Privacy policy

Last updated: September 11, 2026

This Privacy Policy explains how VisionFantasyArt UF collects, uses, shares, and protects personal data when you visit visionfantasyart.com, contact us, or make a purchase from our online store.

We only process personal data when there is a specific purpose and a valid legal basis for doing so. We do not sell your personal data.

1. Data Controllers and Contact Information

VisionFantasyArt UF is a student-run UF company operated by Lauren Wali and Emil Jahdadic. Since a UF company is not a separate legal entity, Lauren Wali and Emil Jahdadic are the data controllers for the processing activities determined by VisionFantasyArt UF.

Business: VisionFantasyArt UF
Company ID: 1648561
Data controllers: Lauren Wali and Emil Jahdadic
Postal address: Gamla Uppsalagatan 9B, 753 34 Uppsala, Sweden
Email: visionfantasyart@gmail.com
Website: https://visionfantasyart.com

You may use the email address above if you have questions about this policy or wish to exercise your rights.

2. Personal Data We Process

The personal data we process depends on how you use our online store. It may include:

  • Contact and delivery information: your name, email address, telephone number, billing address, and delivery address.

  • Order information: products ordered, price, currency, discounts, order number, delivery status, returns, complaints, and purchase history.

  • Payment information: your chosen payment method, payment status, transaction reference, and limited card information, such as the card type and final digits. Complete card details are provided directly to the payment service provider and are normally not available to us.

  • Account information: information required to create and use a customer account, if you choose to create one.

  • Communications: the content of messages you send to us, including questions, complaints, or return requests.

  • Technical information: your IP address, device type, browser, operating system, cookie identifiers, and information about how the website is used.

  • Consent and preferences: for example, your choices in the cookie banner and, if the option is available, whether you have consented to receive marketing communications.

  • Social media information: information you make available when contacting or interacting with us through platforms such as TikTok or Instagram.

Please do not send us sensitive personal data, such as information about your health, religion, or political opinions, unless it is necessary for us to handle your request.

3. How We Obtain Personal Data

We obtain personal data:

  • directly from you when you place an order, create an account, or contact us;

  • automatically from your device when you use the website, through necessary cookies and, where consent is required, other cookies after you have provided consent;

  • from Shopify, payment service providers, Gelato, and delivery companies when necessary to fulfil or follow up on your order;

  • from TikTok, Instagram, or other social media platforms when you communicate with us through those platforms.

4. Why We Process Personal Data and Our Legal Basis

Purchases and Deliveries

We process contact, order, payment, and delivery information to receive payment, enable Gelato to produce your order, arrange delivery, and provide you with information about your order.

Legal basis: The processing is necessary to enter into and perform our contract with you.

Customer Service, Returns, and Complaints

We process contact, order, and communication information to answer questions and manage returns, the right of withdrawal, faulty products, refunds, and other customer service matters.

Legal basis: Performance of a contract and compliance with legal obligations. When necessary to document, establish, or defend legal claims, we rely on our legitimate interest in handling disputes and protecting our rights.

Payments, Security, and Fraud Prevention

We and our payment and platform providers process personal data to complete payments, protect customer accounts, and detect or prevent fraud and misuse.

Legal basis: Performance of a contract and our legitimate interest in providing a secure online store and preventing fraud.

Customer Accounts

If customer accounts are available and you choose to create one, we process your account information to provide the account, display order information, and simplify future purchases.

Legal basis: Performance of a contract.

Accounting and Other Legal Requirements

We process information that must be included in accounting records and other documentation to comply with applicable accounting, tax, and consumer protection requirements, as well as valid decisions issued by public authorities or courts.

Legal basis: Compliance with a legal obligation.

Marketing and Social Media

We market our business through platforms including TikTok and Instagram. If you contact or interact with us through these platforms, we process the information necessary to respond to you and manage the communication. The platforms also process personal data in accordance with their own privacy policies.

If we offer newsletters or other direct marketing, we send such communications based on your consent or where marketing is otherwise permitted by law. You may unsubscribe at any time. We will continue to send necessary communications concerning your orders.

Legal basis: Consent or, where permitted by law, legitimate interest. Communications initiated by you are processed based on our legitimate interest in responding to and managing enquiries.

Statistics and Website Development

We may use aggregated statistics to understand how the store is used and improve its functionality. Cookies or similar technologies that are not strictly necessary are only used after you have provided consent, where consent is required.

Legal basis: Consent for non-essential cookies and related processing. Fully anonymised statistics are not subject to the GDPR.

5. When We Share Personal Data

We only disclose personal data when necessary for the purposes described in this policy or when required by law. Recipients may include:

  • Shopify, which provides the online store, order management, technical operation, and parts of the payment solution;

  • Gelato and Gelato’s printing and production partners, which receive the order and delivery information necessary to produce, package, and ship the poster;

  • payment service providers, including Shopify Payments and Shop Pay, card networks, and Apple Pay or Google Pay, depending on the payment method you choose;

  • carriers and local delivery partners, which require contact and address information to deliver the order;

  • technical service providers and approved Shopify apps, to the extent necessary to operate the store and only in accordance with applicable data protection requirements;

  • public authorities, courts, or professional advisers, where disclosure is required by law or necessary to establish, exercise, or defend legal claims.

