Privacy policy

Last updated: 26 October 2026

This policy explains how we collect and use personal data when you visit our online shop, buy from us or contact us.

1. Who is responsible for your data

The data controller is Taffrail Press, CVR 45497305, a Danish sole proprietorship. You'll find our postal address in our Legal notice.

Email: sales@taffrailpress.com

We can't be reached by phone; we answer email within 2 business days.

2. What data we use, why, and on what legal basis

What	Data	Why	Legal basis (GDPR)
Your order	Name, delivery and billing address, email, phone number, items ordered, order history, payment status	To take, print, ship and support your order and handle returns, withdrawals and complaints	Contract (Art. 6(1)(b))
Personalised logbooks	The text you give us (e.g. boat name, home port, your name) and your proof approval	To make your personalised copy	Contract (Art. 6(1)(b))
Payment	Payment method and transaction details. Card details are handled by Shopify Payments; we never see your full card number	To take payment and make refunds	Contract (Art. 6(1)(b))
Accounting	Order and payment records, invoices	To keep the records the Danish Bookkeeping Act (bogføringsloven) requires	Legal obligation (Art. 6(1)(c))
Messages and withdrawals	Your emails, messages sent through our contact and Cancel your order forms, and our replies	To answer you and to document withdrawals and complaints	Contract (Art. 6(1)(b)) and our legitimate interest in handling and documenting enquiries and legal claims (Art. 6(1)(f))
Security and fraud prevention	IP address, device and browser data, checkout data	To keep the shop and payments secure	Legitimate interest (Art. 6(1)(f))
Marketing emails	Email address, your consent record (when and how you signed up), and whether you open or click our emails	To send you occasional emails about new logbooks and offers	Consent (Art. 6(1)(a))
Customer review invitations	Name, email address and order reference	To send a one-off invitation to review your purchase on Trustpilot after delivery	Legitimate interest in collecting genuine customer feedback (Art. 6(1)(f)); you can object/opt out at any time
Cookies that aren't strictly necessary	See section 6	Analytics and preferences	Consent (Art. 6(1)(a))

You need to give us your name, address, email and phone number to place an order, because we can't print and deliver it without them. Everything else is optional.

Marketing emails. We send occasional marketing emails (for example about new logbooks and offers) through Shopify Email, and only to people who have opted in through our newsletter signup or the tickbox at checkout. When you sign up, we send you an email asking you to confirm your subscription (double opt-in), and we only send marketing after you confirm. The legal basis is your consent (GDPR Art. 6(1)(a)). Every email has an unsubscribe link, and you can also withdraw your consent by emailing sales@taffrailpress.com. Withdrawing your consent doesn't affect processing that took place before. We keep your email address on our marketing list until you unsubscribe. Shopify processes this data for us as our data processor.

Customer review invitations (Trustpilot). After your order has been fulfilled and delivered (normally 24 days after order fulfilment), we may send you a one-off, neutral email through the Trustpilot integration inviting you to review your purchase on Trustpilot, or you can use the Trustpilot link on our website directly. For post-purchase review invitations we share your name, email address and order reference with Trustpilot A/S (Pilestræde 58, 5., 1112 København K, Denmark, CVR 30276582) as our data processor. The legal basis is our legitimate interest in collecting genuine customer feedback (GDPR Art. 6(1)(f)), or your consent where required. You can object to or opt out of review invitations at any time—before or after an order—by emailing sales@taffrailpress.com.

We don't use automated decision-making or profiling that has legal or similarly significant effects on you.

3. Who we share your data with

We use these service providers. They process data on our behalf and under our instructions (data processors), unless stated otherwise:

Provider	What they do	Data	Location
Shopify (Shopify International Limited, Ireland, and its group companies)	Hosts our shop and checkout, sends order emails and our marketing emails (Shopify Email), runs the cookie banner	All shop, order and customer data	EU, Canada, USA and other countries (see section 4)
Shopify Payments (with its payment partners, e.g. Stripe)	Processes card and other payments	Payment and order data	EU, USA and other countries
Lulu Press, Inc., Durham, North Carolina, USA	Prints your book and ships it to you from its print sites	Name, delivery address, phone number, email, items, personalisation text	USA and print sites in other countries
Zoho (Zoho Mail)	Our email inbox for sales@taffrailpress.com	Your emails and our replies, form messages forwarded from the shop	USA (Zoho Corporation, see section 4)
Trustpilot A/S, Pilestræde 58, 5., 1112 København K, Denmark (CVR 30276582)	Sends post-purchase review invitations on our behalf (data processor) and hosts reviews on trustpilot.com	Name, email address, order reference	Denmark / EU

Shopify, its payment partners, the carriers that deliver your parcel, and Trustpilot A/S (once you choose to submit a review on trustpilot.com) may also use some data as independent controllers, for example to prevent fraud, meet financial regulations, deliver the parcel or publish your review under their terms. Their own privacy policies apply to that use.

We also share data with authorities, our accountant or advisers where the law requires it or where it is needed to establish or defend legal claims. We never sell your data.

4. Transfers outside the EU/EEA

Some of our providers are outside the EU/EEA:

Lulu Press, Inc. (USA) is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection (Decision (EU) 2023/1795). When your book is printed and shipped from a site outside the EU, or delivered to the United States, the transfer is also necessary to perform your order (GDPR Art. 49(1)(b)).
Shopify transfers data to Canada (covered by an EU adequacy decision) and to the USA and other countries under the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
Zoho Corporation (USA) stores our email inbox in its US data centre. The transfer relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in Zoho's data processing agreement.

You can ask us for more information about these safeguards.

5. How long we keep your data

Orders and accounting records: 5 years from the end of the financial year they belong to, as the Danish Bookkeeping Act requires.
Emails, form messages and withdrawal requests: as long as needed to handle the matter, and then up to 3 years so we can document it if a claim is made (the general Danish limitation period). Messages that are part of an order's accounting records are kept with that order.
Personalisation text: with your order record, for the same period. Our printer keeps print files according to its own retention rules.
Cookie consent: as set out in the cookie banner.

6. Cookies

Our shop runs on Shopify, which uses cookies and similar technologies. Cookies that are strictly necessary for the shop to work (for example your cart, checkout and security) are always set. Other cookies, such as analytics and preference cookies, are only set if you accept them in our cookie banner. You can change or withdraw your consent at any time through the cookie settings link at the bottom of every page.

You can find details of the cookies Shopify uses at www.shopify.com/legal/cookies.

7. Your rights

Under the GDPR you have the right to:

get access to the data we hold about you;
have incorrect data corrected;
have your data deleted, unless we must keep it (for example for accounting);
have processing restricted;
object to processing based on our legitimate interests;
receive the data you gave us in a portable format;
withdraw your consent at any time, where we rely on consent. This doesn't affect processing before the withdrawal.

To use your rights, email sales@taffrailpress.com. We reply within one month.

8. Complaints

If you're unhappy with how we handle your data, please contact us first. You can also complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or to the data protection authority in the EU country where you live.