Privacy Policy - Printbar.az

1. General provisions

1.1. This Policy sets out what personal data Printbar collects, why and on what grounds it is processed, to whom it may be disclosed, how long it is kept, and what rights the data subject has.

1.2. This Policy applies to every channel through which you interact with Printbar: the website printbar.az and its subdomains, including the online designer create.printbar.az (together, the “Website”); our social media and messenger accounts (Instagram, Facebook, WhatsApp, Telegram); chatbots; marketplaces and delivery services (including Wolt); and orders placed by phone, email or in person.

1.3. This Policy has been prepared in accordance with the Constitution of the Republic of Azerbaijan, the Law of the Republic of Azerbaijan “On Personal Data” No. 998-IIIQ of 11 May 2010, the Laws “On Information, Informatization and Protection of Information”, “On Electronic Commerce” and “On Protection of Consumer Rights”, and other legislation of the Republic of Azerbaijan (together, “applicable law”).

1.4. The terms “personal data”, “subject”, “operator” and “processing” have the meanings given to them in the Law “On Personal Data”. “User” or “you” means any person who uses the Website or any other Printbar channel, whether or not they place an order.

1.5. The Website may contain links to third-party resources and embedded third-party services (payment pages, social networks, maps, etc.). Their processing of data is governed by their own policies, and Printbar is not responsible for it.

2. Legal grounds and consent

2.1. We process personal data on the following grounds:

• the subject’s consent, given electronically: by ticking a box when registering or placing an order, by signing in with Google or Facebook, by sending a message to our account or chat, by subscribing to newsletters, or by any other action that clearly indicates consent;
• entering into and performing a contract with you, including a contract for the sale or manufacture of products under our public offer, and steps taken at your request before entering into a contract (quotes, mock-ups, consultations);
• compliance with obligations imposed on us by law - tax, accounting and consumer protection obligations, and requests from competent public authorities;
• other cases in which applicable law permits processing without consent, including the protection of Printbar’s rights and legitimate interests in resolving disputes.

2.2. By placing an order, registering, signing in via social media, or sending us messages or files, you confirm that you have read this Policy and consent to the processing of your personal data to the extent and for the purposes described in it, including disclosure to the recipients listed in Section 8 and the cross-border transfers described in Section 9.

2.3. If you provide us with another person’s personal data (for example, a gift recipient, a company employee, or a person shown in a photo for printing), you confirm that you are entitled to provide it and have obtained that person’s consent where required by law.

2.4. Providing personal data is voluntary. However, without the data needed to fulfil an order (name, phone number, delivery address, artwork file) we will not be able to accept or fulfil the order.

3. Data we process

3.1. Data you provide

• first and last name;
• phone number and email address;
• delivery address and details, recipient details;
• account data (login; passwords are stored only in encrypted form), order history, saved designs;
• company details and contact person details (for B2B);
• files for printing: logos, artwork, images, photos, texts;
• the content of messages, order comments, reviews and support requests.

3.2. Data received from social networks and messengers

When you sign in with Google or Facebook, or contact us via Instagram Direct (@printbar_baku), Facebook Messenger, WhatsApp Business or Telegram, we receive from the relevant platform (Google LLC, Meta Platforms Inc., Telegram) the data you have allowed it to share:

• profile name and profile picture;
• email address (when signing in with Google or Facebook);
• your unique profile identifier on the platform (e.g. Facebook User ID, Instagram-Scoped ID, Google ID);
• username and phone number (for WhatsApp and Telegram);
• message text and attachments (photos, files, voice messages).

3.3. Data collected automatically

• IP address and approximate location derived from it;
• device type, browser, operating system, language and screen resolution;
• cookie and similar technology identifiers, advertising identifiers;
• information about your activity on the Website: pages viewed, navigation, clicks, scrolling, time on page, referral source, add-to-cart actions and purchases;
• server logs (date and time of request, page address, response code).

3.4. Payment data

Card payments are made on the secure page of a bank or payment institution (in particular Birbank / Birpay, Pulpal and others connected to the Website). Printbar does not receive or store your full card number, expiry date or CVV/CVC code. From the payment provider we receive only the outcome of the payment: transaction number, amount, status, date and, where available, a masked card number.

