Privacy Policy

Last Updated: August 16, 2025

Topics:

  1. Introduction
  2. What data we collect
  3. How we use your data 
  4. How we store your data
  5. Who we share your data with
  6. Your data protection rights
  7. Cookies and tracking technologies
  8. Data security
  9. International data transfers
  10. Children's privacy
  11. Privacy policies of other websites
  12. Changes to this Privacy Policy
  13. Contact us

 

1. Introduction

Welcome to Nopoint Atelier. This website (www.nopointatelier.com) is operated by Nopoint Atelier Ltd ("we", "our", "us", “our company”), the data controller responsible for your personal information.

Official company details:
Company Name: Nopoint Atelier Ltd
Company Registration Number: 206376400
Registered Address: 2 Balanite village, 5301, Gabrovo, Bulgaria

This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our website.

2. What Data We Collect

We collect personal information in two main ways: information you actively give us, and information collected automatically as you use our website.

1. Information You Provide Directly to Us

1.1. To Fulfil Your Order: When you make a purchase, we collect information necessary to process and ship your order, including your name, email address, shipping address, phone number, and details of the product(s) you ordered.

Please note: We do not collect, see, or store your payment card details. This information is provided directly by you to our trusted third-party payment processors, who securely handle the transaction. The processors we use are:

Stripe: You can read their Privacy Policy here: https://stripe.com/privacy
PayPal: You can read their Privacy Policy here: https://www.paypal.com/us/legalhub/privacy-full


1.2. For Our Newsletter: When you subscribe to our newsletter, we collect your email address to send you updates, news about our studio, and special offers. We process this data based on your explicit consent, which we confirm using a double opt-in process to ensure it was you who subscribed.

Our newsletter is managed and distributed using Mailchimp, our marketing automation platform. This means your email address will be transferred to Mailchimp for processing. You can learn about their privacy practices here: https://www.intuit.com/privacy/statement/ (Mailchimp is owned by Intuit).

To help us create better content, our emails may contain tracking pixels that allow us to see if an email was opened and which links were clicked. This engagement data helps us understand what content our subscribers enjoy.

You can withdraw your consent and unsubscribe at any time by clicking the "unsubscribe" link provided in the footer of every newsletter we send.

1.3. For Communication: When you contact us via our website's contact form or by direct email, we collect the personal information you provide, such as your name, email address, and the content of your message. We process this data based on our legitimate interest in providing excellent customer service and responding to your inquiries.
      • Our contact form is an integrated feature of our e-commerce platform, Big Cartel. You can read their privacy policy here: Big Catel's Privacy Policy
      • Our direct emails (nopointatelier[at]gmail.com and print[at]nopointatelier.com) are hosted by Google. Communication with us is therefore also subject to the Google Privacy Policy

We retain communications for as long as necessary to fulfil the purpose for which they were collected. The retention period is determined by the nature of the inquiry:

General Inquiries: Communications related to general questions about our products or services are kept for a reasonable period to provide ongoing support, after which they are periodically deleted.
Order-Related Inquiries: Communications related to a specific order are kept as part of our business records for a longer period to comply with our legal, tax, and accounting obligations.

In all cases, we will never use the contact details from these inquiries to add you to a marketing list without your separate, explicit consent.

For your own privacy, we ask that you please do not include any sensitive personal information (such as health details, financial information or other special categories of personal data) in your message.

1.4. For Residency Applications: When you apply for our residency program, we use Google Forms to collect and process your application. We collect the information necessary to evaluate your submission and manage the program. This information includes:
    • Your name, email address, and contact details: To communicate with you about your application.
    • Your portfolio and any other information you provide about your artistic practice: To assess the quality and suitability of your work for the residency.
    • Confirmation that you are over 18 years of age: To ensure you meet the eligibility requirements for the program.
    • Your country of origin (optional): This information is used for internal statistical purposes only, helping us understand the geographic reach of our program. Providing it is not required to be considered for the residency.

All data submitted via Google Forms is subject to Google's Privacy Policy. For your own privacy and to ensure a fair evaluation process, we ask that you do not include any sensitive personal information (such as health data, religious beliefs, or other special categories of personal data) in your application unless it has been explicitly requested.

