Privacy Policy

The data controller for personal data processed via this website is:

DW
Brusselseweg 240, 6217 HR Maastricht, The Netherlands
KVK (Dutch Chamber of Commerce): 75924595
Contact: hello@theskythatevening.com

In this policy we refer to DW as "we", "us" or "The Sky That Evening".

We only process what is necessary to sell, produce and deliver your canvas, and to operate this website.

• Order data — name, shipping address, email, phone (if provided), order contents, price paid. Purpose: performance of the sales contract. Legal basis: Art. 6(1)(b) GDPR.
• Product configuration — the coordinates (latitude/longitude), the date and the size you chose for your canvas. Purpose: rendering and printing your unique artwork. Legal basis: Art. 6(1)(b) GDPR.
• Payment data — handled by Shopify Payments / Stripe. We only receive a confirmation and the last four digits, never full card numbers. Legal basis: Art. 6(1)(b) GDPR.
• Support correspondence — the content of any email or message you send us. Legal basis: Art. 6(1)(b) and 6(1)(f) GDPR (our legitimate interest in answering you).
• Technical / analytics data — IP address, device type, referring page, page views. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning store), and Art. 6(1)(a) consent where cookies are non-essential.

We do not knowingly collect data from anyone under 16 and we do not use your data for automated decision-making or profiling in the sense of Art. 22 GDPR.

We use strictly necessary cookies to run the cart, checkout and login. We may use anonymous analytics cookies to understand aggregate traffic. Non-essential cookies are only set with your consent, which you can withdraw at any time via the cookie banner or by clearing your browser storage.

We share the minimum data necessary with the following categories of recipients, all bound by GDPR-compliant data-processing agreements:

• Shopify International Ltd. — e-commerce platform, checkout, payment processing (Ireland / EU).
• Gelato APS — print-on-demand production and shipping partner (Denmark, with local production hubs in the EU and worldwide). Receives your name, shipping address and the print file.
• Supabase / hosting infrastructure — order database and rendered artwork storage (EU region).
• Open-Meteo & NOAA data sources — public astronomical and weather data queried by coordinate; no personal data is sent.
• Email provider — for transactional emails (order confirmation, shipping updates).
• Tax, accounting and legal advisors, and competent authorities where legally required.

We do not sell your personal data. International transfers, where they occur (e.g. print hubs outside the EU), rely on the EU Standard Contractual Clauses.

• Order and invoice records: 7 years, as required by Dutch tax law (Art. 52 AWR).
• Rendered print files: kept while your order is in production and up to 12 months after delivery for reprint / support, then deleted.
• Support correspondence: up to 24 months after the last message.
• Analytics data: aggregated and retained no longer than 14 months.

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data where legally possible (Art. 17).
• Restrict or object to processing (Art. 18 & 21).
• Data portability (Art. 20).
• Withdraw consent at any time, without affecting past processing.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or your local EU supervisory authority.

To exercise any right, email hello@theskythatevening.com. We respond within 30 days.

We use TLS encryption in transit, encrypted storage at rest, row-level access control on our database, and least-privilege access for staff. Payment card data never touches our servers — it is processed directly by PCI-DSS certified providers.

We may update this policy to reflect changes in our services or the law. Material changes will be communicated on this page with an updated "Last updated" date.