Privacy and Confidentiality Policy

• The Company or Tamm: the company named above and its affiliates, and every digital channel it runs to deliver its services, including websites, dashboards, programming interfaces and applications.
• The Services: manufacturing, print-on-demand, storage, order preparation, shipping and returns handling services and the digital tools that go with them.
• The Client: any natural or legal person who opens an account with the Company or requests its services.
• Sales Channel: any website, application or platform through which the Client sells to its own customers and which it connects to its account with the Company.
• The Recipient: the person who buys from the Client through a Sales Channel and to whom an order is shipped.
• The Visitor: anyone who browses the Company’s websites without an account.
• Personal data: any data relating to an identified or identifiable person, directly or indirectly.
• A Provider: any third party the Company engages to deliver its services.

• Client and Visitor data: the Company is the controller and determines the purposes and means of processing.
• Recipient data: it reaches the Company from the Client or its Sales Channel, and the Company processes it on the Client’s behalf as a processor, for the sole purpose of executing, shipping and handling the returns of orders. The Client is the controller of that data and is responsible for the lawfulness of collecting it and for informing Recipients that it is shared with fulfillment and shipping providers.

• Client account data: name, phone number, email, entity name and its commercial registration or freelance document, VAT number, address, and encrypted credentials.
• Payment data: payment cards are processed by a licensed payment provider. Full card details never reach the Company; when a Client chooses to save a card, we keep a reference token, the card type, the last four digits and the expiry date.
• Connection data: the tokens and permissions a Sales Channel grants to the Client’s account, encrypted, and the product and order data received through it.
• Recipient data: name, phone number, shipping address and order details, to the extent that preparing and shipping the order requires.
• Content: the designs, files and images the Client uploads for printing.
• Technical data: IP address, device and browser type, cookies, usage logs, and session recordings on the Company’s websites for improvement and security.
• Correspondence: what a Client or Visitor sends through the contact, request and application forms.

We process data to:

• Open the account and verify identity and eligibility.
• Execute orders: manufacturing, printing, storage, preparation, shipping and returns, and print the Recipient’s name and address on the shipping label.
• Manage the wallet, fees, invoices and monthly statements.
• Run the connections with Sales Channels and update products, orders and shipping statuses in them.
• Communicate with the Client about its account, orders and notifications.
• Improve, measure and secure the Services and prevent fraud.
• Comply with legal, accounting and tax obligations.
• Market the Company’s services to the Client, with the option to unsubscribe at any time. We never market to Recipients.

We share data, to the extent necessary, with:

• Carriers and delivery companies: the Recipient’s name, address, phone number and shipment details.
• Payment providers and banks: to process wallet top-ups and automatic charges.
• Sales Channel platforms: product, order and shipping status updates, within the permissions the Client granted.
• The domain registrar and the registry of the ending: when the Client buys a domain through the dashboard, we share the store owner’s name, email address, verified phone number and the store’s address with an ICANN-accredited registrar that registers the domain, and with the registry of the domain’s ending, to the extent the registration requires, including the deposit of registration data with an escrow agent and the registrar’s obligations to ICANN. This data may be processed outside the Kingdom, and its processing by the registrar is also governed by the Domain Registration Agreement.
• AI model providers: when the Client uses the agent, the store builder or the Studio, we send the inputs and files needed to deliver the requested Service only. This data may be processed outside the Kingdom.
• Hosting, infrastructure, analytics and support providers, contractually bound to protect the data.
• Advertising partners (Meta, TikTok, Snapchat, Google and OpenAI): to measure and improve the performance of the Company’s own advertising, as described in section 9. This data may be processed outside the Kingdom.
• Public authorities: on a lawful request, or on suspicion of unlawful activity such as fraud, money laundering or data misuse.
• Affiliates: to run the Services, align policies and comply, all bound by this policy.

• We apply technical and organisational measures to protect data, including encryption in transit and at rest for sensitive data, need-based access restriction, and access logging.
• Passwords are stored hashed, connection tokens are encrypted, and full card details are never stored with us.
• In the event of a breach affecting personal data, we notify the competent authorities and the affected data owners as the law requires.

• Account data: for as long as the account exists, then for the period accounting and tax rules require.
• Recipient data: for the time it takes to execute the order and handle its returns and the statutory period for keeping shipping records, after which it is deleted or anonymised. The Client may request earlier deletion unless the law prevents it.
• Connection data: until the connection is removed, after which the tokens are deleted.
• Correspondence and requests: a reasonable period for replying and following up.

A data owner has, under the law:

• The right to know how their data is processed.
• The right to access their data and obtain a copy of it.
• The right to correct, complete or update their data.
• The right to request the destruction of their data when it is no longer needed, unless the law prevents it.
• The right to withdraw consent for processing based on consent.
• The right to lodge a complaint with the competent personal data protection authority in the Kingdom.

• The Client confirms the accuracy of the data it provides and keeps it up to date.
• The Client ensures that collecting Recipient data and sharing it with the Company is lawful and consistent with the privacy policy published in its Sales Channel.
• The Client will not misuse any data it sees through the Company’s services.