Privacy Policy

Translation notice: This is an English translation of our German-language privacy policy, provided for your convenience. The German version at lanamathieson.com/datenschutz is legally binding. The sections on customer accounts, order processing, payment providers, our print partner and the newsletter describe our online shop and have no German-language counterpart yet; please have them reviewed alongside the translation before this page goes live.

1. Privacy at a glance

Protecting your personal data is important to us. We treat personal data confidentially and in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR), and this privacy policy.

This privacy policy informs you which personal data is processed when you visit this website, place an order or contact us.

2. Data controller

The controller responsible for data processing on this website is:

Lana Mathieson
Rademacherstraße 10
23556 Lübeck
Germany

Phone: +49 163 7150576
Email: hello@bylanamathieson.com

3. Collection and storage of personal data

We process personal data only to the extent necessary to provide this website, process an order or handle an enquiry. This can include in particular:

name
address
email address
phone number
messages you send us
order and product details
payment and billing information
account login data, if you create a customer account

Processing is based on Art. 6(1)(b) GDPR for pre-contractual measures and contract performance.

4. Contact by email or contact form

If you contact us by email or via a contact form, we store your details to process the enquiry and any follow-up questions.

We do not pass on this data without your consent.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to an order, and Art. 6(1)(f) GDPR based on our legitimate interest in handling enquiries.

5. Customer accounts

If you create a customer account, we store the data required for the account, in particular your name, email address, delivery and billing addresses and your order history. This lets you view past orders and speeds up future checkouts.

The legal basis is Art. 6(1)(b) GDPR for account management as part of the contractual relationship. You can ask us to delete your account at any time using the contact details above.

6. Order processing

To process an order, we use the data you provide at checkout, in particular delivery address, billing address, the items ordered and payment details. This data is passed on to the service providers listed below to the extent necessary to fulfil your order.

The legal basis is Art. 6(1)(b) GDPR, contract performance.

7. Payment providers: Stripe and PayPal

We offer payment via Stripe and PayPal. Depending on the payment method you choose, the payment data required to process the transaction (e.g. name, address, order amount, payment details) is transmitted to the respective provider:

Stripe Payments Europe, Ltd.
PayPal (Europe) S.à r.l. et Cie, S.C.A.

Both providers process this data as independent controllers under their own privacy policies, which we recommend you review. The legal basis for sharing your data is Art. 6(1)(b) GDPR, contract performance.

8. Print and shipping partner: Prodigi

Our art prints and merchandise are produced and shipped on our behalf by our print-on-demand partner, Prodigi. For this purpose, Prodigi receives the order and delivery data required to manufacture and ship your order (e.g. name, delivery address, ordered items).

The legal basis is Art. 6(1)(b) GDPR, contract performance.

9. Newsletter

If you sign up for our newsletter, we use your email address to send you news and offers. Sign-up is based on your consent, Art. 6(1)(a) GDPR, which you may withdraw at any time, for example via the unsubscribe link in every newsletter or by contacting us using the details above.

10. Server log files

When you visit this website, our technical provider may automatically collect information, in particular:

IP address
date and time of access
browser used
operating system
pages accessed

This data serves the technical security and reliable operation of the website. The legal basis is Art. 6(1)(f) GDPR.

11. Cookies

This website may use technically necessary cookies required for its operation. Any analytics, marketing or tracking cookies beyond that are used only with your consent.

12. Web analytics (Swetrix)

We use Swetrix, an open source analytics tool, to see how our shop is used. We host it on our own infrastructure, so no visitor data is passed to a third party analytics provider.

Swetrix does not use cookies and does not store anything on your device. For each page view it records the page path, the referring page, campaign parameters contained in the address, your browser, operating system and device type, the language and time zone your browser reports, and the country derived from your IP address.

Your IP address and browser identification are not stored. They are processed in memory only: together with the website identifier and a salt that changes every day, they are turned into a one way hash. This lets us count which page views belong to the same visit, without being able to identify you, and without being able to recognise you again once the salt has changed.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to understand the reach of our shop and to improve it. We do not build user profiles, we do not merge this data with other sources, and we do not pass it on.

If your browser sends a Do Not Track signal, no measurement takes place at all.

13. Disclosure of data

We only disclose personal data where this is necessary to fulfil a contract, where we are legally obliged to do so, or where you have given your consent. In practice this concerns the service providers named above, in particular payment providers, our print and shipping partner, and technical providers needed to operate the shop (e.g. hosting and email delivery).

14. Retention period

We store personal data only for as long as necessary for the respective purpose. Statutory retention obligations, in particular under tax and commercial law, remain unaffected.

15. Your rights

You have the right at any time to:

access your stored personal data (Art. 15 GDPR)
rectification of inaccurate data (Art. 16 GDPR)
erasure of personal data (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
object to certain processing (Art. 21 GDPR)

To exercise these rights, a message to hello@bylanamathieson.com is sufficient.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

17. Currency of this privacy policy

This privacy policy is currently valid.

Last updated: June 2026; shop-specific sections added September 2026.