Privacy Policy
Last updated: April 2026
Who we are
Gweilo Prints is a fine art photography print store operated from Hong Kong.
What data we collect
When you place an order, we collect your name, shipping address, and email address at checkout. Card details are handled entirely by our payment processor, Airwallex, and never touch our servers.
Of that information, only your email address and the destination country of the shipment are retained in our own database. Your name, street address, and postcode are passed directly to Gelato (our print fulfilment partner) and are not stored by us. We retain enough order metadata — order ID, items, totals, currency, and dates — to handle support enquiries, returns, and our legal record-keeping obligations.
We also use your browser's local storage to remember the contents of your cart. This data stays on your device and is not transmitted to us.
How we use it
Your name and shipping address are passed to Gelato solely so they can produce and ship your order. Your email address is used to send you an order confirmation, shipping updates, and to contact you about your order if needed. The destination country is retained for tax reporting and shipping-cost analysis.
The lawful bases for this processing are performance of a contract (fulfilling your order) and legal obligation (retaining transaction records for tax and accounting purposes).
We do not sell, rent, or share your personal data with any third party beyond what is necessary to fulfil your order or comply with the law.
Mailing list (optional)
If you choose to subscribe to our mailing list, your email address is stored by Resend, our email provider, and used solely to send occasional updates about new prints and collections. We do not share it with anyone else, and we never email you without your explicit opt-in.
You can unsubscribe at any time using the link in any email we send, or by visiting /unsubscribe. Your subscription is recorded with the date and time you opted in, as required by GDPR. For full deletion of your record, contact us using the link below.
Third-party services
- Airwallex — payment processing. Your payment data is governed by Airwallex's Privacy Policy.
- Gelato — print fulfilment and shipping. Your shipping data is governed by Gelato's Privacy Policy.
- Resend — transactional and mailing-list email delivery. Your email address is governed by Resend's Privacy Policy.
- Vercel Analytics — anonymous page view statistics. No cookies are used and no personal data is collected.
Data retention
We retain order records (email address, destination country, order contents, and payment metadata) for three years after the order date. This period reflects our legal record-keeping obligations and the window in which support queries, returns, or chargebacks typically arise.
After three years, the email address is removed from the order, leaving only anonymised aggregate data (country, totals, currency, item descriptions, dates) for accounting purposes.
Airwallex and Gelato also retain order data independently in line with their own privacy policies and the laws that apply to them.
Your rights
Under the GDPR (and equivalent laws in the UK and elsewhere) you have the right to:
- Access a copy of the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data (the “right to be forgotten”), subject to our legal record-keeping obligations.
- Restrict or object to certain processing.
- Lodge a complaint with your local supervisory authority.
To exercise any of these rights, please use our self-service request form at /privacy/request. We will verify the request by sending a confirmation link to the email address on file before disclosing or deleting any data. Most requests are completed automatically within minutes; complex requests may take up to 30 days.