Privacy

Who handles your data

• Controller: Detail still to be filled in: [FULL NAME OF THE OWNER], Spanish tax number Detail still to be filled in: [NIF]
• Address: Detail still to be filled in: [POSTAL ADDRESS OF THE STUDIO]
• Email for anything about your data: Detail still to be filled in: [CONTACT EMAIL]

Whatever you leave here is handled by the artist who runs this site, and by nobody else. It is never sold, never handed over for commercial purposes, and never used to profile you or to decide anything about you automatically.

What is kept, what for, and on what grounds

• Account: your email, the name you want to be called by and the language you prefer. So that your account exists and you can be written to when needed. Grounds: the contract you open by signing up.
• Purchases: shipping address, billing details and what you ordered. So the parcel arrives, the sale can be charged, and the tax and accounting duties of a sale are met. Grounds: the sales contract and the law.
• Comments: the name you sign with and what you write; your email only if you leave it, never published, used to tell you about replies. Grounds: your consent, which you can withdraw.
• Support tips: the amount and —only if you leave them— your name, your message and your email, as support can be given in silence. Grounds: the payment contract and accounting law.
• Shop emails: order confirmation, dispatch notice and receipt. Grounds: the contract.
• Acceptances: which version of the terms you accepted when you signed up and on each order, and the exact moment. Nothing else about that gesture is kept. Grounds: the duty to be able to evidence consent and prior information; it also works in your favour, as it pins down which text you were shown.
• Visits: counted on our own server, with no cookies, without storing your IP address, with no way of identifying you, and only if you accept. Grounds: your consent, given or refused in the cookie notice and changeable whenever you like; until you say yes, your visit is not counted.
• Security: failed sign-in attempts and the pace of form submissions are noted, to hold back spam and attacks. Grounds: the legitimate interest of keeping this standing.

Who else sees it

Only whoever is needed for this to work:

• The payment gateway, Stripe, which handles your card details without this site ever seeing them.
• The carrier who delivers your parcel: Detail still to be filled in: [CARRIER].
• The provider hosting the server: Detail still to be filled in: [HOSTING PROVIDER].

Some of these services may handle data outside the European Economic Area. When that happens it is done with the safeguards the General Data Protection Regulation requires: standard contractual clauses or an adequacy decision.

How long it is kept

• Your account: as long as you want it. When you delete it, it is deleted. It does not expire from disuse: closing your account because you have not dropped by in a year would be deciding for you.
• Orders and invoices: six years from the sale, because Spanish commercial and tax law require it, even if you close your account. Once the term is up, your email and your address go and only the figures and the certificate of the piece stay, which no longer say who you are.
• Purchases left half-way that were never charged: ninety days. With no sale there is nothing to keep.
• Support tips: the ones that were charged, the same six years as an order and with the same pruning when the term is up; the ones never paid, ninety days.
• Comments: for as long as they are public. If you delete your account, the comment stays without your name or your email: the conversation is not left full of holes. The ones taken down and the ones set aside as spam are deleted for good after ninety days.
• Acceptances: as long as whatever they belong to —the one on your account goes with your account, the one on each order lasts as long as the order—. They are a version and a date: they do not say who you are.
• Saved pieces: as long as you want them on your list; they go with the account.
• Your basket: ninety days untouched and it empties itself.
• The emails sent to you: the copy kept in order to send them is deleted ninety days after they go out.
• Visit counts: one hundred and eighty days, and then they delete themselves.
• Your cookie choice: one hundred and eighty days in your own browser, and then you are asked again. It is kept in no database: the only copy is the one in your browser.
• Open sessions: they expire on their own and close when you sign out; the trace of a session already closed is deleted after thirty days.

None of these terms is an intention: they are written in a single place in the program and there is a task that carries them out on its own, with nobody having to remember.

What you can do

You can access your data, correct it, delete it, restrict its use, object to it and take it elsewhere. Two of those are one click away on your account page: download everything held about you and delete the account, without asking anyone. For anything else, write to Detail still to be filled in: [CONTACT EMAIL] and you will get an answer within a month.

If you think something has been done wrong you can complain to the Spanish Data Protection Agency (www.aepd.es). Before that, if you like, write to the studio: almost everything is settled by talking.

Children

This site is not aimed at children under fourteen and no data is knowingly asked of them.

How it is looked after

Passwords are stored hashed and there is no way to read them, not even from the studio; the connection always runs over HTTPS and your card details never pass through this site.