policy

Privacy

We are 3D TEXTILE PATTERN SRL, the company operating the Designora Studio brand and its sub-brands, including Castle Of Gifts. When you shop with us or use one of our services, you trust us with your information. Protecting personal data and your privacy is a priority for us. We want to give you clear and transparent information about what we collect, why we need it, how we use it, who may receive it, how long we keep it, and what rights you have.
Important: This policy should be read together with our separate Cookie Policy. It applies to www.castleofgifts.store and its related services. Third-party websites and services have their own privacy policies.
*

Last Update: October 2026

General Information

Who operates Designora Studio and Castle Of Gifts?
The website www.castleofgifts.store is owned and operated by 3D TEXTILE PATTERN SRL, a company registered in Bucharest, Romania. We operate under the Designora Studio brand and its sub-brands, including Castle Of Gifts.
The website gives customers access to information about our products and services, customer accounts, ordering, order tracking, and communications about our products and services.
Who is responsible for processing your personal data?
3D TEXTILE PATTERN SRL is responsible for the personal data processed through the website and acts as the data controller under applicable data-protection law, including the EU General Data Protection Regulation (GDPR) and, where relevant, the UK Data Protection Act 2018.
Because 3D TEXTILE PATTERN operates several brands, the exact brand involved may depend on the service you use. Unless another controller is specifically identified, 3D TEXTILE PATTERN SRL remains responsible for deciding why and how your data is processed.
What does this Privacy Policy cover?
This Privacy Policy governs personal data collected from natural persons through www.castleofgifts.store , related domain names, customer accounts, order services, customer support, newsletters, and other services connected with the website.
It does not apply to third-party websites, applications, software, products, or services merely linked from or integrated with the website. Those services are governed by their own privacy notices.
What is your role as a data controller?
As data controller, we determine the purposes and main methods of processing personal data through the website. We are responsible for using an appropriate legal basis, giving you clear information, protecting the data, and responding to valid rights requests.
Some service providers act only on our instructions as data processors. Others, such as certain payment providers, couriers, advertising platforms, or public authorities, may act as independent controllers for the processing they determine themselves.
Do you rely on consent for every use of personal data?
No. Consent is only one of the legal bases available under data-protection law. Depending on the activity, we may process data because it is necessary to perform a contract with you, comply with a legal obligation, pursue a legitimate business interest, or because you have given consent.
We may ask for consent where required, including for non-essential cookies, certain marketing activities, or a new use of data that is not covered by another appropriate legal basis. You may withdraw consent at any time, without affecting processing that was lawful before withdrawal.
Is the website intended for children?
The website is not marketed to children and should not be used by children to create accounts, place orders, or submit personal data without the involvement of a parent or legal guardian. We do not intentionally collect children’s personal data.
If you are a parent or legal guardian and become aware that a child has submitted personal data to us, please contact us. We will review the request and delete or otherwise lawfully handle the data without undue delay.

What personal data do we collect and why?

What is personal data? 
Personal data is information that identifies you directly or can be linked to you indirectly. Examples include your name, address, email address, telephone number, order information, account identifier, IP address, and information you provide when contacting customer service.
Where do you obtain personal data from? 
We obtain personal data directly from you, automatically through your activity on the website, and from third parties that are lawfully involved in providing our services.
  • Directly from you, such as when you create an account, place an order, complete a form, subscribe to a newsletter, or contact us.
  • Automatically, such as server logs, IP address, browser and device information, website activity, and cookie-related data.
  • From third parties, such as payment providers, print-on-demand partners, shipping companies, analytics providers, advertising partners, and other service providers.
What data do you collect when I create an account? 
When you register a customer account, we may collect your location, customer number, first name, last name, telephone number, email address, and password. If business or invoicing details are requested for a separately approved professional purchase, we may also collect the company name, company registration number, tax or VAT number, nature of business, company type, contact name and business contact details.
We use this information to create and maintain the account, enable access to account features, provide requested services, contact you when necessary, and maintain business records. The legal bases are contract performance, our legitimate interests in operating and administering the website, and consent for optional information.
What data do you collect when I place an order? 

When you place an order, we collect the information reasonably necessary to process, produce, deliver and document the transaction.

