Privacy
This page explains what personal data we handle when you visit surfhaunts.com or buy a print through its “Buy now” buttons, why we handle it, who else is involved and what you can ask us to do. Last updated 24 October 2026.
Who is responsible
The data controller
Surf Haunts is run by C Projects · Rosenborggade 19, 1130 Copenhagen K, Denmark · CVR 27834167. We are responsible for the personal data described here. For anything about your data, write to contact@oldhauntsstudio.com.
Orders on Etsy
If you buy one of our prints on Etsy instead, Etsy handles the purchase under its own privacy policy. This page covers orders placed on surfhaunts.com.
When you browse the site
Hosting
The site is hosted by Cloudflare. To deliver pages and protect the site, Cloudflare processes technical data such as your IP address, the page requested and your browser type, on our behalf. Cloudflare describes its role in Cloudflare’s privacy policy.
Visitor statistics
We use Umami to count visits and see which pages and prints people look at. Umami works without cookies. It records the page, the referring site, browser, device type and an approximate country, and Umami says it does not store visitors’ IP addresses in its analytics records. When you click “Buy now”, we also record which print, region, size and price you chose, without your name or email. We do this because we have a legitimate interest in knowing what works on our own site.
Fonts
Our pages load their typefaces from Google Fonts. Your browser then connects to Google’s servers, so Google receives your IP address and browser details under Google’s privacy policy.
Cookies
We don’t set any cookies of our own on surfhaunts.com. Services we hand you over to, such as Stripe on its payment page, may use their own cookies under their own policies.
Links to other sites
Links to Etsy, Instagram, Pinterest and the sources we cite open those sites, which then handle your visit under their own policies.
When you buy a print
Payment
Payment happens on a Stripe checkout page. Stripe collects your card or wallet details; we never see your full card number. From Stripe we receive your name, email address, delivery address, what you bought, the amount and whether the payment went through. For most of this Stripe works on our behalf, but it also uses some data for its own purposes, such as fraud prevention, and for its Link service if you choose to save your details with Stripe. Stripe explains this in Stripe’s privacy policy.
Making and delivering your print
Prints are made and shipped by our production partner Printful. When your payment has gone through, we place the order with Printful and give it your name, delivery address and the details of your order, so it can print the poster and hand it to a carrier. We don’t give Printful your email address. Printful works on our behalf under a data processing agreement and describes its own practices in Printful’s privacy policy.
Emails about your order
We use your email address to send you a shipping notice and to answer you if you write to us. Printful doesn’t get your email address from us, so the shipping notice comes from us. Emails to contact@oldhauntsstudio.com pass through Cloudflare’s email routing on the way to our mailbox; Cloudflare says that its email routing does not store or access message content. Our mailboxes, the tool we use to read and answer customer emails, and the emails we send you are run by service providers on our behalf. We keep the correspondence so we can handle your order, a return or a complaint.
Why we may do this
We handle order data because we need it to fulfil our contract with you (Article 6(1)(b) of the GDPR), and we keep accounting records because Danish law requires it (Article 6(1)(c)).
Transfers outside Europe
Where the data goes
Some of the services above process data outside the EU and EEA, including in the United States. Where that happens, the transfer relies on the EU–US Data Privacy Framework or the EU’s standard contractual clauses, as each provider sets out in its own terms.
How long we keep data
Order and accounting records
Danish bookkeeping rules require us to keep accounting records, including order and payment records, for five years from the end of the financial year they belong to.
Everything else
We keep emails and other order details only as long as we need them to handle your order, a return or a complaint. Data held by Stripe, Printful, Cloudflare, Umami, Google and our email and customer-service providers is kept under each provider’s own retention rules.
Your rights
What you can ask us
You can ask to see the personal data we hold about you, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable format. Where you gave consent, you can withdraw it at any time; that doesn’t affect what was done before. Write to contact@oldhauntsstudio.com. Some data we must keep by law, such as accounting records, even if you ask us to delete it.
Complaints
If you think we handle your data wrongly, you can complain to the Danish Data Protection Agency, Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, or to the data protection authority where you live. We’d appreciate the chance to sort it out with you first.