Controller and data

The business identified above is the controller for dotShirt processing unless a service provider acts as an independent controller. We may process identity/contact details, billing and delivery information, account data, orders, payment status, product choices, customer design files, communications, quotes, reviews and necessary security/session data.

Purposes and legal bases

Data is processed where necessary to perform a contract, meet legal obligations, pursue proportionate legitimate interests such as security and service operation, or on consent where consent is the appropriate basis.

Recipients and transfers

Necessary data may be shared with hosting/IT providers, email infrastructure, payment providers such as Mollie when enabled, shipping providers such as Sendcloud and carriers, accounting/advisers and other parties required for the order or law. Transfers outside the EEA use a lawful GDPR mechanism when required.

Retention and rights

Data is retained only as long as necessary, including statutory accounting/tax periods and reasonable periods for contracts, claims and support. Subject to the GDPR you may request access, correction, erasure, restriction, portability or object to processing, and withdraw consent where applicable. You may complain to the competent data protection authority, including the Belgian DPA for the Belgian controller.

Security and cookies

Appropriate technical and organisational security measures are used. See our cookie policy for necessary storage and any future optional cookies.