3.5. Data we do not request

We do not request special categories of personal data (racial or ethnic origin, political opinions, religious beliefs, health, private life, criminal record) or biometric data, and ask you not to send them to us. If such information appears in materials you provide (for example, a photo of a person for printing), it will be processed solely to manufacture the order, and the person who provided the materials is responsible for the lawfulness of providing it.

4. Purposes of processing

• registering and maintaining your account, authentication, saving designs and order history;
• accepting, pricing, confirming, collecting payment for, manufacturing and delivering orders, including preparing and checking artwork;
• contacting you about your order or enquiry by phone, email, SMS, messengers and social media;
• handling returns, claims, warranty requests and disputes;
• issuing invoices, acts, delivery notes and other documents; complying with tax and other legal obligations;
• keeping the Website secure and preventing fraud, abuse and automated attacks;
• analysing traffic and improving the Website, product range and quality of service;
• measuring advertising effectiveness and showing relevant advertising on Google, Meta and other networks;
• sending informational and marketing messages and push notifications — only with your consent (Section 14).

We do not make decisions that produce legal effects concerning you based solely on automated processing.

5. Chatbots and artificial intelligence tools

5.1. Messages on the Website, in the designer, and on Instagram, Facebook Messenger and WhatsApp may first be handled by a virtual assistant (the “Leo” chatbot) that uses artificial intelligence models from third-party providers (in particular Anthropic PBC). To generate a reply, the text of your message and the necessary conversation context are sent to the model provider. Under the provider’s terms, this data is not used to train its models.

5.2. Where necessary, the conversation is handed over to a Printbar employee. You can always ask to speak to a person.

5.3. Chatbot replies are for information only and may contain inaccuracies. The price, lead time and terms of an order are agreed only once confirmed by a Printbar employee or in a placed order. Chatbot information that conflicts with a confirmed order, the public offer or the current prices on the Website does not create any obligation for Printbar.

5.4. Image generation and editing features in the designer (logo creation, photo restoration, stylisation, etc.) are performed by third-party AI services (in particular Replicate, Inc.). The image and text prompt you upload for this purpose are sent to that service solely to perform the requested operation. Generated results may be inaccurate or resemble existing images; you are responsible for reviewing them before ordering and for how you use them.

5.5. Do not send payment details, passwords or the information listed in clause 3.5 in chats.

6. Online designer and customer materials

6.1. By uploading or otherwise providing us with images, logos, texts or other materials, you warrant that you hold all rights needed to use and reproduce them on products (copyright, trademark rights, consent of persons depicted), and that the materials do not violate the law of the Republic of Azerbaijan or the rights of third parties.

6.2. Printbar does not check, and is under no obligation to check, the legal status of customer materials. The customer is responsible for any infringement of third-party rights caused by the customer’s materials. If any claims, demands or lawsuits are brought against Printbar in connection with such materials, the customer undertakes to settle them at its own expense and to compensate Printbar for any resulting losses in accordance with applicable law.

6.3. Printbar may refuse to accept or fulfil an order if, in our reasonable judgement, the materials violate the law or third-party rights, contain offensive, extremist or pornographic content, or do not meet the technical requirements for printing. In that case we refund any payment received for that order in accordance with applicable law.

6.4. By providing materials, you grant Printbar a free, non-exclusive right to use them to the extent necessary to fulfil the order: storage, processing, artwork preparation, printing, making samples, and reproducing the order at your request. You retain the exclusive rights to your materials.

6.5. We may publish photos of finished products bearing your design in our portfolio and on social media only with your consent (including consent given in correspondence or by ticking a box when ordering) and without your personal data. You may withdraw consent; we will remove previously published materials within a reasonable time where technically possible.

6.6. Unfinished drafts that you have not saved to your account are stored in your browser on your device. Printbar has no control over their loss if you clear your browser data or switch devices.

7. Cookies, analytics and advertising

7.1. The Website uses cookies, browser local storage, pixels and similar technologies. On your first visit, the Website displays a notice about their use.

7.2. We also send information about completed purchases (amount, products, event ID) to Meta directly from our server (Conversions API). Your email address, phone number, name and city are sent only in hashed form (an irreversible SHA-256 transformation), which lets Meta match the purchase to an ad without receiving this data in readable form.

