Privacy Policy
Last updated: June 2026
Data controller
Art by Barkwald, Glostrupvej 13D, 4500 Nykøbing Sjælland, Denmark. CVR 37883026.
Contact: hello@herbariumprints.com
What we collect and why
| Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|
| Name, delivery address, email | Processing and fulfilling your order | Art. 6(1)(b) — contract |
| Payment details | Processing payment via Stripe | Art. 6(1)(b) — contract |
| IP address, browser data | Security and fraud prevention | Art. 6(1)(f) — legitimate interest |
| Contact form (name, email, message) | Responding to enquiries | Art. 6(1)(f) — legitimate interest |
| GA4 analytics data | Understanding site traffic | Art. 6(1)(a) — consent |
| Pinterest analytics data | Marketing analytics | Art. 6(1)(a) — consent |
Third-party processors
We share data with the following processors under data processing agreements:
Printful Inc. — produces and ships your order. May process data in the EU (Latvia) or US depending on your location. Covered by EU-US Data Privacy Framework.
Stripe Inc. — processes payments. Data processed in the US under EU-US Data Privacy Framework.
Google LLC — analytics (GA4), only with your consent. EU-US Data Privacy Framework.
Pinterest Inc. — marketing analytics, only with your consent. EU-US Data Privacy Framework.
Cloudflare Inc. — CDN and security. Processes data in the US under EU-US Data Privacy Framework.
We never sell your data.
Pinterest API
Herbarium Prints Social Publisher uses the official Pinterest API v5 to create and schedule Pins on Pinterest accounts owned by Art by Barkwald. This application is not endorsed by, affiliated with, or sponsored by Pinterest, Inc. in any way.
Pinterest-derived data accessed through the API is used solely for the purpose of publishing content on our own Pinterest accounts. We do not resell, redistribute, or share Pinterest content or Pinterest-derived data with any third parties under any circumstances.
If access to the Pinterest API is disconnected or revoked for any reason, all Pinterest-derived data and access tokens stored by the application are deleted immediately and permanently. No Pinterest data is retained after disconnection.
International transfers
Some of our processors are based outside the EU/EEA. Transfers to the US are covered by the EU-US Data Privacy Framework (adequacy decision, July 2023). You can verify certification status at dataprivacyframework.gov.
Retention
Order data: 5 years (Danish Bookkeeping Act, legal obligation — art. 6(1)(c))
Contact form data: 12 months
Analytics data: as per Google/Pinterest retention settings (max 14 months for GA4 as configured)
Your rights (GDPR art. 15–22)
You have the right to access, correction, erasure, restriction, portability and objection. Contact hello@herbariumprints.com. Response within 30 days.
You can lodge a complaint with the Danish Data Protection Agency: datatilsynet.dk — Carlsberg Boulevard 8, 1799 Copenhagen V.
Security
All data is transmitted over HTTPS/SSL. Stripe is PCI DSS Level 1 certified. Passwords are not stored.