Privacy policy
1. Who is responsible for your personal data
The controller of the personal data described in this notice is imposter., Italy (referred to below as "we", "us" or "the controller").
You can reach us about anything in this notice, including to exercise the rights described in section 8, at notyetimposter@gmail.com.
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR.
This notice applies to imposter.wtf and to the personal data we handle when you order from us, contact us, or ask us about an order.
2. The personal data we collect
Order and delivery data. When you place an order we receive your name, delivery address, email address, the items ordered, the amount paid, the currency, and the date and time of the order. We also generate a six-character order code that identifies the order.
Payment data. Payment is taken by our payment processor. We never see, receive or store your full card number, expiry date or security code. We receive confirmation that a payment succeeded, the amount, and an identifier for the transaction.
Fulfilment data. Your name and delivery address are passed to our print and delivery partner so that the item can be printed and shipped. We receive back the production status and, once shipped, the tracking reference.
Correspondence. If you write to us we hold your message, your email address and our reply, for as long as needed to deal with it and to have a record of what was agreed.
Technical data. Our hosting provider and our database provider keep server logs which may include your IP address, the pages requested, timestamps and general information about your browser and device. These are generated automatically by the infrastructure and are used for security and to keep the service working.
Local storage in your browser. See our Cookie policy. In summary: what is in your basket, and whether you answered the cookie notice. Neither leaves your device on its own and neither identifies you.
We do not knowingly collect any special category data as defined in Article 9 GDPR, and you should not send us any.
3. Why we use it, and on what legal basis
To sell you a poster and get it to you — taking the order, taking payment, having it printed, having it delivered, telling you where it is, and dealing with returns and complaints. Legal basis: Article 6(1)(b) GDPR, performance of a contract to which you are party, and steps taken at your request before entering into it.
To keep records the law requires us to keep — accounting, tax and commercial records. Legal basis: Article 6(1)(c) GDPR, compliance with a legal obligation to which we are subject.
To keep the site and the shop working and secure — server logs, fraud prevention, diagnosing faults. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in operating a working and reasonably secure service. We consider this interest not to be overridden by your rights, because the data involved is limited, is not used to build any profile of you, and is kept for a short time.
To answer you when you write to us. Legal basis: Article 6(1)(b) GDPR where your message concerns an order or a possible order, and otherwise Article 6(1)(f), our legitimate interest in replying to people who contact us.
To establish, exercise or defend legal claims, including chargebacks and disputes. Legal basis: Article 6(1)(f) GDPR.
To send you marketing email, if and only if you have asked for it. Legal basis: Article 6(1)(a) GDPR, your consent, which you can withdraw at any time. See the Newsletter notice.
Providing the data described in section 2 as necessary for an order is a requirement of entering into the contract: without a name and a delivery address we cannot print or send anything, and the order cannot be completed.
4. Who else handles your data
We use a small number of service providers. Each of them acts either as our processor under Article 28 GDPR, under a written data processing agreement, or as an independent controller for its own purposes, as noted.
Stripe — payment processing. Acts as an independent controller for its own fraud-prevention and regulatory purposes and as our processor for the transaction itself. Stripe receives your payment details directly; we do not.
Gelato — printing and delivery. Receives your name, delivery address and the items ordered, so the item can be produced and shipped. Gelato passes your name and address to the carrier that delivers the parcel.
Supabase — database and file storage. Stores the order record described in section 2.
Vercel — hosting. Serves the site and keeps operational logs.
Resend — email delivery. Sends your order confirmation and any other email we send you.
We may also disclose personal data to our accountants and professional advisers, and to public authorities, courts or law enforcement where we are legally required to do so or where it is necessary to establish or defend a legal claim.
We do not sell your personal data. We do not share it with anyone for advertising, and we do not allow anyone to use it for their own marketing.
5. Transfers outside the European Economic Area
Some of the providers listed in section 4 are established in, or process data in, countries outside the EEA, principally the United States.
Where that happens, the transfer is made on one of the bases permitted by Chapter V GDPR: an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it; or the Standard Contractual Clauses adopted by the European Commission, together with any supplementary measures the transfer requires.
You may ask us for a copy of the safeguards applied to a particular transfer by writing to notyetimposter@gmail.com.
Where your order is printed outside the EEA — we print in the country nearest to you, so an order to the United States is printed in the United States — your name and delivery address are necessarily transferred to that country in order to perform the contract you asked us to perform.
6. How long we keep it
Order, invoicing and accounting records: ten years from the end of the financial year in which the transaction took place, which is the retention period required of us by Italian civil and tax law.
Correspondence about an order: as long as needed to deal with the matter, and then for as long as a claim connected to that order could still be brought.
Correspondence not about an order: normally no more than two years.
Server and security logs: normally no more than twelve months, unless a specific log is retained longer as evidence of a security incident.
Marketing consent and the email address it attaches to: until you withdraw consent or object, and after that only such record as is needed to show that we stopped.
Data in your own browser's local storage: see the Cookie policy. We cannot delete it for you; you can, at any time.
7. Security
The site is served over HTTPS. Access to the order database is restricted, and the administrative area of the site is password-protected.
No system is perfectly secure, and we do not claim otherwise. If a breach of your personal data occurs that is likely to result in a high risk to your rights and freedoms, we will notify you as required by Article 34 GDPR, and the supervisory authority as required by Article 33.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to ask us for access to your personal data; to have inaccurate data corrected; to have data erased; to have processing restricted; to receive data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller; and to object to processing carried out on the basis of our legitimate interests.
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
Some of these rights are qualified. In particular, we cannot erase records we are required by tax and accounting law to keep, and we cannot erase an order record while a claim connected to it could still be brought.
To exercise any of these rights, write to notyetimposter@gmail.com. We will respond within one month of receiving your request, which may be extended by two further months where the request is complex, in which case we will tell you within the first month.
We do not carry out automated decision-making producing legal effects concerning you or similarly significantly affecting you, within the meaning of Article 22 GDPR, and we do not profile you.
If you consider that our processing infringes the GDPR you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The Italian supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.
9. If you are in the United States
We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.
We are not currently a "business" as the CCPA defines one: we are below the annual gross revenue threshold, we do not buy, sell or share the personal information of 100,000 or more California consumers or households in a year, and we do not derive any revenue from selling or sharing personal information. We are nevertheless setting out here how we handle personal information, and we will honour requests of the kinds the CCPA describes.
Categories of personal information collected in the last twelve months: identifiers (name, email address, postal address, IP address); commercial information (products purchased and amounts paid); and internet activity limited to server logs. Categories of sources: you, and our service providers. Business purposes: those set out in section 3. Categories of third parties to whom personal information is disclosed for a business purpose: the service providers listed in section 4.
California residents may request to know what personal information we hold, to have it deleted, and to have it corrected, and may not be discriminated against for exercising those rights. Requests may be made at notyetimposter@gmail.com and will be verified against the order record before being acted on. An authorised agent may make a request on your behalf with written proof of authorisation.
Residents of other US states with comprehensive privacy statutes may make equivalent requests to the same address, and we will treat them in the same way, whether or not those statutes apply to us by their own terms.
10. Children
This shop is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, write to us and we will delete it.
11. Changes to this notice
This notice was last updated on 21 August 2026. If we change it in a way that affects how we use personal data we already hold, we will say so on this page, and where the change requires it we will contact you.