Privacy policy
This policy explains how Air Prints collects and uses personal data when you visit air-prints.com, buy a print or contact us, and the rights you have under the EU General Data Protection Regulation (GDPR) and Portuguese law.
Version 2026-10-19. Last updated 19 October 2026.
1. Who is responsible for your data
The data controller is:
Air Prints is the trading name of Jorge Alexandre Pereira, Sole trader (empresário em nome individual).
Rua da Pedreira 18, 8375-009 São Bartolomeu de Messines, Portugal
VAT number: PT236276026
Email: info@air-prints.com
Air Prints is a small business and is not required to appoint a Data Protection Officer. For any privacy question or request, write to the email address above.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR art. 6) | How long we keep it |
|---|---|---|---|
| Name, email, billing and delivery address, phone (optional), items ordered, order history | Processing, producing and delivering your order; customer service; handling returns and guarantee claims | Performance of a contract (6(1)(b)) | For the duration of the contract and until legal claims are time-barred |
| Invoice data (name, address, tax number if you provide it, amounts, VAT) | Issuing invoices; accounting and tax records; OSS VAT returns | Legal obligation (6(1)(c)) | 10 years, as required by Portuguese tax law |
| Payment status and transaction reference from PayPal (never your full card number) | Confirming payment, refunds, preventing fraud and chargebacks | Contract (6(1)(b)); legitimate interest in preventing fraud (6(1)(f)) | With the order record |
| Account details (if you create an account): email, password (encrypted), saved addresses | Letting you sign in and view past orders | Contract (6(1)(b)) | Until you delete the account; inactive accounts are deleted after 24 months |
| Messages you send us | Answering your question | Legitimate interest (6(1)(f)) or contract | Up to 24 months after the conversation ends |
| Cookie choice and consent record (random ID, date, choices; no IP address) | Respecting and proving your cookie choices | Legal obligation (6(1)(c) with art. 7(1)) | 3 years |
| Order attribution data (which page or campaign led to an order) — only if you accept statistics cookies | Understanding which pages and campaigns work | Consent (6(1)(a)) | Stored with the order; cookies expire after at most 6 months |
| Technical server logs (IP address, browser, time of request) | Security, preventing abuse, fixing errors | Legitimate interest (6(1)(f)) | For the limited period set by our hosting provider |
Providing your name, address and email is necessary to conclude the contract: without them we cannot deliver your order. Everything else is optional.
We do not sell your data, we do not use it for profiling or automated decision-making, and we do not send marketing emails.
3. Who receives your data
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — processes your payment as an independent controller under its own privacy statement.
- Hostinger International Ltd. — hosts this website and its database (processor under a data processing agreement).
- Delivery carrier — receives your name, delivery address and, where needed for delivery, your phone number.
- Print laboratory in Portugal — receives the print file and the order reference only, not your contact details.
- Autoridade Tributária e Aduaneira (Portuguese tax authority) — invoice data, as required by law; and customs authorities for deliveries outside the EU.
- Our certified accountant — invoice and accounting records.
4. Transfers outside the European Economic Area
When you order delivery to the United States or Canada, your delivery details are necessarily passed to carriers and customs authorities in that country to perform the contract (GDPR art. 49(1)(b)). Canada benefits from an EU adequacy decision. PayPal may transfer data within its group under its Binding Corporate Rules.
5. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased, where we no longer need it or you withdraw consent (we must keep invoice records for 10 years by law);
- restrict processing in certain circumstances;
- object to processing based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting earlier processing — for cookies, use
Write to the email address in section 1. We will reply within one month. You also have the right to complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the authority in your country of residence.
6. Security
The site is served only over encrypted HTTPS. Payments are handled on PayPal’s secure systems; we never see or store card numbers. Access to order data is restricted to the owner and protected by strong, unique passwords.
7. Children
The shop is not directed at children under 16, and we do not knowingly collect their data.
8. Cookies
See our Cookie policy for the cookies we use and how to change your choices.
9. Changes
If we change this policy we will publish the new version here with a new date. If a change affects how we use cookies, we will ask for your cookie choice again.