Privacy Policy

Last updated: 2026-10-12

This Privacy Policy explains what personal information mrpandadrawz.com collects, how we use it, who we share it with, and what rights you have. We try to keep it short and plain.

The site is operated by Marcel ("Mr. Panda", "we", "us"), a sole-proprietor digital artist based in the Republic of South Africa. Under South African law (Protection of Personal Information Act, PoPIA) we are the responsible party. For visitors in the EU/UK we are the data controller under the GDPR / UK GDPR. That is true of almost everything in this policy. The one exception is a parcel we print and ship on another artist's instruction: for the delivery details on that parcel we are an operator under PoPIA and a processor under the GDPR, and the artist is the responsible party — see "Printing for other artists" in §4.

1. What we collect

Depending on how you use the Site, we may collect:

Category	Examples	Why we hold it
Account information	Email address, display name, password hash, MFA secret (encrypted)	To create and protect your account
Purchase information	Order references, amounts, currency, customer email	To process payments and provide receipts
Subscription information	Tier, status, period dates, processor reference	To grant the entitlements you paid for
Age-verification records	Pass/fail result + expiry date for the age-gate self-attestation. We never collect or store ID documents.	Legal compliance for adult content
Your 18+ statement	The time you ticked "I'm 18 or older" and which version of that wording you saw, on your account, your orders, your subscription, your commission payments and a Panda Studio enquiry. It is your own statement, not an age check: we do not ask for your date of birth or any document, and it is kept apart from the age-verification records above	To show that we sell only to adults and do not take a child's details
Adult-content settings	Whether adult content is switched on for your account, and whether a commission you placed was marked as explicit	To show you only what you have chosen to see, and to quote and deliver the work you actually asked for. Off unless you turn it on
Technical information	IP address, user-agent, request logs, audit log of admin actions, and a record of each download of a file you bought (the time, the file and the IP address it came from)	Security, abuse prevention, debugging, and answering refund requests and chargebacks on what you bought
Optional analytics	Visit patterns, page-view counts, and — if you buy something — the sale report described in §4	Only collected if you consent — see §5
Communications	Newsletter sign-ups, email replies	To send things you asked for
Things you post or send us	Public comments under your display name, commission briefs and the messages on a commission, and any reference images you upload	To publish the comment, and to understand and deliver the work you commissioned
Panda Studio enquiries	Your name, email address, an optional phone number, an optional link to where you already sell, your own description of your work and what you need printed, and an optional note on volume. As we work through it we add a status and our own notes	To read the enquiry, reply to it by hand, and decide whether the press can take the work on

We do not sell your personal information.

2. How payments work

All paid transactions on this Site are processed by Paystack (Pty) Ltd, who are an independent controller for the payment data they receive (card details, billing address, fraud signals). Paystack provides us with confirmation of payment plus the customer email; we never see or store your card number. If you dispute a charge with your bank, we answer the dispute through Paystack, and for that we send Paystack our record of that order: its reference, the payment reference, the date and amount, what was bought, when you confirmed you were 18 or older, which licence version a digital file was sold under, and the time, file and IP address of each download of it from your account. We do not send your email address, your delivery address or your browser details. Paystack's privacy policy applies in addition to ours and is available at paystack.com. Separately from anything you buy here, we also print for other artists — see "Printing for other artists" in §4. Those orders do not go through the gateway at all, so no card or bank detail for one is stored anywhere on this system.

3. How we use your data

We use the data above to:

Provide the Site, your account, and any subscriptions or purchases you make;
Verify your age where required by law for adult content;
Send you receipts, account notices, and security alerts;
Investigate fraud, abuse, or breaches of our Terms of Use;
Answer a refund request, or a dispute of a charge with your bank, with our record of the order and of each download of what you bought;
Comply with our legal obligations;
Read and answer an enquiry you send through the Panda Studio form, and work out whether the press has capacity to take the work on;
(With your consent) understand how the Site is used and improve it.

The legal bases we rely on (where the GDPR applies) are: contract (giving you what you signed up for), legitimate interests (security, fraud prevention, answering a refund request or a chargeback with our record of the order, basic analytics on essential cookies, answering a business enquiry you send us and deciding whether we can take the work on), and consent (marketing analytics, advertising pixels, optional cookies).

