1. Who we are
delavaga.com is operated by Digital Dunia LLC, a Florida limited liability company (Florida document number L23000552723), whose principal place of business is 2880 W Oakland Park Blvd, Suite 225C, Oakland Park, FL 33311, United States. In this policy “delavaga”, “we”, “us” and “our” mean Digital Dunia LLC.
We decide why and how the personal information described here is used, which makes us its controller (the term used by UK data protection law) or business (the term used by US state privacy laws). You can reach us about anything in this policy at support@delavaga.com.
2. What this policy covers
This policy applies to personal information we handle when you visit delavaga.com (including the journal at delavaga.com/blog), place an order, create an optional account, subscribe to our newsletter, or write to us. “Personal information” means information that identifies you or could reasonably be linked to you.
It does not cover websites we link to, or the payment page run by our payment processor, which has its own privacy notice. We sell to customers in the US, Canada, the UK and Australia; the rights section explains what applies in each.
3. What we collect
We collect only what the shop needs to work. Most of it you give us directly.
Information you give us
- Order details: your name, email address, delivery address and, if you choose to give it, a phone number for the courier. Also what you ordered — unavoidable, since it is the thing being printed — plus the order number, amounts and dates.
- Account details (optional): if you create an account, your email address and the identifier our sign-in provider returns. There is no password; accounts use passkeys.
- Newsletter: your email address, if you subscribe.
- Messages: what you write to us, and anything you attach — for example photographs of a damaged item.
Information collected automatically
- Server logs: your IP address, browser type, the pages requested and the time of each request. This is how outages and abuse are diagnosed.
- Sign-in records: when you sign in, the IP address and browser type used, so that suspicious sign-ins can be spotted.
- Cookies: a small number of cookies that keep your bag and sign-in working, described in the cookie policy. We do not use analytics or advertising cookies.
Information from others
- From our payment processor: whether your payment succeeded, a payment reference, and the amount. We never receive or store your full card number or security code — they are entered on the processor’s own page.
- From our fulfilment partner and carriers: production status, shipping status and tracking numbers for your order.
We do not ask for, and ask you not to send us, sensitive information such as health, financial account, government ID, biometric or precise location information.
4. How we use it, and why we may
We use personal information only for the purposes below. UK law requires us to name a “lawful basis” for each; we apply the same discipline everywhere we sell.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Making and delivering your order | Order details, delivery address, phone | Performing our contract with you |
| Taking payment and issuing refunds | Order details, payment reference | Performing our contract with you |
| Order emails: confirmation, invoice, shipping and tracking | Name, email, order details | Performing our contract with you |
| Customer support, faults, returns and refunds | Order details, messages, photographs | Performing our contract; our legitimate interest in resolving problems |
| Your optional account and order history | Account details, sign-in records | Performing our contract with you |
| Keeping the site secure and preventing fraud | Server logs, sign-in records, order details | Our legitimate interest in a safe, working shop |
| Newsletter | Email address | Your consent, which you can withdraw at any time |
| Google Customer Reviews survey invitation | Email, order number, delivery country, estimated delivery date | Your consent — given in Google’s own window after you order |
| Tax, accounting and legal records | Order and payment records | Complying with our legal obligations |
| Defending or bringing legal claims | Whatever is relevant to the claim | Our legitimate interest in protecting our rights |
Where we rely on legitimate interests we have weighed them against your rights, and you can object (see your rights). We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment processor may run its own automated fraud checks on a payment; its privacy notice covers those.
5. Who we share it with
We share personal information only with the companies that need it to do a specific job for us, under contracts that limit them to that job. None of them is an advertising network.
| Who | What they do | What they receive |
|---|---|---|
| Printify, Inc. and its print providers | Print and pack your order. The provider depends on the product; today most are in the United States and one (sneakers) is in China. | Name, delivery address, phone (if given), email, order contents |
| Postal services and couriers | Deliver the parcel — for example USPS, UPS, FedEx, DHL, Canada Post, Royal Mail or Australia Post. | Name, delivery address, phone (if given) |
| Stripe, Inc. | Process your payment on their own secure page, and screen it for fraud. | Order amount and reference, your email, and the payment details you enter there |
| Paswad ID (operated by Northfast Limited) | Passkey sign-in — only if you create an account. Guest checkout never contacts it. | Your email and sign-in identifier |
| Resend | Send order and account emails. | Your email address and the content of those emails |
| Ghost (self-hosted) and its email delivery provider | Run the journal and send the newsletter. | Your email address, if you subscribe |
| Google LLC | Google Customer Reviews — only with your consent. | If you opt in: email, order number, delivery country, estimated delivery date |
| Cloudflare, Inc. | Domain name and network services that keep the site reachable and block attacks. | IP address and request data, in transit |
| Our hosting provider | Host the servers the shop runs on. | All data we store, held on our behalf |
We may also disclose personal information:
- when the law requires it, or to respond to a valid request from a court, regulator or law enforcement authority;
- to protect the rights, property or safety of our customers, ourselves or others, including to prevent fraud;
- to professional advisers such as accountants and lawyers, under a duty of confidentiality; and
- to a buyer or successor if the business is sold or reorganised. They would be bound by this policy for the information they receive, and we would tell you before your information became subject to a different one.
6. We do not sell your information
We do not sell personal information, and we do not “share” it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act and similar US state laws. We have not done so in the past twelve months. We do not disclose personal information to third parties for their own direct marketing.
