What happens to your photo?

Required checkout information is necessary to accept and deliver an order. If it is not provided, we cannot complete the purchase. We do not make decisions about customers through automated profiling.

A normal photograph is not treated as biometric identification because Glimery does not identify people or analyse faces. A photo can nevertheless show children or incidentally reveal health, religion, ethnic origin, or other private details. We do not try to infer or categorise any of those details.

• Photos are used only for the customer's requested product and related support.
• Photos are not sold, published, used in marketing, added to portfolios, or used to train AI systems.
• Access is limited to the people and systems needed to produce and support the order.
• Order confirmation emails show a small framed preview of the customer's uploaded photograph. The preview is loaded from Glimery through a private order link, and the customer's email provider may process or cache it when displaying the message.

If you upload a photo of another person, including a child, you confirm that you are authorised to use it for this order and that you have informed that person where appropriate. Please do not upload unlawful content or a photo you are not entitled to use.

We share only the information needed for each service:

• Mollie receives payment information directly on its payment page and acts as an independent controller for payment processing, fraud prevention, and its legal obligations. Glimery does not receive full card or bank credentials.
• Resend processes recipient and delivery contact details, order information, and the private preview link contained in the customer confirmation. Full-resolution source photos, production crops, and STL files are not attached to or sent through Resend. Resend is a US provider and uses approved contractual safeguards, including EU Standard Contractual Clauses, for relevant transfers.
• Sendcloud processes destination country and postcode with parcel information when live shipping quotes are requested. If shipping labels are activated, it and the selected carrier will also receive the delivery information needed to transport the parcel.
• Railway hosts the website and processes technical request information, including IP addresses, to deliver and secure the service.
• Country.is receives the visitor's IP address from the Glimery server solely to return an approximate two-letter country code. Glimery does not retain the raw IP specifically for this feature.
• The selected carrier, such as bpost, receives the recipient and delivery details necessary to deliver the parcel.
• Professional advisers, insurers, courts, tax authorities, or other authorities may receive information where this is necessary or legally required.

Country suggestion: IP-based detection is approximate and may reflect a VPN or network exit point. Customers can always change it, and their explicit selection takes priority.

• Browser basket and photo previews: up to 30 days after the last basket change, or until you remove them or complete payment.
• Abandoned, failed, or unpaid checkout: the server-side order and photos are deleted after 7 days.
• Paid-order photos and production files: deleted 60 days after payment. A new upload may be required for a later remake.
• Legally required accounting and transaction records: retained for the Belgian statutory period, generally ten years starting on 1 January following the relevant year. Customer photos are not part of that long-term archive.
• Support and complaint records: normally up to two years after the matter is closed, unless longer retention is needed for a legal claim.
• Marketing email and consent record: kept until you unsubscribe or withdraw consent. A limited suppression record may then be retained so that we do not contact you again by mistake.
• Security records: retained only for the limited period needed to investigate security and reliability issues.

Deletion also removes the source image, preview, thumbnail, and production copy controlled by Glimery. Copies already delivered to a customer's own email provider or device are controlled by that customer and provider.

Glimery uses browser-side storage only for functions requested by the visitor. IndexedDB holds the basket and its uploaded photo previews, while local storage holds delivery and language preferences. The checkout attempt identifier is kept in session storage to prevent duplicate orders.

These are functional technologies and are not used for advertising or visitor analytics. Glimery therefore does not currently place non-essential tracking cookies. You can remove this information through the basket controls or your browser settings. If analytics or marketing technology is introduced later, it will not be activated without the legally required information and consent.

Depending on the circumstances, you may request access, correction, deletion, restriction, or portability of your personal data, or object to processing based on legitimate interests. You may withdraw consent where a future activity is based on consent. Withdrawal does not affect earlier lawful processing.

Send a request to support@glimery.be. Include enough information to locate the order, but do not send a copy of an identity document unless Glimery specifically and justifiably asks for additional identity verification. We normally respond within one month.

You may also lodge a complaint with the Belgian Data Protection Authority. We would still appreciate the opportunity to resolve the concern directly first.

Glimery uses HTTPS in production, restricted administrative access, private storage, secret order-access tokens, short photo-retention periods, supplier access controls, and backups appropriate to the information involved. No online system can promise absolute security.

Suspected loss, unauthorised disclosure, or access to customer photographs is treated as a personal-data incident. Glimery records and assesses incidents and notifies the competent authority and affected people when the GDPR requires this.

The controller responsible for the personal data processed through Glimery is:

No data protection officer has been appointed. Privacy questions and requests can be sent directly to the email address above.

This statement is reviewed when the webshop, suppliers, purposes, or retention periods change. Important changes will be communicated before they take effect where required. The version and date at the top identify the statement that applies.

Questions can be sent to support@glimery.be.