Privacy

Your little lines stay yours.

Draft — business details pending confirmation.

Who is responsible

The controller of your personal data is [Full registered company name] s.r.o., [Registered office], company ID [IČO], registered at [Register court, section, file]. You can reach the studio at hello@onceonpaper.com.

Because the controller is established in the European Union, the EU General Data Protection Regulation (GDPR) applies to its processing. Where Swiss data protection law (the revised FADP) also applies, we respect it too.

What we collect

Your name and email address, so we can reply and prepare a quote.
Your delivery country, quantity, optional desired date, gift note and any notes you add.
The photo or scan you upload of the artwork, and its file details (name, type, size).
Required product/timing/review acknowledgements and a separate optional permission to share a photo of the finished keepsake. Finished-photo sharing is off by default, does not affect the order, never authorises publication of your original upload, and can be withdrawn by contacting us. The current unavailable-checkout preview validates your selected file but does not persist a new order or these choices.
Your commission request reference and, once an order exists, the records needed to make and deliver it, including your delivery address and payment references.
Messages you send through the contact form.
Partner enquiries: organisation and partner type, contact name, work email and country; optional website, approximate quantity, project and preferred date; your message.
Technical data needed to run the website, such as standard hosting logs (see below).

Why we use it, and on what legal basis

To review, quote, make and deliver your commission and to answer you — performance of a contract or steps you ask for before one (GDPR Art. 6(1)(b)).
To keep the records the law requires of us, such as bookkeeping — legal obligations (Art. 6(1)(c)).
To run and secure the website and follow up on enquiries — our legitimate interests, balanced against yours (Art. 6(1)(f)).
Anything optional — for example showing your finished piece in a portfolio or on social media, or marketing emails — only with your separate, specific consent (Art. 6(1)(a)). We never publish your artwork or upload without it.

Children's artwork and other people's data

Drawings and notes can identify the child who made them or other people. Please share only what the piece needs — you don't need to tell us the child's name — and make sure you have the permission of everyone involved, including parental or guardian authority for a child's work.

How uploads are kept

Uploads are stored in private storage that only signed-in studio staff can open. They are never published or shown publicly without your separate, explicit permission.

Who processes data for us

From how this website is built today, the following service providers process data on our behalf:

Website hosting and the database and private file storage behind it, operated through our website platform's cloud service. The hosting and storage locations, and any cross-border transfer safeguards, are listed in our launch checklist for confirmation before launch.
Typeface files are loaded from Google Fonts when pages display; your browser connects to Google's servers to fetch them. We are reviewing whether to host these files ourselves before launch.

We do not sell your data. Any further providers (for example a payment or email service) will be named here, with their role, country and transfer safeguards, before they are used. The exact durations for which each category of data is kept are being finalised in the same checklist; until then we keep data only as long as needed for the purposes above and any legal record-keeping.

Cookies

This website's code sets no analytics, advertising or other non-essential cookies. Technically necessary browser storage is used to keep studio staff signed in to the admin area. Hosting providers may keep standard server logs; we are auditing these, and the Google Fonts connection above, before launch and will update this notice if anything changes.

Your rights

Where applicable, you can ask to access, correct or delete your data, restrict or object to its processing, receive it in a portable format, and withdraw any consent at any time without affecting what happened before. Contact us and choose “Access or delete my data”.

You can also complain to the Czech Office for Personal Data Protection (ÚOOÚ) or, where Swiss law applies, the Swiss Federal Data Protection and Information Commissioner (FDPIC).