Privacy Policy

Account and order data

We process the information needed to create and manage your account, fulfil orders and provide our services.

This may include your email address and sign-in information, contact details, order items and prices, delivery or collection details, address where required, order notes and order status.

For laboratory and zine orders, we also process the film instructions, uploaded photographs, layout information and production files needed to provide the service you selected.

Please only upload photographs, files or other material that you are entitled to submit.

Order and service messages are separate from marketing communications.

Why we use your information

We process personal data where it is necessary to:

• provide your account, order or requested service;
• take steps at your request before entering into a purchase or service contract;
• process payments, refunds, deliveries and collections;
• communicate with you about an order or service;
• keep records required by law;
• protect the security of our website, services and systems and prevent fraud or misuse;
• respond to requests, complaints and legal claims; and
• provide optional analytics or separately requested marketing where you have given consent.

Where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect processing that was lawful before the withdrawal.

Information required for account access, order fulfilment, payment or legal record-keeping may be necessary to provide the relevant service and cannot always be deleted immediately.

Scan delivery via WeTransfer

We deliver scans through WeTransfer.

The download link supplied by QWERTY is normally available for one month after it is sent. Download your scans and keep your own backup within that period.

QWERTY does not provide ongoing scan storage.

The link availability period is our delivery setting and does not mean that WeTransfer necessarily deletes all related files or backups at the same time. WeTransfer's own retention and deletion rules apply to its service.

WeTransfer may process or store transferred files in the EU or US depending on the circumstances of the transfer and its applicable service configuration.

Payments and Bank of Georgia

Online payments are processed through Bank of Georgia's hosted payment page.

The payment provider receives the transaction amount, currency, order reference and other information required to process the selected payment. You enter card details and banking authentication information on the bank's hosted page.

QWERTY receives payment identifiers and transaction status needed to confirm the order and process refunds. We do not store your full card number or CVV.

Bank of Georgia processes payment and banking information under its own terms and privacy documentation.

QWERTY keeps the order and payment information needed for fulfilment, reconciliation, customer support and applicable legal or accounting records.

Returning to the QWERTY website from the bank does not itself establish that a payment succeeded.

Necessary storage and language

A secure session cookie supports account sign-in.

Browser storage may remember your shopping bag, Zine Builder drafts and an unfinished checkout attempt so that you can continue the process or retry it.

The first-party qfl_locale cookie remembers your EN or ქართული language choice for up to one year on each application.

You can change your language at any time.

We also retain information associated with your purchase, including the version of the purchase terms accepted, acceptance time and any separate request to begin a service before the withdrawal period ends.

Clearing cookies or browser storage does not delete a submitted order or files already stored on our servers.

Analytics choices

Vercel Web Analytics provides aggregated website measurement without using analytics cookies. It may process information such as visited page URLs, referring pages, browser and device information and approximate location derived from technical data. Vercel's own privacy terms also describe collection of device, IP and location information in connection with its services.

Google Analytics is optional and is used only after you give the required consent. Where enabled, it helps us understand website visits and limited commerce activity, including product identifiers, quantities and order value.

Advertising storage and personalised advertising are disabled.

Optional analytics event data does not include your payment card details. We also do not intentionally send your contact details to Google Analytics as part of commerce events.

Your optional analytics choice is remembered for up to 180 days. You can change it through Cookie settings.

Refusing or withdrawing optional analytics consent does not prevent you from shopping, signing in or paying.

Our Cookie Policy explains the cookies and browser storage used by the website and how you can manage them.

Service providers and data sharing

We use service providers where necessary to operate the website, fulfil orders and provide requested services.

These may include providers for:

• website hosting and infrastructure;
• email delivery;
• file transfer and scan delivery;
• payment processing;
• delivery and courier services;
• website analytics; and
• other technical services required to operate the shop and laboratory.

Resend delivers transactional and, where separately requested, marketing emails on our behalf. Resend states that customer data is stored in the United States and that applicable international transfers are covered by its data-processing safeguards.

Delivery providers receive the contact and address information necessary to complete your selected delivery.

Payment providers receive the information necessary to process the transaction.

Service providers may process personal data outside Georgia. Where required by applicable law, we use appropriate contractual, organisational or other safeguards for such transfers.

We do not sell your personal data.

Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to:

• provide accounts and services;
• complete and support orders;
• maintain required business, tax and accounting records;
• establish, exercise or defend legal claims;
• maintain security and prevent fraud or misuse; and
• comply with legal obligations.

Different information may therefore be retained for different periods.

Account, order, payment, consent, support, scan and production data may remain available for different periods depending on its purpose and applicable legal or operational requirements.

When information is no longer required, we delete it, anonymise it or otherwise dispose of it where reasonably practicable.

Clearing a browser draft does not delete a submitted order or server-side files.

Your rights and enquiries

You may contact dev@qwertyfilmlab.com to ask about your personal data and, where applicable, request:

• information about how your data is processed;
• access to your personal data and a copy of it;
• correction of inaccurate data;
• deletion of data where there is no lawful reason to retain it;
• restriction of processing where applicable;
• transmission of data in a structured, commonly used and machine-readable format where the legal requirements for this right are met;
• withdrawal of consent where processing is based on consent; or
• objection to processing where the law provides this right.

We may need to verify your identity before fulfilling a request.

Some requests may be limited where the law requires us to retain information or where another lawful basis for processing applies.

Under Georgian law, data subjects generally have the right to receive requested information and access or copies of their data within the applicable statutory period.

You may also complain to the State Audit Office of Georgia or seek judicial redress where applicable. Contacting QWERTY first does not prevent you from exercising your legal rights.

Updates to this policy

We may update this Privacy Policy when our services, processing activities or legal requirements change.

The current version published on this website applies from its stated effective date.