Please Note for Selected Participants: For health and safety purposes, participants who are selected for the residency will be asked to voluntarily provide relevant medical information (such as severe allergies or conditions) via a separate, explicit consent form. This information is treated with the utmost confidentiality and is used solely to ensure we can provide a safe environment during your stay.

2. Information We Collect Automatically

2.1. Essential Technical Information

To make our website function correctly and securely, we and our essential service providers automatically collect certain technical information. This data is processed based on our legitimate interest in operating a functional and secure e-commerce store. This includes:

  • Platform Functionality (Big Cartel): Our e-commerce platform, Big Cartel, uses necessary cookies and similar technologies to provide the core functions of our shop. These are essential for features like keeping items in your shopping cart as you browse, processing checkouts, and remembering your preferences (like your country). This process may involve collecting your IP address, browser type, and device information. You can learn more in Big Cartel's Privacy Policy.
  • Spam Prevention (Google reCAPTCHA): To protect our contact form from spam and automated abuse, we use Google reCAPTCHA. This service analyzes hardware and software information, such as device and application data, to determine that you are not a robot. This activity is subject to Google's Privacy Policy and Terms of Service.

 

2.2. Optional Analytics Information (With Your Consent): To help us improve our shop and understand how visitors use it, we use Google Analytics. Only if you provide your explicit consent via our cookie banner will we collect certain information about your device and browsing activity. This may include:
  • Your IP address (which we have configured to be anonymized by Google Analytics)
  • General geographic location (e.g., country and city)
  • Browser and device type
  • The pages you visit and the time you spend on them
  • The website that referred you to our shop

This analytics data is aggregated and processed in a way that does not directly identify anyone.

3. How we use your data

We use your personal information for the following purposes, based on a lawful basis under GDPR:

1. To Fulfil Our Contract with You:
    • To process, package, and ship the orders you place.
    • To communicate with you about your order status and provide customer support
2. With Your Explicit Consent:
      • To send you our newsletter and other marketing communications via Mailchimp if you have opted-in to receive them. You can withdraw your consent at any time by clicking the "unsubscribe" link in any of our emails.

3. For Our Legitimate Business Interests:
    • To respond to your inquiries and provide you with information you have requested.
    • To improve our website, products, and services.
    • To maintain the security of our website and prevent fraud.
    • To manage our Print Residency program and communicate with applicants.


4. How we store your data

Your personal data is stored and processed on the secure systems of the trusted third-party service providers we have listed in this policy. We do not store your personal information on local servers or personal computers.

Here is a breakdown of where your data resides:

  • Website and Order Information: All data related to our website, your customer account, and the orders you place is stored securely on Big Cartel's platform. Their servers are located in the United States.
  • Newsletter Information: Your email address and engagement data for our newsletter are stored on Mailchimp's secure servers, which are also located in the United States.
  • Communications and Applications: Emails you send us and applications submitted via Google Forms are stored within our Google Workspace account. Google stores data in a global network of secure data centres.
  • Payment Information: As stated previously, we do not store your payment card details. This information is processed and stored by Stripe and PayPal on their highly secure, PCI-DSS-compliant servers.

All of our partners are chosen for their commitment to security and are contractually obligated to use industry-standard security measures, including encryption and access controls, to protect the data they store on our behalf.

Data retention 

We keep your personal information only for as long as is necessary for the purposes for which it was collected. Our retention periods are determined by the following criteria:

  • Order Information: We retain all data related to orders (including related communications) for an extended period to comply with our legal, tax, and accounting obligations in Bulgaria.
  • Newsletter Subscribers: We retain your email address on our mailing list as long as you remain subscribed. If you unsubscribe, your details will be moved to a suppression list to ensure we do not contact you again.
  • General Inquiries: Communications not related to an order are kept for a reasonable period to provide ongoing support and are then periodically deleted.
  • Residency Applications:
    • Successful Applicants: Data is retained for the duration of the residency and for a reasonable period thereafter to maintain our business and alumni records.
    • Unsuccessful Applicants: We retain application data for a limited period (up to 5 years) after the selection process is complete. Our legitimate interest in doing so is to maintain a pool of talented artists for consideration for future opportunities. You can request the deletion of your application data at any time by contacting us.

