Plakato

3 for 2 on all posters

The cheapest of three is free, until 15 November

See the gallery walls

Privacy Policy

Last updated: 24 September 2026

1. Data Controller

The data controller responsible for your personal data is:

Appivate AS
Org.nr: 815 992 482
Øvre Kråkenes 17, 5152 Bønes, Norway
Email: hello@appivate.com

Plakato is a brand and online store operated by Appivate AS.

2. What Personal Data We Collect

We collect the following categories of personal data:

  • Order information: name, email address, shipping address, and phone number when you place an order.
  • Payment information: payment details are processed securely by our e-commerce platform provider (Shopify). We do not store your full credit card details.
  • Communication data: information you provide when contacting us via email.
  • Technical data: IP address, browser type, operating system, and device type, which are processed when you visit the website. We use this information for anonymous, cookieless visitor statistics (our own measurement and PostHog), in which your IP address is not stored, and – only if you consent – for Vercel Analytics and Speed Insights. See section 8.
  • Newsletter data: email address if you subscribe to our newsletter, along with your language, approximate country, and where you signed up (for example which campaign or page you came from).

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under the GDPR (and the Norwegian Personopplysningsloven):

  • Contract performance (Art. 6(1)(b)): processing necessary to fulfil your order, deliver products, and provide customer support.
  • Legitimate interest (Art. 6(1)(f)): fraud prevention, improving our services, and anonymous, cookieless visitor statistics (see section 8).
  • Consent (Art. 6(1)(a)): marketing communications (newsletter) and non-essential cookies and analytics tools (Vercel Analytics and Speed Insights). You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): retention of transaction records as required by Norwegian accounting law (Bokføringsloven).

4. How We Use Your Data

Your personal data is used to:

  • Process and fulfil your orders
  • Send order confirmations and shipping updates
  • Provide customer support and handle complaints
  • Improve our website and services
  • Send marketing communications (only with your explicit consent)
  • Comply with legal and accounting obligations

5. Data Processors and Third Parties

We share your personal data with the following trusted third-party processors who act on our behalf:

  • Shopify: our e-commerce platform that handles the online store, checkout, and payment processing.
  • Gelato: our print-on-demand fulfilment partner that produces and ships your orders. Gelato operates a global network of 140+ production hubs in 32 countries, producing locally near the delivery address.
  • Shipping carriers: logistics partners such as DHL, FedEx, and local postal services that deliver your orders.
  • Vercel Inc.: hosts and delivers the website and processes technical server logs. If you consent to analytics cookies, Vercel also provides Vercel Analytics and Speed Insights.
  • Google (Firebase Data Connect): stores our own anonymous visitor statistics and our newsletter subscriber list in a database in the EU (europe-west1, Belgium).
  • Resend, Inc.: sends the welcome email when you subscribe to our newsletter.
  • PostHog Inc.: processes our anonymous visitor statistics on servers in the EU.

We do not sell your personal data to third parties. Data is only shared to the extent necessary to fulfil your order and operate our services.

6. International Data Transfers

As our fulfilment partner Gelato operates globally, your name and shipping address may be transferred to production facilities outside the EEA. In addition, some of our providers (including Shopify, Vercel, Google, Resend, and PostHog) are established in, or use sub-processors in, the United States. Such transfers are safeguarded by:

  • EU Standard Contractual Clauses (SCCs) between us and our processors
  • Adequacy decisions by the European Commission where applicable, including the EU–US Data Privacy Framework for certified US companies
  • Our processors' compliance with applicable data protection regulations

You can contact us for more information about the basis for a specific transfer.

7. Data Retention

We retain your personal data for the following periods:

  • Order data: 5 years after the transaction, as required by Norwegian accounting law (Bokføringsloven).
  • Customer support data: up to 2 years after the inquiry is resolved.
  • Newsletter subscriptions: until you unsubscribe.
  • Visitor statistics: up to 12 months, both in PostHog and in our own measurement.
  • Cookie data: see our Cookie Policy for specific retention periods.

8. Cookies and Anonymous Analytics

Our website uses cookies and similar technologies. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please see our Cookie Policy.

To understand which pages are used and how we can improve the website, we also keep anonymous visitor statistics without cookies – both with our own measurement and with the tool PostHog. The statistics neither store nor read anything in your browser, whether cookies or other local storage. When you visit a page, we record which page you visit and how long you stay, which page or link you came from (if any), your browser type, operating system, and device type, and, in our own measurement only, your approximate country derived from your IP address. Our own measurement also records aggregated shop activity, such as products viewed or added to the cart.

To count the number of visitors without recognising you, a code is calculated from, among other things, your IP address and browser – for PostHog this happens on PostHog's servers, and for our own measurement on our server. The code is replaced every day, so visits on different days cannot be linked together, and the IP address itself is not stored. We do not record clicks or what you type, do not record your visit, and do not use the statistics to identify you or for marketing.

The statistics are stored on servers in the EU for up to 12 months. The legal basis is our legitimate interest in improving the website (GDPR Art. 6(1)(f)). We consider that this interest outweighs the impact on you, because the statistics are limited to what is necessary and cannot be linked to you as a person. You can nevertheless object to the processing, see section 9. If you use a browser extension that blocks tracking, normally no statistics from your visit are sent to PostHog. See the “Cookieless, Anonymous Visitor Statistics” section of our Cookie Policy for details.

9. Your Rights Under GDPR

Under the GDPR and Norwegian data protection law, you have the following rights:

  • Right of access: obtain a copy of the personal data we hold about you.
  • Right to rectification: request correction of inaccurate or incomplete data.
  • Right to erasure: request deletion of your data where there is no compelling reason for continued processing.
  • Right to restriction: request that we limit the processing of your data in certain circumstances.
  • Right to data portability: receive your data in a structured, machine-readable format.
  • Right to object: object to processing based on legitimate interest, including direct marketing.
  • Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at hello@appivate.com. We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at www.datatilsynet.no.

10. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. All data transmitted through our website is encrypted using SSL/TLS technology. Payment processing is handled by PCI-compliant third-party providers.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The updated version will be posted on this page with a revised “last updated” date. We encourage you to review this page periodically.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Appivate AS
Øvre Kråkenes 17, 5152 Bønes, Norway
Email: hello@appivate.com