Privacy Policy
Last updated: 26 September 2026
What changed on 26 September 2026: section 5 now states the legal basis for the cookieless visit counter and explains how it tells visits apart.
The short version
We sell files, not attention. We ask for an e-mail address when you write to us and when you buy, and we use it to answer you and to deliver what you paid for. We do not sell data, we do not build profiles, and we send marketing only to people who asked for it.
1. Who is responsible
Old Map Studio is run by one person, based in Slovakia. That person is the controller of the personal data described here. The business is not registered yet: the trader’s full name, IČO and DIČ will be published here and on a Legal Notice page before the shop starts selling. Until then the shop sells nothing: you can browse the maps and write to us, but no payment is taken.
Write to hello@oldmapstudio.com about anything on this page, including a request to see, correct or delete your data. We answer every message, usually within one working day.
2. When you write to us through the form
The form asks for one thing: your e-mail address. Everything else is optional. It also carries, prefilled, the name of the map you were looking at, so that we know what you are asking about and so that you can see it too.
| What | Why | Legal basis | How long |
|---|---|---|---|
| E-mail address, your message, the map you asked about, the page you came from | To answer you, and to count which maps people ask about | Steps at your request before a contract, Art. 6(1)(b); and our legitimate interest in knowing what our visitors want, Art. 6(1)(f) | 24 months from the last message in the thread |
The form is protected by Google reCAPTCHA v3, which scores the request to tell a person from a bot. Google processes your IP address and interaction data for that purpose as a separate controller.
3. When you ask to hear about new maps
There is a separate, unticked box for this, and it is never required. Ticking it is your consent under Art. 6(1)(a). We keep the address until you withdraw consent, and every message has a one-click unsubscribe link. Withdrawing consent does not affect anything sent before.
We do not add buyers to this list automatically. Buying a map is not a subscription.
4. When you buy a map
Payments are processed by Paddle, acting as our authorised reseller and merchant of record. You enter your payment details on Paddle's side; we never see or store a card number. Paddle passes us the information we need to fulfil and account for the order.
| What | Why | Legal basis | How long |
|---|---|---|---|
| E-mail address, order and licence details, country for tax purposes | To deliver the file, honour the licence, handle refunds and answer support | Performance of a contract, Art. 6(1)(b) | For the life of the licence and while support is possible |
| Invoice and transaction records | Accounting and tax obligations under Slovak law | Legal obligation, Art. 6(1)(c) | 10 years, as required by Slovak accounting and VAT rules |
| Record of your consent to immediate delivery | To show the withdrawal-right waiver was validly given | Legal obligation, Art. 6(1)(c), and Art. 6(1)(f) | 3 years from the order |
5. When you simply look around
The site sets the cookies it needs to work: a session identifier, your language and currency choice, and the contents of your cart. These are strictly necessary and are not used to track you.
Anything beyond that — analytics, advertising measurement — is set only after you agree to it in the cookie banner, and you can change your mind at any time from the same banner. The analytics service we use is Google Analytics 4, provided by Google Ireland Limited; advertising features and ad personalisation are switched off, so the data is not used to build advertising profiles.
We also count visits with Ahrefs Web Analytics, provided by Ahrefs Pte. Ltd. It sets no cookies and writes nothing to your browser's storage, so it is not part of the cookie banner and needs no consent. It records the page, the site you came from, the country and the type of device, in aggregate. To tell one visit from ten, it turns your IP address and browser identifier into a one-way code mixed with a random value that is replaced every 24 hours; according to Ahrefs, the IP address itself is discarded and never stored, and the code cannot link your visits across days or across websites. The legal basis is our legitimate interest, Art. 6(1)(f) GDPR, in knowing which maps people look at and whether the site works, without following anyone around. You can object at any time by writing to us.
Our server keeps standard access logs (IP address, time, page requested, browser), which are used to keep the site running and secure and are deleted after 30 days.
6. Who else is involved
We use a small number of service providers, each processing data only on our instructions and under a data processing agreement:
| Who | What for | Where |
|---|---|---|
| Paddle | Payments, invoicing, merchant of record | United Kingdom / EU / USA |
| netcup GmbH | Hosting the shop and storing the files | Austria (netcup data centre in Vienna) |
| Cloudflare, Inc. | DNS, content delivery, protection against attacks | USA, with EU edge locations |
| Brevo (Sendinblue SAS) | Sending order confirmations and replies | France |
| Google Ireland Limited | reCAPTCHA on the contact form | Ireland, with transfers to the USA |
| Ahrefs Pte. Ltd. | Cookieless visit statistics | Singapore (outside the EEA) |
Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or by an adequacy decision.
We do not sell personal data and we do not share it with anyone for their own marketing.
7. Your rights
Under the GDPR you may ask us to give you a copy of your data, to correct it, to delete it, to restrict what we do with it, or to send it to another provider in a portable form. You may object to processing we base on legitimate interest, and you may withdraw consent at any time where consent is the basis.
Ask by writing to hello@oldmapstudio.com. We answer within one month. There is no charge, and you do not need to explain why.
If you think we have got it wrong, you may complain to the Slovak data protection authority: Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho 7/B, 821 04 Bratislava — dataprotection.gov.sk. You may also complain to the authority in the country where you live.
8. Automated decisions
We do not make decisions about you by automated means, and we do not profile you. The reCAPTCHA score decides whether a form submission is accepted, and if it blocks you, writing to us by e-mail always works.
9. Children
This shop is not aimed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us data, write to us and we will delete it.
10. Security
The site runs over HTTPS. Files for sale are stored outside the publicly readable part of the server and are delivered through order-bound links. Access to the admin panel is restricted and logged.
11. Changes
If this policy changes, the date at the top changes with it. If a change matters to you — a new processor, a new purpose — we say so on this page rather than quietly editing a line.