Privacy Policy

Updated: 10 July 2025

1. Contact Information

2. Processing and Purpose of Personal Data

We always process your personal data lawfully, fairly, and transparently. We collect and process information only when we have a valid legal basis for doing so, for example to fulfil a contract or comply with statutory obligations.

3. Purposes of Personal Data Processing

We collect and process personal data for the following purposes:

• Managing customer relationships and processing orders
• Delivering products and services
• Customer service and communication
• Marketing and advertising targeting (with consent only)
• Service development and quality control

The information collected may include:

• Name and contact details
• Payment information and billing address
• Order information and customer feedback
• Information related to online behaviour

4. Customer-Uploaded Images (Custom Products)

We process customer-uploaded images only for producing custom products, such as paint by numbers or diamond painting kits made from the customer’s photo, and for customer service. Images are not used for any other purpose without the customer’s separate consent.

Images are deleted from our systems and from third-party services (Cloudflare) no later than 30 days after the order. Invecom Oy is not responsible for the data security of third-party services to the extent that such security is under the responsibility of those third parties.

5. Security and Disclosure of Information

Information is stored and processed on carefully protected servers. Information may be disclosed to the following third parties:

• Payment service providers (e.g. Shopify Payments, Paytrail, PayPal)
• Logistics partners (e.g. Matkahuolto, Posti, GLS, DHL)
• Image processing services (e.g. Cloudlift)

Personal data will not be transferred outside the EU or EEA without appropriate safeguards.

6. Data Retention

Personal data is retained only for as long as necessary for the purposes defined in this privacy policy or for the period required by law. At the customer’s request, the data may be deleted within 30 days.

7. Rights of the Data Subject

The data subject has the right to:

• Access their own information
• Request correction or deletion of data
• Object to or restrict the processing of data
• Transfer data to another service provider
• Withdraw consent at any time

Requests should be sent by email to info@paintbynumbers.eu.

8. Cookies

We use cookies to enable website functionality and improve the user experience. The use of cookies is described in more detail in a separate cookie policy.