contact us at support@printhappy.co for further information about the safeguards applicable to international transfers of your personal data.

8. Cookies and Similar Technologies

Our website uses cookies and similar technologies for purposes such as operating the website, remembering preferences, maintaining security, understanding website usage, and, where applicable, analytics and advertising.

Some cookies are necessary for the website to function. Other cookies, including certain analytics, advertising, or personalization cookies, are used only where permitted by applicable law and, where required, after you have provided consent.

You can manage your choices through the cookie consent controls available on our website. You may also be able to control cookies through your browser settings.

Withdrawing or refusing consent to non-essential cookies does not affect the lawfulness of processing that occurred before consent was withdrawn.

9. Your Data-Protection Rights

Subject to the conditions and limitations provided by applicable law, you may have the right to:

  • Access the personal data we hold about you.

  • Rectify inaccurate or incomplete personal data.

  • Request erasure of your personal data.

  • Restrict processing of your personal data.

  • Object to processing based on legitimate interests.

  • Receive certain personal data in a portable format and have it transmitted to another controller where applicable.

  • Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

  • Lodge a complaint with a competent data-protection supervisory authority.

Where processing is based on our legitimate interests, you have the right to object to that processing on grounds relating to your particular situation, subject to the conditions established by applicable law.

Where personal data is processed for direct marketing, you have the right to object to such processing at any time.

To exercise your rights, contact us at:

support@printhappy.co

We may need to request information reasonably necessary to verify your identity before acting on certain requests.

We will respond within the time limits required by applicable data-protection law.

As a business established in Poland, the relevant supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO). You also have the right, where applicable, to lodge a complaint with another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

10. Whether You Must Provide Personal Data

Certain personal data is necessary for us to enter into and perform a contract with you.

For example, we need appropriate contact, delivery, order, and payment-related information to process and fulfil an order. For personalized portrait products, we also need the photograph and personalization information required to create the requested product.

If you do not provide information that is necessary to perform the contract, we may be unable to process or fulfil your order.

Other information is optional unless otherwise indicated.

11. Photographs of Other People

A photograph uploaded by a customer may contain personal data relating to another identifiable person.

If you submit a photograph depicting another person, you are responsible for ensuring that you are entitled to provide the photograph to us and that any permission or other legal requirement applicable to your use and submission of the photograph has been satisfied.

We process such photographs only for the purposes described in this Privacy Policy, including creating and fulfilling the requested personalized portrait.

12. Automated Processing

We use automated and AI-based technology as part of the process for creating certain personalized portraits.

The AI generation process creates artwork based on the photograph and instructions submitted for the requested product.

We do not use this AI portrait-generation process to make decisions about customers that produce legal effects or similarly significant effects on them.

13. Data Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorized or unlawful access, disclosure, alteration, loss, destruction, or misuse.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.

Access to personal data is limited as appropriate to persons and service providers who require it for legitimate business purposes.

14. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

We are not responsible for the privacy practices of independent third-party websites or services. We encourage you to review their privacy information before providing personal data to them.

15. Children's Privacy

Our products and services are not specifically directed at children.

Where a minor uses our services, the involvement or authorization of a parent or legal guardian may be required in accordance with applicable law and our Terms & Conditions.

If we become aware that personal data has been collected or processed in circumstances where parental authorization or another legal requirement was required but not satisfied, we will take appropriate steps in accordance with applicable law.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our services, technology, service providers, or legal requirements.

The current version will be published on our website together with its “Last updated” date.

Where required by law, we will provide additional notice of material changes.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data-protection rights, or have concerns about how your personal data is processed, contact:

PrintHappy
Operated by JDG Kobernyk Oleksandra
NIP: 5833484007
Przemyska 31/26
80-180 Gdańsk
Poland

Email: support@printhappy.co