Privacy Policy

Mark & Rose is the controller of personal data processed for this online store, including The Legacy Canvas custom printing services. For privacy requests, email cs@marknrose.com.

We may collect identity and contact details (name, email, phone, shipping and billing addresses); order and product configuration details; uploaded images and personalization text; payment-related metadata (we do not store full card numbers); device and usage data such as IP address, browser type, and pages viewed; and communications you send to us.

We may use third-party live chat tools (such as Crisp, Tidio, or similar providers) to answer questions in real time. When you use chat, the provider and Mark & Rose may process your name, email, message content, device information, and conversation history for support and quality purposes.

Chat providers act as processors (or equivalent) under their own privacy terms. Do not share sensitive information in chat that is not needed to resolve your enquiry.

To fulfil orders we process your contact details, shipping address, order contents, uploaded artwork, and production preferences. We share necessary fulfilment data with trusted production partners, logistics carriers, and email delivery services solely to complete and communicate about your order.

Payments are handled by payment processors such as Stripe. Card details are submitted directly to the processor and are subject to their privacy and security practices. We receive confirmation of payment, limited transaction identifiers, and billing details needed for receipts, fraud prevention, and accounting.

We use personal data to process and deliver orders; provide customer service including live chat and email; send transactional messages (order confirmations, shipping updates); improve our website and products; prevent fraud and abuse; comply with legal obligations; and, where permitted, send marketing you have opted into (you may unsubscribe at any time).

We do not sell your personal information. We share data with service providers who help us operate the store — including hosting, payment processing, live chat, email, analytics, production, and shipping — under contracts that limit use to our instructions where required by law.

Depending on your location, you may have the right to access, correct, update, or delete personal data we hold about you; to restrict or object to certain processing; to data portability; to withdraw consent where processing is consent-based; and to lodge a complaint with a supervisory authority.

If you are a California resident, you may have rights under the CCPA/CPRA to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of “sale” or “sharing” of personal information as those terms are defined by California law. We do not sell personal information in the conventional sense.

To exercise deletion or other privacy rights, email cs@marknrose.com with the subject line “Privacy Request”. We may need to verify your identity before fulfilling the request. We will respond within the timeframes required by applicable law.

We retain personal data only as long as needed for the purposes described above — including order fulfilment, legal, tax, and accounting requirements — and then delete or anonymize it where feasible. Uploaded artwork associated with completed orders may be retained for a limited period to support remake or damage claims, then removed according to our retention schedule.

We use commercially reasonable administrative, technical, and organizational measures to protect personal data. No method of transmission or storage is completely secure; please use a strong unique password if you create an account and contact us immediately if you suspect unauthorized access.

Our services are not directed to children under 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take appropriate steps to delete it.

We are based in Hong Kong and may process data in other countries where our providers operate. Where required, we use appropriate safeguards for cross-border transfers.

We may update this Privacy Policy periodically. The “Last updated” date at the top of this page reflects the latest revision. Material changes may be highlighted on the site or by email where appropriate.

For privacy questions or data deletion requests, contact cs@marknrose.com or use our Contact page.