Privacy policy
Effective date: 2026-09-23
1. Controller and scope
MB „Mega Stock“, company code 307008515, Laisvės al. 110, LT-44253 Kaunas, Lithuania, is the controller for the MetalPic processing described here. Contact sales@metalpic.eu or +370 661 69115 about privacy matters.
This notice covers visitors, customers, delivery recipients, people contacting us and identifiable people depicted in submitted material. Reading the website or placing an order is not blanket consent to processing. We use the appropriate legal basis for each purpose under the General Data Protection Regulation (GDPR).
2. Data and sources
We receive names, contact and delivery details, the chosen pickup point, product specifications, order and payment references, payment status, correspondence and complaint information. Uploaded photographs, editing instructions, proofs and text may also contain personal data. Payment providers process the payment credentials; our checkout does not request your online-banking password or card security code by message.
Technical data may include IP address, browser/device information, security logs and identifiers needed to maintain a basket, protect uploads or verify a payment return. Optional audience or advertising information is processed only under the applicable consent choices and the Cookie policy.
Most information comes from you. Recipient details and photographs of other people can come from the customer placing the order. Where GDPR Article 14 requires us to inform those people, we do so within the applicable period; we do not assume that a customer's acceptance replaces this duty.
3. Purposes and legal bases
| Purpose | Data and legal basis |
|---|---|
| Prepare and fulfil your order, communicate about a proof and delivery | Necessary customer and order data; GDPR Article 6(1)(b), contract or requested pre-contractual steps |
| Fulfil an order involving a different recipient or depicted person | Necessary third-person data; Article 6(1)(f), legitimate interests in carrying out the requested delivery or print, subject to necessity and balancing of that person's rights |
| Invoices, tax and legally required records | Necessary accounting data; Article 6(1)(c), legal obligation |
| Security, fraud prevention and establishing or defending claims | Necessary technical and dispute records; Article 6(1)(f), legitimate interests in protecting the service and legal rights; Article 6(1)(c) where a legal obligation applies |
| Optional marketing messages, non-essential tracking or publication of customer photos | Article 6(1)(a), separate consent where used; not a condition of purchase |
Required checkout data is necessary to fulfil the order. Without information needed for payment, preparation or delivery, we may be unable to complete it. Optional consent can be refused without losing access to ordinary purchasing functions.
4. Photographs, editing and publication
Submit only material you are entitled to use and avoid unnecessary sensitive information. A normal photograph is not automatically biometric data used for identification. If material reveals special-category data, or a proposed processing operation requires an additional legal condition, we assess that before proceeding. Children's photographs require particular care and appropriate authority from the person submitting them.
Access to order photographs is limited to people and providers who need it for the agreed purpose. Ordering does not authorise public portfolio use, advertising or AI-model training. Publication requires a separate, specific permission where appropriate. Refusing publication does not affect the purchase.
The actual editing tools, any external AI processing, provider locations and applicable processing safeguards are described here:
We prepare photographs using professional image-editing tools, including Adobe Photoshop, and AI-assisted tools where the customer orders or requests the relevant processing. Where a particular edit requires an external technology provider, we share only the material necessary to perform the requested service.
A purchase does not by itself authorise us to use customer photographs for advertising, a public portfolio or training our own models. A customer photograph or finished artwork is published only after separate permission, normally retained in written communications (for example WhatsApp, Viber, Messenger or another agreed channel).
5. Recipients and providers
Necessary information may be shared with hosting and IT providers, authorised photo-processing providers, payment providers, delivery carriers, accountants, professional advisers and authorities where legally required. Paysera is the current payment service; LP Express/UNISEND and DPD fulfil applicable deliveries. Carriers do not need the customer's print file merely to transport a parcel.
A provider acting on our instructions is subject to the required processing agreement. Providers that determine their own purposes, such as certain payment or delivery services, may act as independent controllers and provide their own notices. We do not treat every software name as a recipient or every provider as a processor.
Current providers, roles, processing locations and material recipient details:
Main recipient categories include hosting and IT infrastructure providers; Paysera for payments; LP Express/UNISEND and DPD for delivery; accounting services and software; image-processing and AI technology providers where required for the service ordered; and Google services (Google Analytics, Google Ads and Google Tag Manager), Meta Pixel and TikTok Pixel only to the extent those non-essential technologies are activated after the required consent.
6. International transfers
Where data is transferred outside the EEA, we identify the relevant transfer and use an applicable lawful mechanism, such as an adequacy decision or standard contractual clauses with any required supplementary measures. We do not claim that all processing remains in the EU unless that has been established. The provider details above identify the applicable arrangements. You can ask sales@metalpic.eu about the safeguards and how to obtain a copy where applicable.
7. Retention
Personal data is kept no longer than reasonably necessary for the relevant purpose. We do not apply one automatic deletion date to order photographs, but this does not mean they are kept indefinitely merely because the customer has not asked for deletion.
- Abandoned uploads without an order: are technically removed, normally after approximately 7 days.
- Original and processed photographs / proofs for an order: are retained in a protected system for as long as reasonably necessary to manufacture and fulfil the order, support possible reprints, deal with quality issues, provide customer service and handle concrete legal claims. The need for continued retention is reviewed periodically.
- Deletion at the customer's request: a request may be sent to sales@metalpic.eu. Where there is no legal obligation or other overriding reason to retain the specific file, a valid deletion request will be actioned.
- Order, payment and accounting records: according to applicable requirements; relevant VAT and related accounting records for 10 years where applicable.
- Analytics, advertising and cookie choices: according to the actual consent configuration.
- Backups: according to the normal backup rotation cycle.
8. Your rights
Subject to the applicable legal conditions, you can request access, correction, erasure, restriction and portability of data processed automatically on consent or contract. You can object to processing based on legitimate interests, and object to direct marketing at any time. You may withdraw consent as easily as you gave it; withdrawal does not affect the lawfulness of earlier processing.
Send a request to sales@metalpic.eu. We may ask only for proportionate information needed to verify identity. We respond without undue delay and normally within one calendar month. For complex or numerous requests, this may be extended by up to two further months; we explain the extension within the first month. Requests are normally free, subject to statutory exceptions. Erasure does not override a duty to retain necessary legal records.
You may complain to Lithuania's State Data Protection Inspectorate (VDAI), vdai.lrv.lt, or the competent supervisory authority in your country, and seek a judicial remedy.
9. Security and automated decisions
We use proportionate access controls, protected storage and technical and organisational safeguards. No system is absolutely risk-free. We handle incidents and notify affected people and authorities where legally required.
Routine validation of checkout fields and calculating a price from selected options are not claims about profiling a person's creditworthiness. Before introducing solely automated decisions with legal or similarly significant effects, we must provide the required information about the logic, significance, safeguards and rights; such a process is not authorised merely by this notice.
10. Changes and related choices
A new purpose or provider is assessed before use, with updated information and fresh consent where required. Changes do not retrospectively authorise earlier processing. Cookie choices, marketing consent and permission to publish photographs are separate. See the Cookie policy and Purchase terms.