Privacy Policy
Last updated: 20 september 2026
This policy describes how 11section handles personal data in connection with https://11section.com, customer orders and enquiries. It is intended to reflect the GDPR and applicable Portuguese law. It must describe the store’s actual operation, not merely its intended configuration.
1. Controller and contact
The controller is 11section, based in Portugal.
Privacy contact: support@11section.com
2. Data and sources
We receive information you enter at checkout, in personalisation fields, and in communications:
- Name, contact details, billing and delivery addresses, and tax details where supplied for invoicing. Customer accounts are not currently offered; purchases use guest checkout.
- Ordered products, selected name and number, previews for physical Your name orders, approvals and correction requests.
- Payment status, refund information and transaction references supplied by payment providers. Card credentials are handled through the selected payment service.
- Correspondence and any photographs supplied to support an order issue.
- Recipient details when a purchaser sends a gift to another person. These come from the purchaser and are used for fulfilment, not automatically for marketing.
- Technical data such as IP address, device/browser information and security logs needed to operate the store. Optional analytics and advertising data depend on the services and permissions described below.
Mandatory checkout fields are needed to process the order. Without essential billing, delivery or contact information, we may be unable to fulfil it. Optional marketing consent is not required to purchase.
3. Purposes and legal grounds
| Purpose | Data used | Legal ground |
|---|---|---|
| Fulfil orders, personalise artwork, send physical or digital personalisation previews and digital download links, handle delivery and support | Contact, order, personalisation and correspondence data | Contract for the customer; legitimate interests in fulfilment for nominated gift recipients |
| Take payments and issue refunds | Transaction, billing and order data | Contract and applicable legal obligations |
| Keep legally required invoices and records | Necessary billing, tax and transaction information | Legal obligation |
| Secure the store, prevent fraud and deal with claims | Necessary technical, transaction and communication records | Legitimate interests and relevant legal obligations |
| Send optional marketing, if offered | Subscription details and preferences | Consent, withdrawable at any time |
| Optional analytics and advertising, if enabled | Permitted browsing/event and identifier data | Consent where required |
Our relevant legitimate interests are fulfilling requested gifts, protecting the store and customers, preventing misuse and resolving disputes. We balance them against individuals’ rights. Optional advertising is not treated as necessary to fulfil a purchase.
4. Service providers and recipients
Only the data needed for the relevant service should be disclosed. Production and delivery can require the recipient’s name, address, order and artwork; providers do not need a customer’s full payment-card details.
| Recipient/category | Purpose and relevant information | Status to confirm |
|---|---|---|
| Production/printing partners and carriers | Produce and deliver the poster; necessary recipient, shipping and personalisation data | Confirm contracted legal entities, countries and data sent |
| Stripe and PayPal, according to checkout method | Payments, refunds and fraud prevention; necessary transaction and billing data | Confirm integrations and merchant entities; Apple Pay/Google Pay routing |
| Hostinger; WordPress/WooCommerce store with Elementor | Hosting, store operation and page building; order, form and technical data according to the features used | Confirm server region, backups and any Elementor cloud/form services or connected extensions |
| Transactional email and digital-file hosting providers | Send receipts, previews, support replies and download links | Confirm services, access controls and storage countries |
| Google Analytics for WooCommerce — plugin active in supplied screenshot | Permitted analytics events and identifiers | Actual connection, events, consent behaviour and retention still require settings verification |
| Meta for WooCommerce — plugin active in supplied screenshot | Permitted advertising measurement/events and identifiers | Confirm actual connection, Pixel, Conversions API, matching and audience features separately |
| Newsletter/review/accounting/security providers, if used | Only data needed for the selected function | Identify actual services or remove this row |
| Professional advisers or authorities where necessary | Legal, accounting and regulatory matters | Disclose only as required or justified |
WordPress and WooCommerce are store software; their use alone does not establish that every order is transmitted to a separate WooCommerce company. Connected extensions must be assessed individually.
5. International transfers
A provider’s international presence does not itself establish that a specific transfer is covered by safeguards. Where required, transfers need an applicable adequacy decision or appropriate safeguards, such as executed Standard Contractual Clauses with any necessary supplementary measures. We have not asserted that those arrangements are already verified.
6. Cookies and advertising controls
Essential technologies support requested functions such as the basket, checkout, authentication and security. Optional analytics and advertising require the applicable consent before activation.
We use Complianz to manage cookie-consent choices.
Suggested customer wording once verified: “You can accept or reject optional analytics and advertising through our cookie controls and change your choices at any time using Cookie settings. Rejecting optional cookies does not prevent you from purchasing.”
7. Retention
We retain data only for a defined purpose and delete or anonymise it when no longer needed, subject to legal obligations and justified preservation for disputes.
| Category | Retention criterion / confirmation needed |
|---|---|
| Invoices and statutory records | Applicable Portuguese statutory period; confirm the exact period and start date with the accountant. Do not apply it automatically to all artwork and browsing data. |
| Order and support records | Necessary for fulfilment, applicable remedies and disputes; confirm the operational deletion schedule. |
| Personalised artwork, previews and delivered files | Download links have no expiry and downloads are unlimited. Confirm how long final files and access records must be retained to support that commitment, separately from working files and previews. Storage/delivery service is not yet selected. |
| Customer accounts | Not currently offered. Order data is still collected through guest checkout. |
| Marketing, if offered | Until consent is withdrawn or the defined inactivity period; retain only justified suppression/consent evidence afterwards. |
| Analytics and advertising | Exact configured retention, separately from cookie expiry; remove the previous unverified “up to 24 months” figure. |
| Security logs and backups | Confirm log retention and backup rotation/deletion cycle. |
8. Your rights
Subject to the applicable conditions, you may request access, correction, erasure, restriction or portability of your data. You may object to legitimate-interest processing and to direct marketing. You may withdraw consent without affecting processing lawfully carried out before withdrawal.
Email support@11section.com. We may request proportionate information to verify identity. We normally respond within one month. Where an extension is legally permitted because a request is complex or numerous, we will explain it within that first month. Exercising rights is normally free.
You may complain to the Portuguese supervisory authority, CNPD, at https://www.cnpd.pt, or another competent supervisory authority. Contacting us first is not a condition for a complaint.