4. Who we share it with

We share personal data with the third parties below, only to the extent needed for them to do their job:

Paystack — payments processor.
OVH — runs the dedicated server and the database behind the Site, and the storage our backups are written to. OVH is a French company; see the note below this list about where your data is held.
Email delivery — transactional email is sent through cPanel SMTP on the same hosting infrastructure.
MailerLite — newsletter / marketing list. Receives your email address, and — if you asked to be told when a sold-out item comes back — which item you asked about. You land on the list through the opt-in box at sign-up or through the notify-me box on a sold-out item; we may also tag your address into role-specific segments based on how you interact with the site (e.g. a "watchers" segment when you subscribe to a paid tier, a "commission alumni" segment when a commission you placed is delivered), so the emails you receive stay relevant. You can unsubscribe at any time from any email or by deleting your account, which removes you from every segment as well.
Gelato AB — Lower Birger Jarlsgatan 27, 11145 Stockholm, Sweden. Our print-on-demand partner. When you order a physical product that is printed to order, we send Gelato your full delivery address so they can produce and ship it. Your email address reaches them too, at the moment we ask them for a price. See "Print fulfilment data" below. Their privacy policy: https://gelato.com/legal/privacy-policy
Cloudflare, Inc. — sits in front of the Site as a reverse proxy and security layer, and provides the "are you human" challenge on our sign-up and notify-me forms (Cloudflare Turnstile). Cloudflare therefore processes your IP address and request headers on every visit, and a short-lived challenge token when you submit one of those two forms. Their privacy policy: https://www.cloudflare.com/privacypolicy/
Third-party storefronts — some artwork is also sold as merchandise through Displate, INPRNT and TeePublic. Those are separate shops: you buy from them, under their terms, on their sites, and we never see or receive your details for those orders. This is different from the print-on-demand orders placed on this Site, which go to Gelato as described above.
Analytics / advertising (optional, only with consent) — Google Analytics, Google Ads, Meta (Facebook/Instagram) Ads. Until you accept the consent banner they receive nothing at all. Once you have accepted it they see page views, click events, and the approximate location worked out from your IP address. And if you then buy something, our server reports that sale to them directly rather than through your browser. The report to Meta carries a scrambled version of your email address — it cannot be turned back into the address, but Meta can match it against an account they already hold, which is why it is sent — along with your IP address, your browser's user-agent string, the order value, and which items you bought. The report to Google carries the ad click identifier, the order reference, the value and the items, and no address or email. Because both are sent from our server, blocking scripts in your browser does not stop them; withdrawing consent does.

Some of the providers above are outside South Africa, and OVH, who host the server and the database, is a French company — so your data is stored and processed both inside and outside the Republic rather than only here. Where data leaves South Africa to providers in countries without an adequacy finding, those transfers are protected by Standard Contractual Clauses or equivalent safeguards from the provider.

Print fulfilment data

When you order a physical product that is printed to order, we collect your delivery address — recipient name, address lines, city, province or state, postal code, country, and an optional phone number — so it can be produced and shipped to you.

That address is sent to Gelato AB, who print and dispatch the item. Gelato is based in Sweden, inside the European Union. Where your order ships outside the EU, Gelato is responsible for passing your address on to the printer and courier in your region.

We also keep our own production and accounting record against the order — what you were charged, and the order's lifecycle status (created, printed, shipped, delivered) — which is how we reconcile our books and chase a delivery problem on your behalf. Our own purchasing and cost records are commercial information about the business rather than personal information about you, so they are not part of a data request; everything we hold about you is, and you can ask for it at any time — see §7.

Orders you place for a studio-shipped item are packed and posted by us, and your address goes to the courier only.

The quote comes earlier than the order. When the Site works out the delivery price for a printed-to-order item it asks Gelato for a quote, and that request carries your country and your email address — before you have paid, and whether or not you ever do. The name, street and postal code in it are placeholders; Gelato does not get your real address until the order is placed.

All of this describes an order you placed on this Site. It is not how things work when another artist asks us to print something for one of their own customers, which is the next sub-section.

In-person sales

At markets and events we sell face to face through a till on this same system. If you ask for a receipt by email, we store the email address against that sale so the receipt can be sent and so a later refund or exchange can be matched to it. If you do not ask for one, the sale is recorded with no personal information attached to it at all.

Card payments at an event are taken on the payment provider's own device or app. We never see or store the card number.

Printing for other artists (Panda Studio)

The studio also prints for other artists. The artist sells the work on their own site, sends us the order, and we print it and post it straight to their customer — unbranded, with nothing of ours in the parcel. We bill the artist. We never bill the person receiving it, and nothing on our system can send them an email.

For those delivery details we are not the responsible party; the artist is. They took the order, they decided what to do with their customer's information, and they are who that customer bought from. We are an operator under PoPIA and a processor under the GDPR, which means we handle the details on the artist's instruction and for one purpose — making the parcel and getting it there.

