Privacy policy

Last updated: October 6, 2026

This Privacy Policy describes how Cosmic Code Tees (the "Site", "we", "us", or "our") collects, uses, and discloses your personal information when you visit cosmiccodetees.com, use our services, make a purchase, or otherwise communicate with us (collectively, the "Services"). In this policy, "you" means a customer, website visitor, or other person whose information we process.

Our store is powered by Shopify. The business responsible for operating the store and acting as controller of your personal information is identified in the Contact section at the end of this policy, except where another provider acts as an independent controller as described below.

Please read this policy carefully. Visiting our website or reading this policy does not, by itself, constitute consent to optional cookies, tracking, or marketing.

Changes to This Privacy Policy

We may update this policy to reflect changes to our practices or legal requirements. We will update the date above and provide additional notice where required, including for material changes.

How We Collect Your Personal Information

The information we collect depends on how you interact with the Services. Personal information means information that identifies you or can reasonably be linked to you.

Information We Collect Directly from You

Depending on the features you use, we collect:

• Contact and delivery details: your name, email address, billing and shipping addresses, and telephone number where provided.
• Order and transaction details: products, sizes and colours selected; purchases; payment confirmations; shipping details; and information needed to handle cancellations, complaints, replacements, or refunds.
• Payment information: information needed to process a transaction is collected by our payment providers. Payment information available to us depends on the payment method and provider and may include transaction references and limited payment details.
• Account information: information used to create and manage a customer account, where that feature is used.
• Customer communications: messages, order references, photographs, and other information you send when requesting help or exercising your rights.
• Marketing preferences: subscription status, consent records, and communication preferences.

Information We Collect Automatically

We collect device and usage information such as IP address, browser and device details, identifiers, pages viewed, and interactions with our store. Cookies, pixels, and similar technologies may collect this information, subject to applicable tracking choices and legal requirements.

Information We Obtain from Third Parties

We obtain information from providers involved in payments, fulfilment, delivery, store operation, and other services you use. This can include transaction confirmations, delivery updates, and information supplied by technical, analytics, or advertising providers where those services are used and the processing is permitted.

You do not have to subscribe to marketing to buy from us. Some information, such as delivery details, is needed to fulfil an order. Without that information, we may be unable to complete the purchase or provide the service you request.

How We Use Your Personal Information

Where the GDPR applies, we use the following legal bases:

• Contract: to take steps at your request before a purchase, process orders and payments, arrange printing and shipping, provide order updates, and handle order-related support and remedies.
• Legal obligations: to keep required accounting records, meet tax obligations, and respond to legally binding requests.
• Legitimate interests: to protect our store and customers against fraud and misuse, maintain service security, resolve disputes, and manage business communications, where these interests are not overridden by your rights. We do not use this basis to bypass consent requirements for tracking or marketing.
• Consent: for optional cookies and similar technologies where required, and for marketing activities that require your consent. You may withdraw consent without affecting the lawfulness of processing carried out before withdrawal.

We use information to operate and improve the store, communicate with you, and offer marketing or personalised advertising where permitted by law and your choices. Order communications, such as dispatch updates or replies to a complaint, are separate from promotional communications.

Cookies and Similar Technologies

We use cookies and similar technologies for essential store functions, such as maintaining a shopping session and supporting checkout. Optional technologies may be used for analytics, preferences, and advertising, subject to applicable law and your choices.

Where prior consent is required, non-essential tracking must not be enabled before that consent. You can make or change your choices through the cookie controls provided for your location. You can also manage cookies in your browser, although blocking essential cookies may affect checkout and other functions. Browser controls do not replace the privacy choices available through the store.

For information about Shopify's cookies, visit Shopify Cookie Policy.

How We Disclose Personal Information

We disclose information as needed for the purposes described in this policy to:

• Shopify and providers supporting our store, hosting, and technical services;
• payment providers processing transactions;
• printing and fulfilment providers, and delivery companies, receiving the information needed to make and deliver your order;
• providers supporting customer service, analytics, marketing communications, or advertising, where those services are used and the disclosure is permitted;
• professional advisers and public authorities where necessary to comply with law, establish or defend claims, or obtain professional services; and
• parties involved in a business transfer, where necessary and subject to applicable safeguards.

Some providers act on our instructions; others process information as independent controllers under their own privacy policies. We disclose information necessary for the relevant purpose rather than giving every provider access to all customer information.

Relationship with Shopify

Shopify hosts our store and processes information to provide its services. Certain Shopify features can also involve Shopify using information from your interactions with our store, other merchants, and Shopify to provide and improve services, including personalised advertising where enabled and permitted. For processing where Shopify acts as an independent controller, Shopify is responsible for responding to requests about that processing.

