Privacy policy
Last updated: 28 August, 2026
Michelangelo Media AS (Org. no. 935 656 273) operates the Gandrud Visuals brand and the website and online store at gandrudvisuals.com (“Gandrud Visuals”, “we”, “us”, “our”).
This Privacy Policy explains how we collect, use, disclose and protect personal information when you visit our website, sign up to receive content, purchase digital or physical products, contact us, or otherwise interact with our services (the “Services”).
Our online store is hosted by Shopify, which provides the ecommerce platform we use to operate the Services.
1. Data Controller and Contact
Data Controller: Michelangelo Media AS (Gandrud Visuals)
Org. no.: 935 656 273
Address: Postboks 4128 Sjølyst, 0217 Oslo, Norway
Email: hello@gandrudvisuals.com
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us using the email above.
2. Personal Information We Collect
The personal information we collect depends on how you interact with us.
Information you provide
This may include:
- Contact information, such as your name, email address and phone number
- Billing and shipping information, such as your billing address, shipping address and delivery details
- Order information, such as products purchased, order history, refunds, returns and digital download access
- Communications, such as emails, support requests or other messages you send us
- Marketing preferences, including newsletter subscription status, consent records and unsubscribe requests
Information collected automatically
When you use our website, we and our service providers may collect certain information automatically, including:
- IP address
- Browser and device information
- Operating system
- Approximate location derived from your IP address
- Pages viewed and interactions with our website
- Referral and website usage information
- Information collected through cookies, pixels and similar technologies
The extent of this collection depends in part on your cookie and privacy choices.
Information from third parties
We may receive information from service providers that help us operate the Services, including:
- Shopify, our ecommerce and website platform
- Payment providers, which process payments on our behalf
- Gelato and other fulfilment or shipping providers, which help produce and deliver physical photographic prints
- Digital delivery providers, which make purchased digital content available to you
- Email and communications providers, which help us deliver requested content, transactional messages and marketing communications
- Analytics and advertising providers, where enabled and permitted by your privacy choices
We do not receive or store your complete payment card details.
3. How We Use Personal Information
We may use personal information to:
Provide our Services
This includes:
- processing orders and payments
- delivering digital products and download links
- producing and delivering physical photographic prints
- providing order confirmations and other transactional communications
- handling returns, refunds and customer support
- maintaining records relating to purchases and customers
Provide requested content
For example, we may use your email address to send you a photography guide, resource or other content you requested.
Send marketing communications
Where you have subscribed or otherwise provided the required consent, we may send emails about:
- photography tips and educational content
- Gandrud Visuals updates
- new products and launches
- offers and promotions
You can unsubscribe at any time using the unsubscribe link included in our marketing emails.
Improve our website and business
We may use information to:
- understand how our website and store are used
- improve content, design, functionality and customer experience
- measure website and marketing performance
- troubleshoot technical issues
Security and fraud prevention
We may process information to protect our customers, website and business, detect suspicious or fraudulent activity and prevent misuse of our Services.
Legal and administrative purposes
We may process information where necessary to:
- comply with accounting, tax and other legal obligations
- respond to lawful requests from authorities
- establish, exercise or defend legal claims
- enforce our terms and protect our rights
4. Legal Bases for Processing
Where the GDPR or similar data protection legislation applies, we rely on one or more of the following legal bases:
- Contract: where processing is necessary to fulfil an order, provide a purchased product or service, or take steps requested by you before entering into a contract
- Consent: for activities such as marketing communications and non-essential cookies or tracking technologies where consent is required
- Legal obligation: where processing is necessary to comply with applicable laws and regulations
- Legitimate interests: where necessary for purposes such as operating and improving our Services, maintaining security, preventing fraud and protecting our business, provided those interests are not overridden by your rights and interests
Where processing is based on consent, you may withdraw your consent at any time.
5. How We Share Personal Information
We disclose personal information only where reasonably necessary to operate our Services or fulfil the purposes described in this Privacy Policy.
Recipients may include:
- Shopify
- payment processors
- Gelato, for production and fulfilment of physical photographic prints
- shipping and logistics providers
- digital product delivery providers
- email and communications providers
- website, IT, security and technical service providers
- analytics and advertising providers, where enabled and permitted
- professional advisers where necessary
- public authorities or other parties where disclosure is required by law
For example, when you purchase a physical print, information such as your name, shipping address and order details may be shared with Gelato and relevant shipping providers so that your order can be produced and delivered.