What we hold is a delivery name, a postal address and sometimes a phone number. There is no email address on one of these orders and there cannot be, because the order is created without one and no account can ever be attached to it. These jobs are printed by us rather than sent to a print partner, so the Gelato arrangement described above does not apply to them. The courier is given the delivery name, address and phone number, because that is what delivering a parcel takes, and they may be in touch about the delivery itself — that contact is the courier’s, not ours. Beyond the courier we pass the details to nobody — other than the providers listed at the top of this section, who hold or carry everything on this system and are not a choice we make per parcel.

We also hold ordinary business details for the artist themselves — name, email address, phone number, billing address, a tax or company reference, and our own notes on working with them — so we can quote, invoice and keep the accounting record. Where the artist is a sole trader, those are details about a person and not only about a company, and our notes are part of what we hold about them. Taking an artist off the studio list hides the record rather than erasing it; a real deletion is something to ask us for.

If you are an artist thinking about using the press: your customer's details stay yours, and we will sign a written agreement with you that says so — what we may do with them, how long we hold them, who we tell if something goes wrong, and what we delete when the arrangement ends. Ask for it at [email protected] and we will have it in place before your first order. We do not have one with you until it is signed.

If you received a print from an artist and we printed it, the artist is who to ask about your details. They took your order and they decide what happens to your information — we only hold it to make the parcel, and we are not allowed to change or delete it without their say. Write to us anyway if that is easier — [email protected] — and we will pass it on to them and help them answer.

Panda Studio enquiries

If you fill in the enquiry form at mrpandadrawz.com/studio, we keep what you send so a person can read it and reply. That is your name and email address, a phone number if you gave one, a link to where you already sell if you gave one, your description of your work and what you need printed, and your note on volume if you added one. As we work through it we add a status and our own notes about the conversation. Those notes are part of what we hold about you, so they are yours to ask for.

Your enquiry lands in a queue a person opens and reads, and the reply is written by hand. Nothing is sent automatically, so do not wait for a confirmation email — there isn't one. An enquiry goes to nobody outside the studio. It is not a sign-up: the address is not added to the newsletter, not put into any marketing segment, and not sent to MailerLite.

We hold it on our legitimate interest in answering a business enquiry and working out whether the press has capacity to take it on. Once we are actually quoting you for a job, we also hold it because you and we are in the middle of agreeing one. We do not ask for your consent, so there is none to withdraw. You can object to us holding the enquiry instead, at the address in §10, and we will delete it.

The enquiry itself holds no IP address and no record of your browser. We do count submissions per internet connection, so the form cannot be flooded, and that counter holds your IP address briefly and separately from the enquiry — §6 says for how long. What you write is also screened automatically against a short list of things we will not print, the same screen a commission brief gets; an enquiry that trips it is refused rather than stored, so nothing of it is kept.

5. Cookies and tracking

We use a small number of cookies, grouped as follows:

Strictly necessary — login session, CSRF token, age-verification cookie. These cannot be turned off because the Site won't work without them.
Preferences — remember things like font size on the lore reader. Set on use, not on visit.
Analytics & advertising — Google Analytics 4, Google Ads conversion tracking, and the Meta (Facebook / Instagram) Pixel. Off by default. None of them is loaded, and no identifier is sent to any of them, unless you accept the consent banner. You can change your choice at any time from the cookie banner footer link.

Advertising click identifiers. If you arrive from an ad, the link may carry an identifier in the address — Google's gclid, Meta's fbclid, and the equivalents from TikTok and X. We record one of these against your order only if you have accepted analytics cookies. Its only purpose is to tell the ad platform that the click led to a sale, so we can see which advertising is worth paying for. If you have not consented, the identifier is discarded and nothing is reported back. The campaign tags a link can carry — utm_source, utm_medium and utm_campaign — are treated exactly the same way: recorded only with your consent, used only for that reporting, and deleted on the same 90-day limit.

Cloudflare Turnstile, on the sign-up and notify-me forms, is a security control rather than analytics: it is in the "strictly necessary" group above, it runs whether or not you accept the banner, and it is not used to track you between visits.

