GDPR statement
How Mezeik meets the EU General Data Protection Regulation (Regulation (EU) 2016/679).
Draft — pending legal reviewLast updated 25 October 2026
1. Controller
Keenear Holding AB, org. no. 556902-0026, Västra Hamngatan 11, 411 19 Göteborg, Sweden, is the controller for personal data processed through Mezeik. Contact: legal@mezeik.com, +46 73 403 82 76. We are not required to appoint a data protection officer; privacy questions are handled by the company directly.
2. Processing and legal bases
| Processing | Legal basis |
|---|---|
| Storing and processing your photos to create previews and prints | Contract — Art. 6(1)(b) |
| Orders, delivery, invoicing, complaints | Contract — Art. 6(1)(b) |
| Keeping accounting records for 7 years | Legal obligation — Art. 6(1)(c) (Bokföringslagen) |
| Security, logs, abuse prevention, contact form rate limits, answering enquiries | Legitimate interest — Art. 6(1)(f) |
| Analytics via Google Tag Manager / Google Analytics | Consent — Art. 6(1)(a) |
| Reporting illegal content to authorities | Legal obligation or legitimate interest — Art. 6(1)(c)/(f) |
3. How we apply GDPR
- Data minimisation — photos are downscaled and stripped of metadata in your browser before upload; only what the mosaic needs is stored.
- Storage limitation — photos are deleted when the order is paid, on Start over, or after 24 hours of inactivity.
- EU residency — photos, orders and the database are stored in Microsoft Azure, Sweden Central.
- No special categories — no face recognition, biometrics, profiling or AI training.
- Accountability — data processing agreements are in place with every processor listed below.
4. Sub-processors
| Recipient | Purpose | Location | Safeguard |
|---|---|---|---|
| Microsoft Azure (Microsoft Ireland Operations Ltd) | Storage of photos, previews and print files; database; mosaic generation service | EU — Sweden Central | EU data residency, DPA |
| Vercel Inc. | Hosting of the website and its API (no photos pass through Vercel) | EU region Stockholm; US company | DPA, EU–US Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe Ltd | Payments, invoices and receipts, VAT calculation (Stripe Tax) | EU (Ireland), with transfers to the US | DPA, EU–US Data Privacy Framework and SCCs |
| Gelato AS | Printing, framing and delivery; receives the print file, the products and your delivery address | EU print partners close to the delivery address | DPA |
| Postmark (ActiveCampaign, LLC) | Transactional email (order confirmation, shipping updates) and contact form delivery | US | DPA, EU–US Data Privacy Framework and SCCs |
| Google Ireland Ltd / Google LLC | Google Photos Picker (only if you choose it); Google Analytics via Google Tag Manager (only with your consent) | EU and US | DPA, EU–US Data Privacy Framework and SCCs |
5. Retention
| Data | Kept until | Why |
|---|---|---|
| Your photos, thumbnails, the photo index and previews | Until your order is paid, you press Start over, or 24 hours without activity — whichever comes first | Needed only to create your mosaic; data minimisation |
| Rendered print files of ordered mosaics | 60 days after delivery | Reprints if a delivery is damaged or defective; the print partner fetches them |
| Order records (name, addresses, items, amounts, invoices) | 7 years after the end of the financial year | Swedish Bookkeeping Act (Bokföringslagen) |
| Contact form messages | Up to 12 months after the matter is closed | Handling your request and follow-up questions |
| Session cookie (mz_sid) | 24 hours, extended while you are active | Keeps your photos and cart together |
| Technical logs | Up to 30 days | Security, fault finding and abuse prevention |
6. Your rights and how to use them
- Access — get a copy of the personal data we hold about you (Art. 15).
- Rectification — have inaccurate data corrected (Art. 16).
- Erasure — have data deleted when it is no longer needed or processed unlawfully (Art. 17). Photos can be deleted at any time with Start over in the editor.
- Restriction — have processing limited while a dispute is resolved (Art. 18).
- Data portability — receive data you gave us in a machine-readable format (Art. 20).
- Objection — object to processing based on our legitimate interests (Art. 21).
- Withdraw consent — at any time, for example in the cookie settings, without affecting earlier processing (Art. 7(3)).
- Complain — to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or the supervisory authority where you live.
Send your request to legal@mezeik.com or through the contact form. We respond within one month (extendable by two months for complex requests, in which case we tell you). Requests are free of charge. Full details are in our Privacy Policy.
7. Personal data breaches
If a breach occurs we report it to IMY within 72 hours when required, and inform affected people without undue delay when the breach is likely to result in a high risk to them.