This may include:

  • your name;
  • billing address;
  • delivery address;
  • delivery country;
  • email address;
  • telephone number;
  • ordered products and product variants;
  • order number;
  • shipping method;
  • payment status;
  • transaction information;
  • fulfilment and tracking information; and
  • any information you voluntarily provide in connection with the order.

Because Castle Of Gifts uses print-on-demand production, relevant order and delivery information may be shared with the production partners selected for the product and the carrier responsible for delivery.

We use this information to perform the sales contract, arrange production and delivery, provide order and customs-related information, communicate with you and comply with accounting, tax, consumer-protection and other legal obligations.

What data do you collect when I contact you? 
When you contact us by email or another customer-service channel, we collect your name, email address, the content of your message, and any information or files you choose to include. We use this data to answer your enquiry, investigate an order issue, provide support, and maintain a record of our communication.
Please do not send passwords, full payment-card details, or sensitive information that is not necessary for your request. 
What payment data do you process? 

Payments are processed through third-party payment providers available at checkout.

Payment-card details such as the full card number and security code are entered into the payment provider's secure payment environment rather than intentionally stored by Castle Of Gifts.

We may receive limited information about the transaction, such as:

  • payment status;

  • transaction identifier;

  • payment amount;

  • currency;

  • billing information;

  • payment method or card brand; and

  • limited card information such as the final digits, where provided by the payment processor.

We use this information to associate payments with orders, prevent fraud, administer disputes or refunds where applicable and maintain legally required financial records.

Do you store full payment-card details? 

No.

Castle Of Gifts does not intend to store full payment-card numbers or card security codes on its own website systems.

Those details are processed by the third-party payment provider selected at checkout under that provider's own security and privacy arrangements.

We may retain limited transaction information necessary to identify and administer the payment.

Do you collect my IP address?

Yes.

When you use the website, we or our service providers may process your IP address for purposes including website security, fraud prevention, technical administration, analytics where permitted, and approximate country-level geolocation.

Castle Of Gifts may use approximate country information derived from your IP address when no delivery country has yet been provided in order to display customs information relevant to your likely customs region.

This does not mean that we use your IP address to determine your precise physical or street location.

Do you use my location or delivery country to show customs information?

Yes.

Castle Of Gifts uses country-level information to determine which customs information is relevant to you.

Before you provide a delivery address, the website may use approximate country information derived from your IP address.

Once you provide billing or shipping information, the relevant country from that information may be used instead.

The website compares your customs region with the production regions available for the products you are viewing or purchasing. This allows us to display a Customs Information notice when a product may be produced outside your customs region.

The notice may appear on a product page, in the cart or during checkout.

This automated check is designed to provide information only. It does not itself determine whether customs authorities will charge you import taxes, duties or handling fees.

Do you use cookies? 
Yes. When you browse the website, we may collect cookie-related data. Cookies and similar technologies may be used for essential website functions, preferences, analytics, security, and advertising.
The separate Cookie Policy explains the categories of cookies, their purposes, how long they remain active, and how you can manage your choices. Non-essential cookies are used on the basis of consent where required.
What data do you collect through forms? 

When you complete a form on the website, we collect the information requested by that form and any additional information you choose to provide.

Depending on the form, this may include your name, email address, telephone number, company details, address, order number and the content of your message.

We use the information to process your request, provide the requested service, contact you where necessary and maintain appropriate records.

Do you collect sensitive personal data? 
We do not intentionally ask for special categories of personal data, such as health information, genetic or biometric data, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, or information about sexual orientation.
Please do not include this type of information in free-text fields, messages, uploads, or product-related communications unless it is strictly necessary. If sensitive data is received unexpectedly, we will assess whether it should be deleted, restricted, or otherwise handled under applicable law.
What happens if I refuse to provide requested personal data?
If the information is necessary to create an account, process an order, deliver a product, answer your request, prevent fraud, or comply with law, we may be unable to complete the requested operation without it. Optional information and marketing consent are not required for making a purchase unless clearly stated.

What technical and usage data do we collect? 

What technical and usage information is collected? 