6. How long we keep it

Data	Retention
Active account information	While your account is open. When you delete it we immediately replace your email address with a one-way hash and remove your name, your password and your MFA secret; the emptied row stays behind the orders it is attached to, and nothing restores it
Purchase records	At least 5 years after the transaction, because tax and accounting law requires it — and we do not delete them on a timer after that. If you delete your account we immediately remove your name, email address and delivery address from the record, leaving the amounts, the dates and the destination country, which is what the tax treatment of the sale rests on
Audit logs	Kept for as long as the business record they describe — these are the trail behind every order, refund and price change, and they hold an account reference and the IP address and browser details of the request that made them, rather than your email address or your delivery address. Nothing deletes them on a timer
Age-verification records	24 months from verification (then expires; you can re-verify)
Your 18+ statement	Kept with the record it is on, for as long as that record is kept: an order with the purchase record, your account while it is open, a subscription with its record, an enquiry with the enquiry. It has no timer of its own
Newsletter sign-ups	Until you unsubscribe
Delivery addresses on orders	With the purchase record (5 years), because a tax invoice has to show where the goods went — on an order you placed with us. Deleting your account clears the address straight away, leaving only the destination country
In-person sale receipts	With the purchase record (5 years). A sale with no email attached stays anonymous permanently
Advertising click identifiers	90 days from the order, then deleted. They are only useful for reporting a conversion back to the ad platform, which happens well inside that window
Rate-limiting counters	Up to 24 hours. These hold a one-way hash of an email address, never the address itself, and are swept automatically — this is the counter that stops the same address being asked to receive a verification, password-reset or notify-me email over and over
Abuse counters on forms	At most about two hours. A second counter limits how often one internet connection, or one email address, can submit a form — including the Panda Studio enquiry form. It holds that IP address or email address as it is, not scrambled, and an hourly clean-up deletes it
Analytics data	Provider default (typically 14–26 months) — you can also clear via the consent banner
Things you post or send us	A public comment stays up until you or we take it down; deleting your account takes your name off it but leaves the comment itself. A commission brief, the messages on it and the reference images you sent are kept with the record of the work. Nothing deletes any of this on a timer, and deleting your account does not remove it — ask us and we will
Panda Studio enquiries	Nothing deletes one on a timer. We keep an enquiry while we are talking to you about printing; once it is closed or declined it is of no further use to either of us — see "Panda Studio enquiries" in §4
Details of an artist we print for	With the accounting record their invoices belong to (5 years). Taking an artist off our list hides the record rather than deleting it, and nothing deletes it on a timer
Delivery details on a parcel we print for another artist	Held with the order record so a delivery problem or a reprint claim can be answered. Nothing deletes them on a timer. How long they ought to be kept is the artist's call rather than ours, because the information is theirs, and we clear them when they tell us to
Adult-content settings	With your account, and reset when you close it
IP addresses recorded against a blocked or banned comment	Not deleted on a timer. A strike against an address stops counting after seven days but the row stays, and a ban with no end date is permanent

7. Your rights

Depending on where you live you have the right to:

Access the data we hold about you;
Correct information that is inaccurate;
Delete your data ("right to be forgotten") — subject to retention obligations above;
Object to processing based on legitimate interests;
Withdraw consent at any time for things you previously opted into;
Portability — receive your data in a portable format;- Portability — receive your data in a portable format, which you can download yourself from account settings if you have an account;
Lodge a complaint with the South African Information Regulator (inforegulator.org.za), or — if you live in the EU/UK — your local data-protection authority.

To exercise any of these, email us at the address in §10. We will answer within one month, and if a request turns out to be complicated enough that we need longer we will tell you inside that month and say why.

Two situations work differently from the rest. If you have no account here — because you wrote to us through the Panda Studio enquiry form, or because you are an artist we quote and invoice — the download in account settings cannot reach what we hold about you, so write to the address in §10 and a person will put it together by hand. And if we hold your delivery address only because another artist asked us to print something for you, we cannot act on an access, correction or deletion request ourselves: those details belong to the artist, and we are only allowed to do what they instruct. Send it to us anyway and we will pass it on and help them answer.

8. Security

We hold passwords as Argon2id hashes with a server-side pepper, run admin sessions with MFA (a till at a market can instead hold a 30-day PIN-locked credential, enrolled from an MFA session, limited to the point-of-sale screens, and revoked after five wrong PINs), store payment-card details only at Paystack, and keep originals of artwork outside the public web tree behind signed, time-limited URLs that can be individually withdrawn. No system is perfectly secure — if we ever discover a breach affecting your data, we will notify you and the Information Regulator within 72 hours of becoming aware, in line with PoPIA / GDPR requirements. The 72 hours is the GDPR's deadline, which we apply to everyone; PoPIA asks instead that we report as soon as reasonably possible, which we treat as sooner than that wherever we can. One case works the other way round: if a compromise touches delivery details an artist gave us for their own customer, we tell the artist immediately and it is they who notify that customer and the Regulator, because they are the responsible party and we are not the ones who may make contact.

9. Children

We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email us and we will delete it, except records the law requires us to keep.

10. Contact

Privacy questions, rights requests, or breach reports: Email: [email protected]. It reaches the owner, who is also the Information Officer for PoPIA purposes — the registered details, including the Regulator's registration number and the contact address on file, are published directly below this policy. If the two addresses ever differ, the one on that record is the current one.

11. Changes

We update this policy from time to time. The "Last updated" date above shows the most recent change. Material changes will be highlighted on the Site for at least 14 days.