Because there is no sale or sharing to opt out of, a Global Privacy Control signal from your browser requires no further action from us. Every optional category is off until you switch it on yourself, whether or not your browser sends one.
7. International transfers
We are based in the United States, and our servers and most of our service providers are too. If you order from Canada, the United Kingdom or Australia, your information is transferred to and processed in the United States, where data protection law differs from yours. A small number of orders are produced by a print provider in China.
Where UK law requires a safeguard for such a transfer, we rely on the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, the UK–US Data Bridge for recipients certified to it, or — for the address a carrier or print facility needs to deliver your parcel — the transfer being necessary to perform your contract with us. You can ask us for more detail on the safeguard used for a particular recipient.
8. How long we keep it
We keep personal information only as long as its purpose requires, then delete or anonymise it.
| Information | How long |
|---|---|
| Bag (cart) contents | 30 days after it was last changed, then deleted |
| Sign-in session | 60 days, or until you sign out |
| Sign-in attempt records | 10 minutes for an unfinished attempt |
| Orders, invoices and payment records | 7 years from the order, because tax and accounting law requires it |
| Support messages and photographs | Until the matter is resolved, then up to 3 years in case it comes back |
| Optional account | Until you ask us to delete it; order records are then kept as above |
| Newsletter subscription | Until you unsubscribe |
| Server logs | Up to 30 days |
| Review invitation cookie | 2 hours at most, deleted as soon as it is used |
9. How we protect it
Every connection to delavaga.com is encrypted with TLS. Card details never touch our systems. Session and bag cookies carry only random tokens, and we store a one-way hash of each token rather than the token itself — so a copy of our database does not contain anything that could be replayed as a login. Cookies are marked httpOnly, so scripts on the page cannot read them. Access to order data is limited to the people who need it, and accounts use passkeys rather than passwords.
No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the relevant authorities where the law requires it.
10. Your rights
Depending on where you live, you have some or all of the rights below. We honour them for every customer, wherever you live, as far as we reasonably can.
- Access: ask for a copy of the personal information we hold about you, and how we use it.
- Correction: ask us to correct information that is wrong or incomplete.
- Deletion: ask us to delete it, except what we must keep for tax, accounting or legal reasons.
- Portability: ask for it in a structured, machine-readable form.
- Objection and restriction: object to a use based on our legitimate interests, or ask us to pause a use while a complaint is looked at.
- Withdraw consent: for the newsletter or Google Customer Reviews, at any time, without affecting anything done before.
- Non-discrimination: exercising a right never changes the price you pay or the service you get.
To exercise a right, email support@delavaga.com from the address you ordered with, or include your order number. We verify requests by matching them to the email address on our records, and may ask for one more detail if we cannot. An authorised agent may make a request for you with your signed permission. We reply within one month (45 days where US state law sets that period), and tell you if we need longer and why. Requests are free unless they are manifestly unfounded or excessive.
If we refuse a request, we will explain why. Where US state law gives you a right to appeal a refusal, reply to our answer with the word “appeal” and we will review it within 45 days.
11. Rights where you live
United Kingdom
The UK GDPR and the Data Protection Act 2018 apply to our handling of information about people in the UK, and give you all of the rights above. You can complain to the Information Commissioner’s Office (ico.org.uk), though we would welcome the chance to put things right first.
United States
Residents of California and other states with consumer privacy laws have the rights to know, access, correct and delete personal information, and to opt out of its sale or sharing. We do not sell or share it. The categories we collect, in the terms California law uses, are: identifiers (name, email, postal address, phone, IP address); commercial information (orders and purchase history); internet activity (server logs); and inferences — none. We collect them from you, your device, and the service providers named above, for the purposes in section 4, and disclose them only to the recipients in section 5. We do not use or disclose sensitive personal information.
Under California’s “Shine the Light” law you may ask whether we disclosed personal information to third parties for their direct marketing in the past year. We did not.
Canada
We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). You can access and correct your information and withdraw consent, subject to legal and contractual limits. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Australia
We handle personal information in line with the Australian Privacy Principles. You can access and correct your information. If you are not satisfied with our answer to a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
12. Marketing email
We send the newsletter only if you subscribe. Every issue has a one-click unsubscribe link, and you can also ask us to remove you. Order and account emails — confirmations, invoices, tracking — are part of the service you asked for, are not marketing, and are sent even if you do not subscribe.
13. Cookies
We use two strictly necessary cookies (your bag and your sign-in), and load Google Customer Reviews only if you allow it. There are no analytics or advertising cookies. The cookie policy lists every cookie and how to change your choice; the “Your privacy choices” button at the foot of every page reopens the settings.
14. Children
The shop is intended for adults and is not directed at children. We do not knowingly collect personal information from anyone under 16, and never from a child under 13. If you believe a child has given us their details, email us and we will delete them.
15. Other websites
The site links to others — the payment page, carriers’ tracking pages, social networks. Their handling of your information is governed by their own policies, not this one.
16. Changes to this policy
When we change this policy we update the date at the top. If a change affects what we do with information you have already given us — adding a service provider counts — we will say so on the site, and email you if you have an account or an order in progress.
17. Contact and complaints
Digital Dunia LLC, 2880 W Oakland Park Blvd, Suite 225C, Oakland Park, FL 33311, United States. Email support@delavaga.com.
If you have a concern, please tell us first — most things can be fixed quickly. You also have the right to complain to the data protection authority where you live, named in section 11.