Privacy Policy
Effective from 11 September 2026. This notice replaces the privacy policy of 1 January 2014.
1. Who we are
The controller of your personal data is CO2Art Technologies Limited, a company registered in Ireland under company number 658258, registered office Suite 2, Cathedral Buildings, Middle Street, Galway, H91 ERD1, Ireland, VAT number IE3647876IH. You can reach us at support@co2art.eu or by post at the address above.
This notice covers the online store at www.co2art.eu and its language mirrors (for example de.co2art.eu, co2art.pl, co2art.fr), our customer accounts, our e-mails and our customer support. Our trade (B2B) store and our US store have their own notices.
2. What we collect and why
We only collect what we need to sell you our products, keep you informed and run the store. The legal bases under the GDPR are given in brackets.
- Orders and delivery — your name, delivery and billing address, e-mail address, phone number, what you bought and how you paid. We need this to fulfil your order, deliver it, issue invoices and handle returns and warranty claims (performance of a contract; legal obligations such as tax and accounting law).
- Your customer account — your e-mail address, name, addresses and order history. Sign-in is handled by Shopify with a one-time code sent to your e-mail, or with Google, Facebook or Shop if you choose so; we never see a password. If you sign in with Google or Facebook, we receive only your name and e-mail address from them (performance of a contract).
- Customer support — the messages you send us by e-mail, chat or the contact form, and the details needed to answer them, such as your order number and photos of a product (performance of a contract; our legitimate interest in answering you well).
- Newsletter and offers — your e-mail address and, where you tell us, the topics you are interested in. We send these only with your consent, which you can withdraw at any time with the link in every e-mail (consent).
- Reviews — the name and review text you submit, together with your order, so that we can show verified reviews (consent; performance of a contract).
- Website use — technical data such as your IP address, browser, the pages you visit and, if you accept them, analytics and advertising cookies (our legitimate interest in a working and secure website; consent for analytics and advertising cookies).
- Fraud prevention and security — the data around an order and a payment that Shopify and our payment providers use to detect fraud (legitimate interest; legal obligations).
3. Who we share it with
We share personal data only with providers that help us run the store, and only for those purposes. They act on our instructions, except where they are independent controllers (payment providers, carriers and the social sign-in providers you choose).
- Shopify (Shopify International Limited, Ireland, and Shopify Inc., Canada) hosts the store, the checkout, the customer accounts and the order data, and provides Shopify Payments, Shop Pay, Apple Pay and Google Pay. Shopify's own privacy policy applies to the checkout and to payments.
- Payment providers shown at checkout process your payment. We never receive your full card number.
- Carriers such as FedEx and UPS receive your name, address, phone number and e-mail address to deliver your parcel and to send delivery notifications. For deliveries outside the European Union, customs authorities receive the data required by law.
- Our own order and customer systems, operated by us, hold order, delivery, warranty and support records so that our team can serve you across the store, the warehouse and customer service.
- Customer support tools — Re:amaze (chat and help desk). Part of our chat and e-mail support is answered by an AI assistant that we operate; to draft an answer it may process the content of your message with an AI service provider, Anthropic, under the EU Standard Contractual Clauses. A person from our team can always take over, and your message is never used to train those models.
- E-mail — our newsletters and service e-mails are sent through Amazon Web Services (Amazon SES, Ireland region). Before we send a newsletter we may check that an e-mail address can receive mail through Bouncer, an e-mail verification service based in the European Union. Sign-up forms and pop-ups on the site are provided by Privy.
- Reviews — Stamped collects and displays product reviews and sends review requests on our behalf.
- Order tracking — our "Track order" page looks up your order by its number and your e-mail address in our own order system and shows the carrier's tracking status.
- Affiliate programme — GoAffPro records that you arrived through an affiliate's link so that the affiliate can be paid a commission; it does not receive your name or address.
- Language versions — the translated mirrors of this store are served through GTranslate, which passes your page requests to the store.
- Analytics and advertising — Shopify Analytics, Google Analytics, Google Ads and Meta (Facebook and Instagram) receive usage and conversion data as described in section 5, only after you accept those cookies.
- Authorities and advisers where the law requires it, and a buyer of our business if it is sold.
Some of these providers are outside the European Economic Area, mainly in the United States and Canada. Where that is the case we rely on the European Commission's adequacy decisions (Canada; and the EU-US Data Privacy Framework for certified US providers) and on the EU Standard Contractual Clauses.
4. How long we keep it
- Orders, invoices and the related correspondence: for as long as tax and accounting law requires, in general 6 years after the end of the year of the order, and for as long as a warranty claim can be made.
- Your customer account: until you close it or after 3 years without an order or a sign-in.
- Newsletter data: until you withdraw your consent; we then keep only the record that you unsubscribed.
- Support conversations: 3 years after the last message, unless they belong to an order or a claim.
- Analytics data: according to the retention settings of the tools in section 5, at most 14 months for Google Analytics.
5. Cookies and similar technologies
When you first visit the store, a banner lets you accept or decline cookies that are not necessary. Your choice is recorded by Shopify's consent tool and respected by the analytics and advertising tags on the site. You can change it at any time by clearing the cookies of this site in your browser; the banner then appears again.
| Type | Cookies | Purpose and lifetime |
|---|---|---|
| Necessary | _shopify_essential, cart, cart_currency, localization, _shop_app_essential | Your session, your cart, your currency and country, secure checkout; set by Shopify; from the session up to one year. |
| Preferences | co2art_local_store | Remembers whether you chose a language version of the store or asked to stay on the English one, so that we do not ask again; one year; set only when you answer the language bar. |
| Preferences | concept:newsletter-popup | Remembers that the newsletter window has been shown; one year. |
| Analytics (with your consent) | _shopify_y, _shopify_s, _shopify_analytics, _ga, _ga_* | Shopify Analytics and Google Analytics: which pages are visited and how the store is used, in aggregate; up to 13 months. |
| Advertising (with your consent) | _shopify_marketing, _fbp, _gcl_au | Meta and Google Ads: measuring whether an advertisement led to an order and showing relevant advertisements; up to 90 days. |
| Third-party | _privy_*, _GRECAPTCHA | Privy pop-up forms (one year) and Google reCAPTCHA protecting our forms against bots (6 months). |
6. Your rights
You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format and to withdraw a consent at any time without affecting what was done before. You can see and change most of your data yourself in your customer account. For everything else write to support@co2art.eu; we answer within one month.
If you think we have not handled your data correctly you can complain to the Irish Data Protection Commission (www.dataprotection.ie) or to the supervisory authority of the country where you live.
7. Children
Our products and our marketing are meant for adults. We do not knowingly collect personal data from anyone under 16.
8. Security
The store, the checkout and our own systems use encrypted connections, access controls and regular backups. No method of transmission or storage is completely secure, so please keep your sign-in e-mail account safe and tell us at once if you suspect misuse.
9. Changes
We will post any change to this notice on this page with a new effective date. For material changes we will also tell customers with an account by e-mail.