Privacy notice
Last updated: October 2026
GVDesign is operated by Vishnudaya Dayalam, an individual based in Malaysia. Vishnudaya Dayalam is the data controller for personal data collected through this site, meaning we decide how and why it is used.
What we collect and why
- Contact details (name, email) — to deliver your order, send receipts and answer support requests.
- Order details (which artwork you bought, order number) — to provide your download and handle refunds.
- Support messages you send us — to help you.
- Technical data (IP address, browser and device information) — to keep the site secure and prevent fraud.
Legal basis
We process your data to perform our contract with you (delivering your purchase), for our legitimate interests (security, fraud prevention and improving the shop), and to meet legal obligations such as tax and accounting records.
Who we share it with
- Paddle, our Merchant of Record, which handles the sale, payments, tax compliance and invoicing.
- Service providers that host and run this website.
- Professional advisers (such as accountants) where needed.
- Authorities, when required by law.
We never sell your data or share it with advertisers.
How long we keep it
We keep order records for as long as required for tax and accounting purposes (usually up to 7 years) and other data only as long as needed for the purposes above. After that it is deleted or anonymised.
Security
We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, access controls and trusted providers.
International transfers
Our providers may process data outside your country. Where they do, appropriate safeguards such as standard contractual clauses are used.
Cookies
We only use essential cookies and similar storage needed for the site and checkout to work. We do not use advertising cookies.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or export your data, object to processing, withdraw consent, and complain to a data protection authority. To exercise these rights, contact us; we aim to respond within one month.