Privacy policy
Last updated: September 2, 2026
This policy explains what personal information we collect, why we collect it, and what you can do about it.
Who is responsible
Rome Media Group BV, trading as PaperGoodsParty Pastoor Jacobsweg 100, 6226 VX Maastricht, the Netherlands Chamber of Commerce: 92806686 VAT: NL866179082B01 contact@papergoodsparty.com
Rome Media Group BV is the controller of the information described below. We sell to customers in the United States, and we operate from the Netherlands, so both US state privacy law and the European General Data Protection Regulation apply to how we handle your data. Where they differ, we follow the stricter rule.
What we collect
When you place an order: your name, email address, billing address, and the details of what you bought. Your payment card details go directly to our payment provider and never reach us.
When you visit the site: your IP address, browser and device type, the pages you view, and how you arrived here. This comes from cookies and similar technologies — see our Cookie Notice.
When you contact us: whatever you choose to put in your message.
When you sign up for emails: your email address and, if you give it, your first name.
We do not collect Social Security numbers, government ID numbers, precise location, biometric data, or any of the categories US law treats as sensitive.
Why we use it, and on what basis
| What we do | Why | Legal basis |
|---|---|---|
| Process and deliver your order | To give you what you paid for | Performance of a contract |
| Send order confirmations and download links | Same | Performance of a contract |
| Answer your emails | To help you | Legitimate interest |
| Detect and prevent fraud | To protect the shop | Legitimate interest |
| Understand how the site is used | To improve it | Consent |
| Send marketing emails | To tell you about new designs | Consent |
| Keep records for tax and accounting | Because we must | Legal obligation |
Who we share it with
We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we never have.
We share it only with the services that make the shop work:
- Shopify — our store platform, which hosts the site and processes orders
- Payment providers (Shopify Payments, PayPal, and similar) — to take payment
- Klaviyo — to send order emails and, if you opted in, marketing emails
- Our digital delivery app — to deliver your download
- Analytics providers — to measure site traffic, only where you have accepted analytics cookies
These providers may process your information in the United States or in Europe. Where data moves between the two, the transfer is covered by the EU–US Data Privacy Framework or by Standard Contractual Clauses approved by the European Commission.
We may also disclose information if the law requires it, or to protect our rights.
How long we keep it
Order and invoice records: seven years, as Dutch tax law requires of us. Marketing contacts: until you unsubscribe, plus a short period afterward so we can honor the request. Support emails: two years. Analytics data: as set by the provider, typically fourteen months.
Your rights
Wherever you live, you can ask us to:
- Give you a copy of the information we hold about you, and tell you what we do with it
- Correct anything that is wrong
- Delete your information, where we are not required to keep it
- Send your information to another provider
- Stop or limit a particular use
- Withdraw a consent you gave earlier
Email contact@papergoodsparty.com. We reply within 45 days, and usually much sooner. We may ask you to confirm your identity first, so that we do not hand your data to someone else. You may use an authorized agent to make a request on your behalf. We will never charge you or treat you differently for exercising these rights.
If you are in California, Virginia, Colorado, Connecticut, Texas, Oregon, or another state with a comprehensive privacy law, the rights above are the rights that law gives you, and you may appeal a decision you disagree with by replying to our response. If you are in the European Union, you may also complain to the Dutch data protection authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
Marketing emails
Every marketing email has an unsubscribe link at the bottom. One click and you are out. Order confirmations and download links are not marketing and will still be sent, because they are part of your purchase.
Children
This shop is not intended for children and we do not knowingly collect information from anyone under sixteen. If you believe a child has given us their information, email us and we will delete it.
Security
Payments run over an encrypted connection and card details never reach our systems. No method of transmission over the internet is completely secure, but we take reasonable steps to protect what we hold.
Changes
We will update this page when our practices change, and update the date at the top.