1. Roles
For recipient and end-customer data submitted solely to manufacture and fulfil a customer's order, the business customer acts as data controller and Wall Art People acts as data processor, unless law requires otherwise.
2. Instructions and confidentiality
We process recipient data only on documented instructions reflected in orders, these terms and support requests. Personnel with access are subject to confidentiality duties.
3. Security and subprocessors
We apply proportionate technical and organisational measures and may use vetted hosting, database, communications, payment and shipping subprocessors. The customer authorises subprocessors needed to provide the service, subject to applicable data-protection obligations.
4. Assistance and deletion
Taking account of the processing, we will reasonably assist with data-subject requests, security incidents and compliance information. On termination, recipient data will be deleted or returned when reasonably practicable unless retention is legally required.
5. International transfers
Where recipient data is transferred abroad, the parties will use a lawful transfer mechanism under applicable data-protection law. Final vendor locations and safeguards must be confirmed before production launch.