MDULAR

Legal

Privacy

Last updated · May 2026

This statement explains how MODULAR processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation).

Controller

Marcus Rojas, Triq il Kartia 100, Victoria VCT 1012, Gozo, Malta. Contact: hello@modularprint.com. No data protection officer is appointed; the operator does not meet the thresholds of Art. 37 GDPR.

Scope

This statement covers the website modularprint.com and the systems used to fulfil card purchases through it. It does not cover anything you do off-site, including the websites of providers we link to.

What we collect, why, and on what legal basis

  • Visiting the site. Your browser sends an IP address, a user-agent string, and the URL you requested. Our hosting provider records this in standard access logs for up to 30 days, used to detect abuse and keep the site online (Art. 6(1)(f) GDPR — legitimate interest in operating the service securely).
  • Adding to cart.Cart items are stored in your browser’s localStorage. They never leave your device unless you proceed to checkout. This is local storage, not a server-side processing.
  • Checking out. To print and ship a card we need your name, postal address, email address, phone (if you give one to the carrier), and payment details. Payment details are collected and held by Stripe; we receive only the transaction reference and the last four digits of the card. Legal basis: Art. 6(1)(b) GDPR — performance of the sales contract.
  • Optional account. If you create an account, we keep your email address and an auto-generated display name for the duration of the account. Legal basis: Art. 6(1)(b) GDPR.
  • Sending you order email. Order confirmation, shipping and delivery notifications go to the email address on the order. Legal basis: Art. 6(1)(b) GDPR.
  • Statutory records. Invoices and accounting records are kept for ten years. Legal basis: Art. 6(1)(c) GDPR — compliance with a legal obligation under Maltese tax and commerce law.

Processors

We use the following processors strictly to operate the site and fulfil purchases. Each has its own privacy statement at the linked address.
  • Vercel Inc. — hosting and access logs. Policy.
  • Neon Inc. — database hosting (EU region). Policy.
  • Cloudflare, Inc. — storage of work files (R2) and DNS. Policy.
  • Stripe Payments Europe, Ltd. — payment processing. Policy.
  • Gelato AS — printing and shipping fulfilment. Policy.
  • Resend, Inc. — transactional email. Policy.

Transfers outside the EU

Some of our processors (Vercel, Cloudflare, Stripe US entities, Resend) are headquartered in the United States. Personal data may be transferred to the US under the EU–US Data Privacy Framework, supplemented by Standard Contractual Clauses where applicable. We do not transfer data to any country without an adequacy decision or appropriate safeguards.

Cookies and similar technologies

The site uses a single technical cookie to keep you signed in if you create an account. It is set only after sign-in. We do not use analytics, advertising, tracking pixels, fingerprinting, or third-party beacons. Therefore no consent banner is shown — none is required under Art. 5(3) ePrivacy Directive for strictly necessary cookies.

Retention

Server access logs: up to 30 days. Account data: until the account is deleted on request. Order and invoice records: ten years to satisfy Maltese accounting law. Email delivery logs at Resend: as set out in the Resend retention policy, typically 30 days.

Your rights

Under Articles 15–22 GDPR you have the right to request access, rectification, erasure, restriction of processing, data portability, and to object to processing. Write to hello@modularprint.com and we will respond within one month. Statutory retention obligations on invoices may limit erasure for order data; we will tell you which records we cannot delete and why.

Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular the Maltese Information and Data Protection Commissioner or the authority in your country of residence.

Changes to this statement

We will revise this statement when our processors, retention periods, or processing purposes change. The date below reflects the most recent revision.