When you use the website, technical information may be collected automatically by the website and by service providers used for security, hosting and analytics.

Depending on your consent choices and the technologies enabled, this may include:

  • IP address;

  • browser type;

  • device type;

  • operating system;

  • visited pages and URLs;

  • referral information;

  • page loading information;

  • technical errors;

  • website interactions; and

  • cookie or similar online identifiers.

Google Analytics or other non-essential analytics technologies are used only subject to the consent requirements applicable to them.

Technical information that can identify or be linked to an individual is treated as personal data.

Why do you use technical and usage data? 
We use it to understand how visitors use the website, measure relevance and engagement, investigate bugs and security incidents, prevent abuse, develop features, and adapt the website to different devices and technical requirements.
What happens if technical data is aggregated or de-identified? 
If technical data is combined with personal data in a way that can identify you, we treat the combined information as personal data. If data is irreversibly de-identified so that it can no longer be linked to a natural person, it is no longer personal data and may be used for legitimate business, statistical, research, or service-improvement purposes.
Do you keep customer feedback and support records? 
Yes. If you contact us, we may keep records of questions, complaints, recommendations, compliments, and our responses. Where reasonably possible, we remove information that is unnecessary for maintaining those records.

How and why do we process your personal data? 

Why do you process personal data? 

We process personal data where necessary to operate Castle Of Gifts and provide the services requested by customers.

This includes processing data to:

  • operate and secure the website;

  • create and administer customer accounts;

  • process payments;

  • accept and manage orders;

  • send orders to print-on-demand and production partners;

  • arrange production and delivery;

  • provide tracking and order communications;

  • identify the customs region associated with a delivery destination;

  • display relevant customs information and warnings;

  • provide customer support;

  • investigate damaged, missing or incorrect orders;

  • prevent fraud and misuse;

  • maintain accounting, tax and transaction records;

  • comply with legal obligations; and

  • improve the website and services where permitted.

Marketing and non-essential analytics are handled separately and are subject to the applicable consent or other legal requirements.

What legal bases do you rely on? 

The legal basis depends on why the information is being processed.

We principally rely on:

Performance of a contract or steps before entering into a contract
For activities such as creating an order, processing payment, arranging production and shipping, communicating about the order and providing customer service connected with a purchase.

Compliance with a legal obligation
For accounting, tax, consumer-protection, regulatory and other records that we are legally required to maintain.

Legitimate interests
Where necessary for purposes such as operating and securing the website, preventing fraud, maintaining business records, improving our services and providing useful country-level customs information, provided those interests are not overridden by your rights and freedoms.

Consent
Where required for activities such as non-essential cookies, analytics, newsletter subscriptions or advertising technologies.

Where processing is based on consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.

Do you use automated decision-making?

Castle Of Gifts uses some automated rules to operate the website.

For example, the website may automatically compare your country or customs region with the production regions available for a product in order to decide whether to display a customs-information notice.

Automated systems may also be used by payment, security or fraud-prevention providers.

The Castle Of Gifts customs-warning system is informational and does not by itself make a decision that produces legal effects or similarly significant effects concerning you.

We do not currently use solely automated decision-making that produces legal or similarly significant effects on customers unless this is specifically disclosed.

Can you use my data for a new purpose? 
We do not use personal data for purposes that are incompatible with the reason it was collected. If we need to use it for a materially different purpose, we will assess whether the new purpose is legally compatible, provide additional information where required, and obtain consent if no other lawful basis applies.

How do we communicate with you? 

When will you send me newsletters? 

We send promotional newsletters when you voluntarily subscribe or otherwise provide the required marketing consent.

Placing an order does not by itself mean that you have subscribed to the Castle Of Gifts newsletter.

Marketing consent is separate from the service-related messages necessary to process and deliver an order.

You can withdraw your marketing consent at any time by using the unsubscribe link in the email or by contacting us.

How can I stop marketing messages? 
You can opt out free of charge at any time by selecting the unsubscribe link in a newsletter, adjusting the settings in your customer account where that feature is available, or contacting us directly.
We may keep a minimal suppression record so that we remember not to send further marketing to the same address.
Do your newsletters use tracking pixels? 