5. Who we share your data with

We do not sell your personal data. We only share it with the following trusted third-party service providers who are essential for us to run our business:

  • E-commerce Platform: Our store is hosted on Big Cartel, which provides the platform for our website and contact form. Big Cartel's Privacy Policy.
  • Payment Processors: To securely process your payments, your data is provided directly to Stripe (Privacy Policy) and PayPal (Privacy Policy). We do not see or store your payment card details.
  • Email Marketing Platform: We use Mailchimp (an Intuit company) to manage our newsletter. Intuit's Privacy Statement.
  • Analytics and Service Providers: We use Google for several services, including Google Analytics, Google Forms (for residencies), Google reCAPTCHA, and email hosting. Google Privacy Policy.
  • Shipping Providers: To deliver your order, we share your name, shipping address, and contact details (such as your email or phone number for delivery notifications) with our courier partner, PostOne. PostOne's Privacy Policy.
  • Legal Obligations: We may disclose your information if required to do so by law.

 

6. Your data protection rights

Our Company would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

  • The Right to Access: You have the right to request Our Company for a copy of your personal data. We may charge you a small fee for this service.
  • The Right to Rectification: If you believe any data we hold about you is inaccurate or incomplete, you have the right to request we correct it.
  • The Right to Erasure (The "Right to be Forgotten"): You can request that we erase your personal data, under certain conditions. Please note: This right is not absolute. We cannot delete data related to your past orders before the legal retention period has passed, as we are required by the Bulgarian Accountancy Act to keep tax and accounting records for up to 10 years.
  • The Right to Withdraw Consent: Where we rely on your consent to process your data, you can withdraw it at any time. This is a simple, "self-serve" action:
    • For our Newsletter: You can withdraw consent instantly by clicking the "unsubscribe" link in the footer of any email.
    • For Analytics Cookies: You can withdraw consent at any time by opening and changing your preferences in our website's cookie consent manager.
  • The Right to Object to Processing: Where we process your data based on our legitimate interests (e.g., for managing residency applications), you have the right to object. This requires you to contact us directly so we can assess your request.
  • The Right to Restrict Processing: Under certain conditions, you can request that we temporarily stop processing your personal data.
  • The Right to Data Portability: You have the right to request we transfer your data that we have collected to another organisation or directly to you, under certain conditions.

How to Exercise Your Rights

If you would like to exercise any of these rights, please contact us at nopointatelier[at]gmail.com and/or print[at]nopointatelier.com.

To help us process your request efficiently, please be as specific as possible and use a clear subject line like "Data Subject Request." We are required by law to respond to your request within one month.

Your right to lodge a complaint

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you have the right to lodge a complaint with your local data protection authority. The supervisory authority for our company in Bulgaria is:

  • Commission for Personal Data Protection (CPDP), Bulgaria
  • Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592
  • Website: www.cpdp.bg

 

7. Cookies and tracking technologies

Our website uses cookies, which are small text files placed on your device, to function correctly, ensure security, and improve your experience. We classify the cookies we use into the following categories:

1. Strictly Necessary Cookies

These cookies are essential for the basic operation of our website and e-commerce store. They cannot be disabled in our systems. They are used for core functionalities such as:

  • Enabling you to navigate the site.
  • Keeping items in your shopping cart.
  • Processing checkout and payments.
  • Ensuring the security of our site and contact form (e.g., via Google reCAPTCHA).

These cookies are set by our platform provider, Big Cartel, and do not store any personally identifiable information. Because they are essential, they are loaded based on our legitimate interest to provide you with a functional website, and we do not require your consent to use them. For more details, you can review Big Cartel's Cookie Policy, part of their Privacy Policy.

2. Analytics & Performance Cookies

These cookies are optional and help us understand how visitors interact with our website. They allow us to count visits, see which pages are most popular, and identify how users move around our site. The information we collect is aggregated and anonymised. This helps us improve our website and the products we offer.

We use Google Analytics for this purpose. These cookies will only be set on your device if you give us your explicit consent by clicking "Accept" on our cookie consent banner.