Our service providers may not freely use personal data for their own purposes when acting as processors on our behalf. In such cases, they may only process the data in accordance with our instructions and applicable agreements.

6. Shopify, Shop, and Shop Pay

Shopify mainly processes customer data as a processor on our behalf to provide the online store. For certain services and purposes, Shopify may act as an independent data controller, for example when a customer uses Shop or Shop Pay or when certain enhanced Shopify features are used.

When Shopify acts as an independent data controller, Shopify determines the purposes and means of that processing and is responsible for handling related data subject requests. Further information is available in Shopify’s Consumer Privacy Policy and Shopify’s Privacy Portal.

7. Cookies and Similar Technologies

The website uses cookies and similar technologies. Strictly necessary cookies may be used without consent when required for functions such as the shopping cart, security, payment processing, and other features explicitly requested by the user.

Non-essential cookies, such as those used for statistics or personalised advertising, are only activated after you have made an active choice in the cookie banner, where consent is required. You can reject such cookies as easily as you can accept them. You may later change or withdraw your choice through the website’s cookie settings.

The cookie banner contains up-to-date information about the cookies used, their purposes, providers, and retention periods.

8. Transfers Outside the EU/EEA

Shopify, Gelato, and their subcontractors may process personal data in countries outside the EU/EEA. Where such a transfer is subject to the GDPR, it must be based on a valid adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with additional safeguards where necessary.

You may contact us if you would like further information about the safeguards used for a specific transfer.

9. How Long We Retain Personal Data

We do not retain personal data for longer than necessary for each purpose:

  • Order, payment, and delivery information is retained while the purchase is being completed and afterwards for as long as necessary to manage returns, complaints, legal claims, and legal requirements.

  • Accounting information is normally retained for seven years after the end of the calendar year in which the relevant financial year ended, where the information is subject to such a legal requirement.

  • Customer service and complaint cases are retained while the matter is being handled and normally for no longer than three years afterwards, unless the information must be retained for longer due to an ongoing claim or legal obligation.

  • Customer accounts are retained for as long as the account remains active. When the account is closed, the account information is deleted or anonymised within a reasonable period, except for information that must be retained for other purposes, such as accounting or legal claims.

  • Direct marketing information is retained until you unsubscribe or withdraw your consent. Limited information may then be retained to ensure that you do not receive further marketing communications.

  • Cookie information is retained for the period stated in the cookie settings. Consent records are retained for as long as necessary to document and respect your choice.

When personal data is no longer required, we delete or anonymise it. Information may remain in backups for a limited period before being overwritten in accordance with our service providers’ procedures.

10. Your Rights

Under the GDPR, and where the conditions for each right are met, you have the right to:

  • receive information about how your personal data is processed;

  • request access to the personal data we process about you;

  • have inaccurate or incomplete personal data corrected;

  • request the deletion of your personal data;

  • request that the processing of your personal data be restricted;

  • object to processing based on legitimate interests;

  • object to direct marketing at any time;

  • receive certain personal data in a structured, commonly used, and machine-readable format and, where possible, have it transferred to another data controller;

  • withdraw your consent where the processing is based on consent. Withdrawing your consent does not affect the lawfulness of any processing carried out before the withdrawal;

  • lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

You can exercise your rights by contacting us at visionfantasyart@gmail.com. We may need to verify your identity to ensure that we do not disclose or alter information relating to the wrong person. We normally respond within one month.

These rights are not absolute. For example, we may need to retain certain information to comply with the law or manage legal claims.

You can contact IMY through www.imy.se or at the following address:

Swedish Authority for Privacy Protection
Box 8114
104 20 Stockholm
Sweden

11. Automated Decision-Making

VisionFantasyArt UF does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you.

12. Children’s Personal Data

The online store is not specifically intended for children. We do not knowingly collect children’s personal data in violation of applicable law.

If you are a parent or legal guardian and believe that a child has provided personal data to us without the necessary permission, please contact us so that we can assess the matter and, where appropriate, delete the information.

13. Security

We use reasonable technical and organisational safeguards and established service providers to protect personal data against unauthorised access, alteration, loss, and disclosure. No transmission or storage of information over the internet is entirely risk-free. You should therefore avoid sending sensitive or unnecessary information by email or through social media.

14. External Links and Social Media Platforms

Our website and accounts may contain links to other websites or platforms, including TikTok and Instagram. These organisations are independently responsible for the processing of personal data within their services. Please read their privacy policies before providing personal data through those services.

15. Changes to This Policy

We may update this policy if our procedures, service providers, Shopify apps, or legal requirements change. The current version will be published on the website together with the date of the most recent update.

If a change materially affects how personal data already collected is used, we will provide appropriate notice where required by law.

16. Contact Us

Questions about this policy or our processing of personal data should be sent to:

VisionFantasyArt UF
Lauren Wali and Emil Jahdadic
Gamla Uppsalagatan 9B
753 34 Uppsala
Sweden
visionfantasyart@gmail.com