Where enabled, newsletter services may use technologies that record information such as whether an email was delivered, opened or whether a link was selected.

We use this information only where permitted by applicable privacy and electronic-communications rules and subject to the consent requirements that apply.

You can withdraw marketing consent or unsubscribe from newsletters at any time.

What are service-related notices? 
Service-related notices include order confirmations, receipts, payment information, production and shipping updates, account-security messages, technical emails, and other administrative communications. These messages are sent when needed to provide the service or comply with law and are not ordinary marketing messages.
You cannot opt out of messages that are necessary to process an active order, maintain account security, or provide legally required information.

How long do we keep your personal data?

How long do you retain personal data? 

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and for any additional period required or permitted by law.

The appropriate retention period depends on factors such as:

  • the type of information;

  • the purpose for which it is used;

  • contractual obligations;

  • accounting and tax requirements;

  • consumer-protection requirements;

  • fraud and security needs;

  • possible disputes or legal claims; and

  • applicable limitation periods.

A request for deletion will be honored where the legal conditions for erasure are met. Some information may need to be retained even after a deletion request or account closure where we have a legal obligation or another lawful reason to retain it.

When information is no longer required, it will be deleted, anonymized or otherwise securely disposed of.

How long do you retain account data? 
Account information is generally retained while the account remains active. If you ask us to delete your account, we will remove or anonymize information that is no longer needed, while retaining order, payment, tax, fraud-prevention, dispute, or legal records for as long as required or permitted by law.
How long do you retain order and payment records? 
Order, invoice, transaction, and payment-status records are retained for the period required by applicable accounting, tax, consumer-protection, and limitation rules. This may continue after an account is deleted.
How long do you retain technical data? 
Technical and usage data is retained for as long as reasonably necessary for analytics, security, audits, legal compliance, dispute resolution, and enforcement of agreements. Retention settings may also depend on the providers we use, including Google Analytics.
What about backups and legally required records? 
Deleted data may remain temporarily in protected backups until the normal backup cycle expires. Where law requires us to preserve business, accounting, tax, or legal records for a specific period, we retain the necessary information and securely delete it once that period ends.

How do we share and disclose your data? 

Who do you share personal data with? 

We disclose personal data only where reasonably necessary for operating Castle Of Gifts, fulfilling orders, providing services, protecting the website or complying with law.

Recipients may include:

  • hosting and infrastructure providers;

  • print-on-demand platforms;

  • production and fulfilment partners;

  • payment processors;

  • delivery companies and postal operators;

  • newsletter and communication providers;

  • analytics providers, subject to applicable consent requirements;

  • IT, security and fraud-prevention providers;

  • professional advisers and contractors; and

  • courts, regulators, tax authorities or other public bodies where legally required.

Where a service provider acts as our processor, it processes personal data on our behalf and subject to appropriate contractual requirements.

Some recipients, including certain payment providers, carriers and public authorities, may act as independent controllers for their own processing activities.

Which service providers may receive my data?

The principal categories of service providers used in connection with Castle Of Gifts currently include:

  • Hostinger, for website hosting and related infrastructure;

  • Printify, for print-on-demand order fulfilment;

  • the relevant Printify production or print provider selected to manufacture an ordered product;

  • the postal operator or delivery carrier selected for the particular shipment;

  • payment processors enabled at checkout, for payment processing and fraud prevention;

  • MailerLite, where used for newsletter distribution;

  • Google Analytics, where enabled and where the required analytics consent has been provided; and

  • technical, security, professional or customer-support providers where reasonably necessary.

The exact production partner and carrier may vary according to the product, production location, delivery destination and fulfilment route.

We share only the information reasonably required for the provider to perform the relevant service.

Do you sell my personal data? 

We do not sell personal data to third parties for monetary consideration. If we introduce technologies or disclosures that are treated as a ‘sale’ or ‘sharing’ under an applicable privacy law, we will provide the disclosures and controls required by that law.

Do you currently use behavioral advertising?

Not through advertising or targeting cookies under the current Website configuration described in our Cookie Policy. If advertising, remarketing or social-media tracking technologies are introduced in the future, they will be disclosed through the Website’s cookie settings and used only in accordance with applicable consent and data-protection requirements.