7.3. You can refuse non-essential cookies via the notice on the Website (where this setting is available), in your browser settings, or using providers’ opt-out tools (e.g. Google Analytics Opt-out, Meta ad preferences, Yandex Metrica opt-out). Disabling cookies may cause some Website features to stop working properly.

7.4. By continuing to use the Website after the cookie notice has been shown, without changing your settings, you agree to the use of cookies for the purposes described.

8. Disclosure to third parties

8.1. Printbar does not sell personal data. We disclose data only to the extent necessary for the relevant purpose, to the following categories of recipients:

• delivery and courier services (including Wolt, Bolt, Yango and others) — name, phone number, address and delivery details;
• banks and payment institutions — data needed to process and confirm payment;
• production subcontractors — artwork and order specifications and, where necessary, the recipient’s name; subcontractors sign confidentiality agreements;
• technical infrastructure providers processing data on our behalf: hosting and servers (Hostinger), content delivery and protection (Cloudflare), email, cloud backups and service notifications (including Telegram, used for backups only in encrypted form);
• analytics and advertising providers — Google, Meta, Yandex, OneSignal (as described in Section 7);
• AI service providers — Anthropic, Replicate (as described in Section 5);
• intermediary platforms through which you contact us or sign in — Meta (Instagram, Facebook, WhatsApp), Telegram, Google;
• professional advisers — accountants, auditors, lawyers, subject to confidentiality;
• public authorities, courts and law enforcement — in the cases and manner provided by law;
• a successor — in the event of reorganisation or sale of all or part of the business, provided the level of data protection is no lower than under this Policy.

8.2. Parties processing data on our behalf must keep it confidential and use it only to provide services to Printbar. Correspondence in messengers and on social media is accessible to authorised Printbar staff and to the automation systems used to handle enquiries.

8.3. Third-party platforms (Meta, Google, Telegram, etc.) are independent operators of the data you post on them and process it under their own rules.

9. Cross-border transfers

9.1. Some of the providers listed in Sections 5, 7 and 8 are located, or store data, outside the Republic of Azerbaijan (in particular in the United States, European Union member states, the Russian Federation and other countries). Personal data may therefore be transferred abroad.

9.2. Cross-border transfers are carried out on the grounds provided by the Law “On Personal Data”: with your consent given in accordance with clause 2.2, and where the transfer is necessary to enter into or perform a contract with you. We choose providers that apply recognised data protection measures, and we do not transfer more data abroad than the relevant purpose requires.

9.3. If you do not agree to cross-border transfers, you may refuse non-essential cookies (Section 7), avoid social sign-in, AI features and the chatbot, and contact us by phone or email. Refusing transfers of data that are essential to fulfil an order (for example, online payment data) may make the relevant ordering or payment method unavailable.

10. Data security

10.1. We apply legal, organisational and technical safeguards: encrypted connections (HTTPS/TLS), password hashing, server and network perimeter protection, malicious traffic filtering, role-based staff access, encrypted backups, regular software updates, and internal data-handling rules.

10.2. Keys and access tokens for external services (including the Meta API) are available only to authorised technical staff and are stored securely. If a compromise is suspected, they are revoked and reissued immediately.

10.3. No method of transmission over the internet or electronic storage is completely secure. We take reasonable measures but cannot guarantee the security of data in circumstances beyond our control. You are responsible for keeping your password and access to your email, phone and social media accounts secure.

10.4. If an incident compromises the security of personal data, we will take steps to mitigate its consequences and notify affected persons and competent authorities in the cases and within the time limits required by law.

11. Retention periods

We keep data no longer than necessary for the purposes of processing or than required by law:

These periods may be extended for the duration of a claim, dispute or inspection, or where required by law. When they expire, data is deleted or anonymised.

12. Your rights

12.1. In accordance with applicable law, you have the right to:

• find out whether your data is processed, which data, for what purpose, on what grounds, to whom it is disclosed and how long it is kept;
• have inaccurate or incomplete data corrected;
• have data deleted or blocked if it is processed unlawfully, is inaccurate, or is no longer needed for the purposes of processing;
• have your saved designs and order files deleted;
• withdraw your consent to processing;
• opt out of newsletters and push notifications;
• complain about Printbar’s actions to the competent public authority or to a court.

