Privacy Policy

Who We Are

Tina Marincic, trading as NackaSnaps Photography, is the data controller for your personal information collected through this website. We are based in Nacka, Sweden.

What Data We Collect

We collect and process the following categories of personal data:

• Contact information — email address (if you provide it during checkout)
• Purchase data — items purchased, transaction IDs, and payment timestamps
• Usage data — IP address, browser type, device information, and pages visited
• Support messages — any communications sent to us

Why We Collect It

We process your data for the following purposes and legal bases:

• Contract performance — to process your purchase and deliver your photo downloads
• Legitimate interests — to improve our service, prevent fraud, and ensure website security
• Legal obligation — to comply with accounting and tax requirements
• Consent — where explicitly requested (e.g., marketing emails, if applicable)

Who We Share Data With

We share your data only with trusted service providers necessary to operate our business:

• Paddle — our Merchant of Record for payment processing, subscription management, tax compliance, and invoicing. Paddle acts as an independent data controller for payment-related data.
• Hosting providers — to store and serve website content and photos
• Analytics providers — to understand site usage and improve the service
• Professional advisers — legal and accounting services where required

Data Retention

We retain your personal data only as long as necessary for the purposes outlined above. Purchase records are retained for 7 years to comply with Swedish accounting obligations. Usage and analytics data are retained for up to 2 years. When data is no longer needed, it is securely deleted or anonymised.

Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your data where appropriate
• Restriction — limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Complaint — lodge a complaint with the Swedish Authority for Privacy Protection (IMY)

To exercise any of these rights, contact us at the email provided on our website. We will respond within one month.

Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), access controls, and regular security reviews. However, no online service can guarantee absolute security.

Cookies

We use essential cookies to ensure the website functions correctly (e.g., cart state, language preference). We may also use analytics cookies to understand site usage. You can manage your cookie preferences through your browser settings.

International Transfers

Some of our service providers may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, to protect your data in accordance with GDPR.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page.