Can technical or de-identified data be shared? 
Technical data that cannot identify a natural person may be shared for business, research, website improvement, product development, or statistical purposes. If information can identify you, we treat it as personal data and apply the protections in this policy.
Can you disclose data in response to legal requests? 
Yes. We may disclose information to courts, regulators, tax authorities, law-enforcement bodies, or other public authorities where required by law or necessary for a public-interest objective such as national security, fraud prevention, or law enforcement.
What happens if the website or business is sold? 
If the website or business is sold, merged, reorganized, financed, or transferred in whole or in part, personal data may be disclosed to advisers, potential purchasers, and a successor entity. We will require appropriate confidentiality and data-protection safeguards and will inform you of a change of controller where required.

International Data Transfers 

Where may my personal data be processed?

Personal data may be processed in Romania and elsewhere in the European Economic Area, but some information may also be processed outside the EEA.

This can occur because Castle Of Gifts works with international service providers, including Printify, production partners, payment providers, technology providers and delivery companies operating in different countries.

For example, when an order is produced outside the EEA, information necessary to manufacture and deliver that order — such as the recipient's name, delivery address, contact information and relevant order details — may need to be provided to the production and delivery partners involved.

We limit international disclosures to information reasonably necessary for the relevant purpose and apply the safeguards required by applicable data-protection law.

How do you protect international transfers? 

When personal data is transferred from the EEA to a country outside the EEA, we use an appropriate legal transfer mechanism where required.

Depending on the recipient and destination, this may include:

  • a European Commission adequacy decision;

  • Standard Contractual Clauses approved by the European Commission;

  • appropriate contractual and organizational safeguards; or

  • another lawful transfer mechanism recognized by applicable data-protection law.

Where required, we also consider whether additional safeguards are necessary in light of the destination and the nature of the processing.

How do we protect your personal data? 

What security measures do you use? 

We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorized disclosure or access.

Depending on the system, these measures may include:

  • HTTPS/TLS protection for website communications;

  • access controls;

  • authentication and password protections;

  • software and security updates;

  • restricted administrative access;

  • backups and recovery measures;

  • security monitoring;

  • appropriate confidentiality requirements; and

  • careful selection of service providers.

Security measures are reviewed in light of the nature of the information, the systems involved and the risks associated with the processing.

Can you guarantee complete security? 
No online service can guarantee absolute security. We use reasonable safeguards and review risks, but communications and information-processing technologies can be affected by events beyond our reasonable control.
What happens if there is a security breach? 

If a personal-data breach occurs, we will investigate, contain, document and mitigate the incident.

Where the GDPR requires notification to the competent supervisory authority, we will make that notification without undue delay and, where feasible, within 72 hours after becoming aware of the breach.

Where a breach is likely to create a high risk to the rights and freedoms of affected individuals, we will also inform those individuals without undue delay where required by law.

What rights do you have? 

What privacy rights can I exercise? 

Subject to the legal conditions and exceptions that apply, you may have the following rights:

  • Access — to obtain confirmation about whether we process your personal data and receive a copy and relevant processing information.

  • Rectification — to correct inaccurate or incomplete personal data.

  • Erasure — to request deletion where the legal conditions are met.

  • Restriction — to request that processing be limited in certain circumstances.

  • Data portability — to receive eligible personal data in a structured, commonly used and machine-readable format and, where technically feasible, have it transferred to another controller.

  • Objection — to object to processing based on legitimate interests and to object at any time to processing for direct marketing.

  • Withdrawal of consent — to withdraw consent where processing relies on consent, without affecting processing lawfully carried out before withdrawal.

  • Automated decisions — where applicable, to exercise rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

  • Complaint — to lodge a complaint with a competent data-protection supervisory authority.

How can I exercise my rights? 
Contact us and explain your request in sufficient detail. To protect your information, we may ask for reasonable verification that allows us to identify you in our systems. We will not ask for more information than is necessary for verification.
You can also update certain account information directly in your account pages where those features are available, including access, correction, portability, and account deletion options.
How long will you take to respond? 

We will respond to a valid privacy-rights request without undue delay and normally within one month after receiving it.

