Privacy Policy

When you browse the site, we may collect device, browser, and usage information such as pages viewed, referral source, and anonymized analytics events.

When you place an order, we collect the information needed to fulfill it, including your name, shipping address, billing address, email address, and payment details. Payment details are processed by our payment provider and are not stored on our servers.

When you subscribe to the newsletter, we collect the email address you submit and a timestamp of when you gave consent.

We rely on the following legal bases under the EU General Data Protection Regulation (GDPR):

• Contract — to fulfill orders and respond to support requests for purchases you have made.
• Consent — for marketing emails, optional analytics cookies, and any other optional processing. Consent can be withdrawn at any time.
• Legal obligation — to retain transaction records as required by accounting, tax, and consumer-protection law.
• Legitimate interests — to prevent fraud, secure the storefront, and improve service quality, balanced against your rights.

We share personal data only with third-party providers that help us operate the store. These providers act as data processors under our instructions:

• Shopify (Shopify International Limited, Ireland) — e-commerce platform, checkout, payment routing, order management.
• Klaviyo (Klaviyo, Inc., United States) — newsletter list management and email delivery for subscribers who opt in.
• Google Analytics (Google LLC, United States) — anonymized aggregate usage analytics, loaded only with your consent.
• Vercel (Vercel Inc., United States) — site hosting, content delivery, and request logs.
• Print and framing partners in Europe, the United Kingdom, and the United States — to produce and dispatch made-to-order artwork. They receive only the data needed to print and ship your order.
• Shipping carriers — to deliver your order, with the name, address, and contact information required by the carrier.

We do not sell personal data.

Some of the providers listed above are located outside the European Economic Area (EEA), in particular in the United States. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, additional safeguards offered by the provider, as the legal basis for that transfer.

You can request more information about our specific transfer safeguards by emailing help@wonderland-art.com.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or outdated data;
• request deletion of your data, subject to legal retention rules;
• restrict or object to certain processing;
• receive a copy of your data in a structured, commonly used, machine-readable format (data portability);
• withdraw consent for marketing at any time — either via the “unsubscribe” link in any email we send you, or via our unsubscribe page.

To exercise these rights, email help@wonderland-art.com. If you are in the EU/EEA and believe your rights have not been respected, you also have the right to lodge a complaint with your national data-protection supervisory authority. In Sweden, this is the Integritetsskyddsmyndigheten (IMY).