12.2. Send your request to [email protected] from the email address or phone number given in your account or order, or submit it in person at our office. To protect your data, we may ask for information confirming your identity (such as an order number) and will not disclose data until your identity is confirmed.

12.3. We respond to requests within the time limits set by applicable law.

12.4. Withdrawing consent or deleting data does not affect the lawfulness of processing carried out before that. We may continue to keep data where necessary to comply with legal requirements (including accounting and tax), to fulfil an order that is still in progress, or to defend Printbar’s rights in a dispute. If you withdraw consent to the processing of data needed for an order in progress, that order may become impossible to fulfil; in that case the public offer’s rules on order cancellation apply, including those on costs already incurred for a custom-made order.

13. Deleting data received via Facebook, Instagram and WhatsApp

If you signed in to the Website with Facebook or messaged us on Instagram, Facebook Messenger or WhatsApp, you can request deletion of that data in either of the following ways:

1. Email [email protected] with the subject “Data deletion”, stating the name you used to sign in with Facebook, or the Instagram username or WhatsApp number you used to contact us.
2. Remove the Printbar Bot app in your Facebook account settings: Settings & privacy → Settings → Apps and websites → Printbar Bot → Remove.

We will delete the data within the time limits set by applicable law and send a confirmation to the email address you provide. Data that we are required by law to keep, or that relates to a fulfilled order (Section 11), is kept until the relevant period expires. Deleting data on our side does not delete the conversation on Instagram, Facebook or WhatsApp itself — you can delete it using those platforms’ tools.

14. Newsletters and notifications

14.1. We send marketing messages (promotions, new products, personalised offers) by email, SMS and messengers, and push notifications, only with your consent. You can opt out at any time via the link in the email, in your browser or account settings, or by writing to us.

14.2. Service messages about your order, account or enquiry (confirmation, status, artwork approval, delivery) are not advertising and are sent without separate consent for as long as needed to fulfil the order.

15. Minors

The Website is intended for persons aged 18 and over. Persons under 18 may use the Website and place orders only with the consent of their parents or other legal representatives. If we learn that we have received a minor’s data without such consent, we will delete it unless we are required by law to keep it. A legal representative may contact us at the address given in Section 20.

16. Corporate customers (B2B)

16.1. For corporate customers we process company details (name, VÖEN, address, bank details), contact persons’ details and brand materials in order to enter into and perform the contract, issue documents and communicate.

16.2. By providing us with the data of its employees or representatives, the corporate customer confirms that it has a lawful basis to do so and has informed those persons that Printbar will process their data.

16.3. Where a contract with a corporate customer contains different confidentiality terms, the contract terms prevail.

17. Liability

17.1. Printbar is liable for the processing of personal data in accordance with the law of the Republic of Azerbaijan.

17.2. To the extent permitted by applicable law, Printbar is not liable for:

• the consequences of a user providing false, incomplete or someone else’s data;
• acts and failures of third parties outside Printbar’s control, including payment systems, delivery services, social networks and messengers (including Meta Platforms Inc., Google LLC and Telegram), and telecom and hosting providers;
• a user losing access to their email, phone, social media or messenger accounts, or disclosing their own password;
• the content of materials uploaded or provided by the user;
• processing of data by third-party resources linked from the Website.

17.3. Nothing in this Policy limits consumer rights or Printbar’s liability where such limitation is not permitted by applicable law.

18. Changes to this Policy

18.1. Printbar may amend this Policy unilaterally, including in response to changes in the law, in the services we use or in how we process data. A new version takes effect when it is published on the Website, unless it states otherwise. The current version and its date are always available on this page.

18.2. We will also announce material changes via a notice on the Website or by email to registered users. If a change requires new consent, we will ask for it separately.

18.3. Continuing to use the Website after a new version takes effect constitutes acceptance of it, to the extent that applicable law does not require separate consent.

19. Governing law and language versions

19.1. This Policy and all relations concerning the processing of personal data are governed by the law of the Republic of Azerbaijan. Disputes shall be resolved through negotiation and, failing agreement, by the courts of the Republic of Azerbaijan in accordance with the rules of jurisdiction established by law.

19.2. This Policy is published in Azerbaijani, Russian and English. In the event of any discrepancy between the language versions, the Azerbaijani version prevails.

19.3. If any provision of this Policy is held invalid, the remaining provisions remain in full force.

20. Contact