Where permitted by law, this period may be extended by up to two additional months where necessary because of the complexity or number of requests.

If an extension is required, we will inform you within the initial one-month period and explain the reason for the delay.

Will you discriminate against me for exercising my rights? 
No. We do not deny goods or services, charge different prices, remove discounts or benefits, impose penalties, or provide a lower quality of service merely because you exercised a privacy right.
Can I complain about your use of my data? 

Yes.

You may contact us first so that we have an opportunity to investigate and respond to your concern.

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

Because Castle Of Gifts is operated by a Romanian company, the Romanian supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

You can find current complaint procedures and contact information on the official ANSPDCP website at dataprotection.ro.

If you live in another EEA country, you may also have the right to contact the supervisory authority in your country of residence or work.

Third-party Websites and Services 

Does this policy apply to third-party services? 
No. This policy explains our processing and the disclosures we make to third parties, but it does not replace the privacy notices of payment providers, delivery companies, social-media platforms, advertising partners, analytics providers, or websites that you visit through a link.
Please review the relevant third party’s privacy and cookie information before submitting data to it.

Our Contact Details

How can I contact you about this Privacy Policy? 

The data controller for Castle Of Gifts is:

3D TEXTILE PATTERN S.R.L.
Romania
CUI: RO40979847
Trade Register Number: J2023008370403
Website: www.castleofgifts.store
Privacy and customer-service email: info@castleofgifts.store

For a privacy-rights request, please identify the nature of your request and provide enough information for us to locate the relevant account, order or communication.

We may request proportionate information to verify your identity before disclosing, deleting or changing personal data.

Please do not send passwords, full payment-card details or unnecessary identity documents by email.

General Information

Who operates Designora Studio and Castle Of Gifts? 
The website www.castleofgifts.store is owned and operated by 3D TEXTILE PATTERN SRL, a company registered in Bucharest, Romania. We operate under the Designora Studio brand and its sub-brands, including Castle Of Gifts.
The website gives customers access to information about our products and services, customer accounts, ordering, order tracking, and communications about our products and services.
Who is responsible for processing your personal data? 
3D TEXTILE PATTERN SRL is responsible for the personal data processed through the website and acts as the data controller under applicable data-protection law, including the EU General Data Protection Regulation (GDPR) and, where relevant, the UK Data Protection Act 2018.
Because 3D TEXTILE PATTERN operates several brands, the exact brand involved may depend on the service you use. Unless another controller is specifically identified, 3D TEXTILE PATTERN SRL remains responsible for deciding why and how your data is processed.
What does this Privacy Policy cover? 
This Privacy Policy governs personal data collected from natural persons through www.castleofgifts.store, related domain names, customer accounts, order services, customer support, newsletters, and other services connected with the website.
It does not apply to third-party websites, applications, software, products, or services merely linked from or integrated with the website. Those services are governed by their own privacy notices.
What is your role as a data controller? 
As data controller, we determine the purposes and main methods of processing personal data through the website. We are responsible for using an appropriate legal basis, giving you clear information, protecting the data, and responding to valid rights requests.
Some service providers act only on our instructions as data processors. Others, such as certain payment providers, couriers, advertising platforms, or public authorities, may act as independent controllers for the processing they determine themselves.
Do you rely on consent for every use of personal data? 
No. Consent is only one of the legal bases available under data-protection law. Depending on the activity, we may process data because it is necessary to perform a contract with you, comply with a legal obligation, pursue a legitimate business interest, or because you have given consent.
We may ask for consent where required, including for non-essential cookies, certain marketing activities, or a new use of data that is not covered by another appropriate legal basis. You may withdraw consent at any time, without affecting processing that was lawful before withdrawal.
Is the website intended for children? 

The website is not directed to children under the age of 16.

Children should not create customer accounts, place orders, subscribe to marketing communications or submit personal data without the involvement of a parent or legal guardian where required.

Where processing relating to an online service is based on consent and the individual is under 16, parental or guardian authorization may be required under applicable law.

If you are a parent or legal guardian and believe that a child has provided personal data to us without appropriate authorization, please contact us. We will review the matter and take appropriate action.