We sell custom map artwork. To print something and post it to you we need your name, your address and the design you chose - and very little else. This page says exactly what we hold, why, who else sees it, and how to have it removed.
Who we are
Maps & Son is the data controller for the information described here. You can reach us at orders@mapsandson.com.
What we collect from Etsy, when you place an order:
Your order number, your name, and the delivery address you gave Etsy (street, city, county or state, postcode and country). Your email address, where Etsy makes it available to us.
From you, when you design your artwork:
The place you choose and its coordinates, the style, size, orientation and framing, any title, subtitle or date you type, and the position of any pin you drop. If you upload a GPX route file we keep the track and the distance, duration and elevation derived from it. You may optionally give us an email address so we can tell you before your artwork goes to print - this is never required, and leaving it blank does not affect your order.
If something arrives damaged:
What you tell us went wrong, and any photograph you send. Photographs are stored in a private location, never a public one, because a photograph of a damaged parcel routinely shows a doorstep, an address label or a person.
Automatically:
When you look up an order we record a one-way cryptographic hash of your IP address and whether the attempt succeeded, so nobody can guess their way into someone else’s order. We keep the hash, never the address itself. We also use privacy-preserving website analytics that set no cookies and identify nobody; the page address of your design link is stripped of its access code before anything is recorded.
Why, and on what legal basis:
To fulfil your order - name, address, design choices. Necessary to perform our contract with you.
To email you about your order - the grace period before printing, and problems. Contract, and your consent where you gave us an address voluntarily.
To stop abuse of the order lookup - the hashed IP address. Our legitimate interest in protecting your order from a stranger.
To keep accounting records - order details. Legal obligation.
To connect Strava, if you choose to. Consent, which you can withdraw by disconnecting.
Who else sees it:
We do not sell your information and we do not use it for advertising. It is shared only where a service is needed to complete your order. Choosing a place on the map does not send your location anywhere - the map is drawn on our own servers.
How long we keep it
Order and design records - six years, to meet UK tax record-keeping rules.
Print files and preview images - twelve months after your order ships.
Damage photographs - twelve months after the claim is settled.
Order-lookup records - thirty days.
Email delivery records — twelve months.
Your rights
You can ask for a copy of what we hold, have it corrected, have it deleted, restrict or object to how we use it, or ask for it in a portable format. Email orders@mapsandson.com and we will respond within one month.
Deleting order records before six years may not be possible where we are legally required to keep them — we will tell you if that applies and delete everything else.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk.