You can read the Shopify Consumer Privacy Policy at Shopify Consumer Privacy Policy and access Shopify's privacy portal at Shopify Privacy Portal.

Advertising and US Privacy Choices

Depending on the advertising tools used, disclosing identifiers or online activity to advertising partners may constitute a "sale", "sharing", or processing for "targeted advertising" under certain US privacy laws. These terms can apply even where no money is exchanged for personal information.

Where applicable, you can request an opt-out through Your Privacy Choices or by contacting support@cosmiccodetees.com.

Where required by applicable law, we recognise Global Privacy Control (GPC) as an opt-out preference signal for the browser or device sending it. Shopify may also apply the preference to an associated account where it can identify that account. Other browser "Do Not Track" signals are not treated as equivalent to GPC. Opting out does not prevent processing needed to fulfil your purchase or meet legal obligations.

User-Generated Content

If you submit information for a public product review or another public feature, information you choose to publish may be visible to others. Please do not include information you do not want to make public.

Third-Party Websites and Links

External websites linked from our store have their own privacy practices. This policy does not govern those websites.

Children’s Data

Our store is not directed at children, and we do not knowingly collect their personal information. If you believe a child has provided information to us, contact us so we can assess and address the matter. We do not knowingly sell or share, as defined by applicable law, personal information of children under 16.

Security and Retention of Your Information

We use appropriate measures to protect personal information, but no system can guarantee absolute security. Please avoid sending full payment-card details or other unnecessary sensitive information by email.

Retention

Retention depends on the type of record and its purpose:

• Orders and accounting records: retained for applicable tax and bookkeeping requirements. Where Norwegian bookkeeping rules apply, primary accounting documentation is generally retained for five years after the end of the relevant financial year. Different rules or a specific legal requirement may require a different or longer period.
• Customer support and disputes: retained while the matter is being handled and, where needed, until the relevant claim period has expired or a dispute or legal hold has ended.
• Customer accounts: retained while the account is maintained. Closing an account does not automatically remove records we must keep for orders, accounting, or legal reasons.
• Marketing records: used until you unsubscribe or withdraw consent, or until the subscription is otherwise ended. Limited suppression and consent records may be retained to honour your preferences and demonstrate compliance.
• Device and analytics data: retention is determined by the relevant tool's configured retention period and the duration needed for its documented purpose. Cookie expiry depends on the individual cookie.

You can contact us for information about the retention period applicable to a particular category of your data. At the end of the applicable period, information is deleted or anonymised unless continued retention has a lawful basis.

Your Rights and Choices

Depending on your location and applicable law, you may have rights to:

• access your personal information and obtain information about its use;
• correct inaccurate information;
• request deletion, subject to exceptions such as legally required record retention;
• restrict processing;
• receive eligible information in a portable format;
• object to processing based on legitimate interests, including objecting to direct marketing;
• withdraw consent where processing relies on consent;
• opt out of sale, sharing, or targeted advertising where applicable; and
• appeal a refusal where applicable law provides that right.

To make a request, email support@cosmiccodetees.com. We may request proportionate information to verify your identity or an authorised agent's authority. We will not discriminate against you for exercising your privacy rights.

Where the GDPR applies, we normally respond within one month. If a permitted extension is necessary because of the complexity or number of requests, we will inform you within that first month and explain the reason. Other applicable laws may provide different deadlines.

You may unsubscribe from promotional emails using their unsubscribe link. We may still send necessary order-related or other non-promotional messages.

Complaints

If you have a privacy concern, contact support@cosmiccodetees.com. You can also complain to the Norwegian Data Protection Authority, Datatilsynet, at Datatilsynet, or to the competent supervisory authority in the country where you live or work or where you believe an infringement occurred. You do not have to contact us first to exercise that right.

International Users and Transfers

Shopify and other providers may process information outside Norway or your country, including in the United States. Where information is transferred outside the EEA or the UK, we use the applicable legal transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, together with additional safeguards where required.

Contact us for more information about the safeguards applicable to a particular transfer and how to obtain a copy where available.

Contact

For questions about this policy or to exercise your privacy rights, email support@cosmiccodetees.com.

The controller of personal information processed for operating Cosmic Code Tees, fulfilling orders, and managing customer relationships is:

ADAM KWIECIEN STUDIO, trading as Cosmic Code Tees
Norwegian sole proprietorship (ENK)
Organisation number: 835 997 022
Sigerstadveien 73
1630 Gamle Fredrikstad
Norway