Legal
Privacy policy
In short
- We only collect what an order, an account or a message needs.
- Your delivery details go to the partners who pack and ship your parcel, and to the carrier.
- A few functional cookies remember your language, currency and delivery country. Google Ads cookies measure our ads: in the EEA, the UK and Switzerland only with your consent, elsewhere until you turn them off.
- You have eight rights over your data, and we tell you how to use them.
The full text below is the binding version.
On this page
1. Who we are
Papel Espresso LLC Limited liability company (Wyoming, USA), 30 N Gould St Ste N, Sheridan, WY 82801, United States, runs the Black Tamp shop and is the controller for the personal data described here in the sense of the General Data Protection Regulation (GDPR).
You can reach us for any data protection question at [email protected] or by phone at .
2. What we collect and why
2.1 When you place an order
To sell and ship a product we need your name, delivery address, e-mail address, the items you ordered, the amount you paid and, if you give one, your phone number for the carrier. Your phone number is optional. We use this data to conclude and perform the purchase contract, to send you order and shipping e-mails, to answer questions about the order and to keep the invoice that tax law requires us to keep.
2.2 When you create an account
An account stores your e-mail address, your password in hashed form, your saved addresses and your order history. An account is optional. You can order as a guest.
2.3 When you write to us
The contact form asks for your name, your e-mail address and your message. The order number and the machine model are optional fields, and they exist only so that we can answer you without a second round of questions. We keep the message and our reply so that we can follow up on the matter.
2.4 While you browse the shop
The shop uses a cart cookie and a session cookie so that the items you put in the cart are still there when you move to the next page. A few more functional cookies remember the language, the currency and the delivery country you chose. On the product, cart and checkout pages our payment providers set their own cookies to take payments securely and prevent fraud. The country is derived from your IP address by Cloudflare and is used only to show the shipping rate and the delivery time for that country. Each of these cookies, and how long it stays, is listed on the cookie page. None of this identifies you by name. Our server writes technical log entries with the requested address, the time, the status code and the browser identification, which is what keeps the site available and lets us find attacks and errors.
2.5 Measurement and advertising
Cloudflare Web Analytics counts page views without setting a cookie and without identifying you.
We advertise on Google and use the Google Ads tag to learn which ad brought a visit or an order and to show our ads again to people who visited the shop. The tag sends Google the pages and products you view, what you add to the cart, the value of a completed order, your IP address and the identifiers stored in the Google Ads cookies listed on the cookie page. If you visit from the EEA, the UK or Switzerland, the tag loads only after you choose “Accept all” in the cookie banner. From other countries it loads unless you choose “Only necessary” in Cookie settings at the bottom of the page. You can change your choice there at any time.
3. Legal bases
| What | Legal basis |
|---|---|
| Order, delivery, account, order e-mails | Art. 6(1)(b) GDPR, performance of a contract |
| Invoices and tax records | Art. 6(1)(c) GDPR, legal obligation |
| Answering your message, security of the site, prevention of fraud, cookieless page view statistics (Cloudflare Web Analytics) | Art. 6(1)(f) GDPR, our legitimate interest in replying to customers and in running a working shop |
| Google Ads measurement and remarketing, for visitors from the EEA, the UK and Switzerland, and any other non necessary cookie | Art. 6(1)(a) GDPR, your consent |
| Google Ads measurement and remarketing, for visitors from other countries | Art. 6(1)(f) GDPR, our legitimate interest in measuring and improving our advertising; you can object at any time in Cookie settings |
Where we rely on a legitimate interest you may object to the processing at any time, as described in section 7.
4. Recipients
We do not sell personal data. Data reaches the following recipients only to the extent that they need it:
- Hosting and infrastructure: Hostinger International Ltd. hosts the shop and stores its database and backups.
- Content delivery and security: Cloudflare delivers the shop’s pages, protects the site against attacks, counts page views without cookies (Cloudflare Web Analytics) and forwards e-mails sent to our address. For this it processes your IP address, the technical data of your requests and, when you write to us, your e-mail.
- Payment: payments are processed by Stripe, including Apple Pay, Google Pay, Amazon Pay, Klarna and Affirm. The payment provider receives the amount, the order reference and the data it needs to take the payment. We never see or store your full card number.
- Fulfilment and logistics: the fulfilment and logistics partners that pack and ship your order receive your name, delivery address, phone number if you gave one and the items of the order, and use them only to deliver it. Some of these partners are outside the EU/EEA, see section 5.
- Carriers and tracking: the carrier receives the delivery address and the parcel data. ParcelPanel shows the tracking status of your parcel on our tracking page.
- E-mail delivery: the provider that sends our transactional e-mail receives your e-mail address and the content of the message.
- Advertising: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA, receive the data described in section 2.5 through the Google Ads tag, when the tag loads under the rules set out there. Google also processes this data for its own purposes under its privacy policy, policies.google.com/privacy.
Our processors are bound by data processing agreements under Art. 28 GDPR and may use the data only on our instructions.
5. International transfers
The order data needed for delivery reaches our fulfilment partners, including partners outside the EU/EEA such as in China, where products are stocked and packed. Without that transfer we cannot deliver the goods. The transfer rests on Art. 49(1)(b) GDPR, because it is necessary in order to perform the contract you concluded with us. Where standard contractual clauses adopted by the European Commission are in place with a fulfilment partner, they apply in addition.
Cloudflare, Google and Stripe may process data in the United States. These transfers rest on the EU–US Data Privacy Framework or on the standard contractual clauses adopted by the European Commission.
6. Retention
| Data | How long we keep it |
|---|---|
| Orders, invoices and the related correspondence | 10 years, the retention period tax law imposes on us |
| Account data | Until you delete the account, or until you ask us to delete it |
| Contact form messages | As long as the matter needs, then with the order if it belongs to one |
| Server log files | 14 days |
| Consent record for cookies | For as long as your choice is stored in your browser |
When a retention period ends we delete the data or, where the law requires the record to stay, we block it from all further use.
7. Your rights
Under the GDPR you have the right to:
- Ask what data we hold about you and receive a copy of it (Art. 15).
- Have inaccurate data corrected (Art. 16).
- Have data erased where there is no longer a reason to keep it (Art. 17).
- Have processing restricted while a point is being clarified (Art. 18).
- Receive the data you gave us in a machine readable format, or have it sent to another controller (Art. 20).
- Object to processing that rests on a legitimate interest, for reasons arising from your particular situation (Art. 21).
- Withdraw a consent you gave at any time, with effect for the future (Art. 7(3)). Withdrawing does not make the processing before the withdrawal unlawful.
- Lodge a complaint with a supervisory authority (Art. 77), see section 9.
To use any of these rights, write to [email protected]. We answer within the period the GDPR sets, and we may ask one question to check that the request really comes from you.
8. Cookies
Which cookies the shop, our payment providers and Google set, what each one does and how long it stays are listed on the cookie page. You can change your cookie choice at any time with Cookie settings at the bottom of every page.
9. Complaints
If you believe we handle your data incorrectly, we would like to hear it first at [email protected]. Independently of that you can complain to a data protection supervisory authority, in particular the authority of United States, the authority of the member state where you live or the authority of the place where the matter arose.
10. Changes
We update this page when the shop changes, for example when a new payment method or a new processor is added. The date at the top shows when the current version took effect. If a change concerns you directly, for example a new purpose for data you already gave us, we tell you before it takes effect.