How to Manage Your Cookie Preferences

You have full control over your cookie settings.

  • Our Cookie Banner: You can change your mind and withdraw your consent for Analytics cookies at any time by reopening the cookie consent manager on our website.
  • Browser Settings: Most web browsers also allow you to control cookies through their settings. You can set your browser to block or alert you about these cookies, but please be aware that blocking necessary cookies may cause some parts of the site to stop working. You can find out more about how to manage cookies on popular browsers from their respective help pages.

 

8. Data security

We take the security of your personal information very seriously and have implemented measures to protect it.

  • Website Encryption (SSL/TLS): Our website is protected using Secure Sockets Layer (SSL) technology, which you can see by the "https" and the padlock icon in your browser's address bar. This encrypts all data transmitted between your browser and our website, protecting your personal information from being intercepted.
  • Payment Security: We do not collect, see, or store your payment card details on our servers. All payments are processed directly by our third-party payment processors, Stripe and PayPal, who are certified to the highest industry standards (PCI-DSS compliant). They use advanced encryption and security protocols to keep your payment information safe.
  • Our Commitment: We are dedicated to protecting your data and continuously work to strengthen our security measures. While we and our trusted partners use industry-standard practices to safeguard your information, it is important to remember that no method of transmission over the Internet is 100% secure. Therefore, while we strive to protect your personal information, we also encourage you to take steps to protect yourself, such as using strong passwords and secure internet connections.

 

9. International data transfers

To provide our services, we use essential third-party partners who are based in the United States. This means that when you use our shop, your personal data is transferred outside of the European Economic Area (EEA).

We take specific steps to ensure your data receives the same high level of protection it would within the EEA by using different legal safeguards depending on the partner:

  • For our partners Google, Mailchimp (Intuit), Stripe, and PayPal: We rely on the EU-U.S. Data Privacy Framework (DPF). These companies are certified under the DPF, which the European Commission has determined provides an adequate level of data protection.
  • For our e-commerce platform, Big Cartel: We rely on Standard Contractual Clauses (SCCs). These are legally binding contracts approved by the European Commission that require recipients to protect data to GDPR standards. Big Cartel's formal commitment to these clauses is outlined in their Data Processing Addendum (DPA), which forms part of our legal agreement with them.

By using these appropriate legal frameworks for each partner, we ensure that your data is handled with the same high standards of security and care that are required within the EU.

 

10. Children's privacy

Our website, products, and services are not intended for or directed to individuals under the age of 14. This is the age of digital consent for data processing in Bulgaria. (Our residency program is separately restricted to applicants aged 18 and over).

We do not knowingly collect personal information from children under 14.

If you are a parent or guardian and you believe that your child has provided us with their personal data without your consent, please contact us immediately at nopointatelier[at]gmail.com or print[at]nopointatelier.com. If we become aware that we have inadvertently collected personal data from a child under 14, we will take prompt steps to delete that information from our records.

 

11. Privacy policies of other websites

Our website contains links to other websites (for example, to our service providers' policies or our social media profiles). This Privacy Policy applies only to our website (www.nopointatelier.com).

When you click on a link to another website, you should read their privacy policy to understand how they collect and use your personal information. We are not responsible for the privacy practices or the content of these other websites.

 

12. Changes to this privacy policy

We keep our Privacy Policy under regular review and place any updates on this webpage.

When we make changes, we update the "Last Updated" date at the top of this policy.

  • For Minor Changes: If we make minor changes, such as correcting a typo or updating a link, we will simply post the new policy on this page.
  • For Material Changes: If we make a material change that significantly alters how we handle your personal information or affects your rights, we will provide a more prominent notice. This may include sending an email notification to our newsletter subscribers or displaying a temporary notice on our website homepage.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

13. Contact Us

If you have any questions about this Privacy Policy, how we handle your data, or if you wish to exercise any of your data protection rights, please do not hesitate to contact us.

  • You can reach the data controller for this website using the details below:
    Company Name: Nopoint Atelier Ltd
  • Emails: nopointatelier[at]gmail.com or print[at]nopointatelier.com
  • Registered Address: 2 Balanite Village, Gabrovo, 5301, Bulgaria