Privacy text for your shop
When shoppers personalize a product, the text they type and the images they upload are processed by Sigmira on your behalf. Under the GDPR you are the controller of that data, so your own shop’s privacy policy should mention it. Here is wording you can paste in and adapt. It matches what Sigmira actually does today: EU hosting in Frankfurt, uploads from abandoned designs deleted after 60 days, uploads belonging to an order deleted after 12 months.
This is a template, not legal advice. If you store design files elsewhere too (for example in your own Dropbox or through a webhook), your policy should also cover what you do with those copies.
English
When you personalise a product, any text you enter and any image you upload are processed by our personalisation provider, Sigmira (hosted in the EU, Frankfurt), solely to display your design and to produce your order. Images belonging to a design that is not ordered are deleted after 60 days. Images belonging to a completed order are kept for 12 months for reprints and support, then deleted. Your name and email address from the order are shared with Sigmira so the print file can be matched to your order.
Dutch
Wanneer je een product personaliseert, worden de tekst die je invoert en de afbeelding die je uploadt verwerkt door onze personalisatiepartner Sigmira (gehost in de EU, Frankfurt), uitsluitend om je ontwerp te tonen en je bestelling te produceren. Afbeeldingen van een niet-bestelde ontwerpsessie worden na 60 dagen verwijderd. Afbeeldingen van een geplaatste bestelling bewaren we 12 maanden voor herdrukken en support, daarna worden ze verwijderd. Je naam en e-mailadres uit de bestelling worden met Sigmira gedeeld zodat het printbestand aan je bestelling gekoppeld kan worden.
Where to put it
Add the paragraph to the privacy policy page of your shop, in the section that lists your processors or service providers. If your policy has a table of recipients, Sigmira belongs there too: purpose “product personalization and print file production”, location “EU (Frankfurt, Germany)”.
The legal basis, in short
- You stay the controller for your customers’ data; Sigmira processes it only on your instructions.
- The Data Processing Agreement is part of your Sigmira subscription and covers the details: sub-processors, security measures and retention.
- If a customer asks you to delete their data, contact support and we take care of the Sigmira side.
Was this page helpful?