We may also disclose information in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business.
We do not sell personal information for monetary payment.
In some jurisdictions, certain disclosures for advertising or personalisation purposes may legally be considered a “sale”, “sharing” or similar activity even where no money changes hands. Where applicable, we provide the privacy choices required by law.
6. Shopify
Our store is hosted by Shopify.
Shopify processes personal information to provide ecommerce, checkout, payment, security and other services used by our store.
Depending on the Shopify services and features enabled, Shopify may process certain information in different capacities under applicable data protection laws.
Shopify may also provide privacy controls, cookie consent functionality and data-sharing preferences that apply when you use our store.
7. Gelato and Print Fulfilment
We use Gelato to assist with the production and fulfilment of physical photographic prints.
When you order a print, we may provide Gelato with information necessary to fulfil the order, such as:
- your name
- shipping address
- relevant contact information
- the product ordered
- order and fulfilment information
Gelato and relevant shipping providers may process this information in order to produce, ship and deliver your order.
Gelato may process personal information in accordance with its own privacy practices and applicable data protection obligations.
8. Cookies and Similar Technologies
We use cookies and similar technologies for purposes including:
- Strictly necessary functions, such as security, checkout, cart functionality and fraud prevention
- Analytics, to understand how our website is used and improve it
- Marketing and advertising, where enabled, to measure marketing performance and provide relevant advertising or personalisation
Where required by law, non-essential cookies and similar technologies are used only after obtaining the required consent.
You can manage your choices through the cookie or privacy controls provided on our website.
You may also manage cookies through your browser, although disabling necessary cookies may affect website functionality.
9. Email Marketing and Unsubscribing
If you subscribe to our marketing communications, we may send occasional emails containing photography content, updates, product launches and offers.
You may unsubscribe at any time using the unsubscribe link included in any marketing email.
Unsubscribing from marketing communications does not prevent us from sending transactional messages necessary to fulfil an order or provide a service you requested.
After you unsubscribe, we may retain limited information necessary to record and respect your unsubscribe preference.
10. International Data Transfers
Some of our service providers, including Shopify, Gelato and other technology or fulfilment providers, may process personal information outside Norway or the EEA.
Where personal information protected by European data protection law is transferred internationally, appropriate safeguards are used where required, such as:
- adequacy decisions
- Standard Contractual Clauses
- other legally recognised transfer mechanisms
11. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal requirements.
Retention periods may depend on the type of information involved. For example:
- Order, transaction and accounting information may be retained for the period required by accounting, tax and other applicable laws
- Marketing information may be retained while you remain subscribed, with limited information retained afterwards where necessary to respect an unsubscribe request
- Customer support communications may be retained for a reasonable period to handle requests and maintain appropriate records
- Security and technical information may be retained where necessary to protect and operate our Services
When information is no longer required, we may delete or anonymise it as appropriate.
12. Your Privacy Rights
Depending on where you live and the applicable law, you may have rights relating to your personal information, including the right to:
- request access to personal information we hold about you
- request correction of inaccurate information
- request deletion of your information in certain circumstances
- restrict certain processing
- object to certain processing
- withdraw consent where processing is based on consent
- request portability of certain information
- lodge a complaint with the relevant data protection authority
To exercise a privacy right, contact us at hello@gandrudvisuals.com.
We may need to verify your identity before processing certain requests.
If you are in Norway, you also have the right to complain to Datatilsynet.
13. Security
We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
However, no electronic transmission or storage system can be guaranteed to be completely secure.
14. Children
Our Services are not specifically directed toward children.
We do not knowingly collect personal information from children in circumstances where parental consent or another legal basis would be required.
If you believe a child has provided personal information to us improperly, please contact us so we can investigate and, where appropriate, delete the information.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our Services, technology, legal requirements or business practices.
When we make changes, we will update the “Last updated” date at the top of this page.
Where required by law, we will provide additional notice of material changes.
16. Contact
Michelangelo Media AS (Gandrud Visuals)
Org. no.: 935 656 273
Postboks 4128 Sjølyst
0217 Oslo
Norway
Email: hello@gandrudvisuals.com