Privacy & Cookie Policy

Data controller

The data controller is Elena Teggi, artist, based in the province of Varese, Italy. For any request regarding your personal data, you can contact us through the form on the Commissions page.

Data collected through the contact form

When you use the contact form, we collect your name, email address, the subject of your request, an optional reference to a specific painting, and the message you send us. This data is used solely to respond to your request and is not shared with third parties, except for the technical providers listed below that are necessary to send the email. Legal basis: consent and pre-contractual measures (Art. 6(1)(a) and (b) GDPR).

Data collected during purchase

When you purchase a painting, payment is handled entirely by Stripe, our payment services provider. Stripe collects and processes your payment card details, name, email address and shipping address: this data never passes through or is stored on our servers. We only receive from Stripe the information strictly necessary to fulfil your order (name, email, shipping address, purchased work, amount paid). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Cookies and local storage

This website does not use profiling cookies or third-party analytics or advertising tracking tools. The shopping cart uses your browser's local storage solely to remember the works you have selected while browsing: this data stays on your device and is not transmitted to our servers until you proceed to payment.

Providers and third parties

To operate this website we rely on the following providers, each of which processes data according to its own privacy policy:

• Stripe — secure payment processing
• Resend — sending order confirmation emails and contact form replies
• Vercel — website and server function hosting
• Neon — database for managing the catalogue and orders
• Cloudinary — hosting of painting images

Some of these providers are based outside the European Economic Area; in such cases, data transfers take place in compliance with GDPR safeguards, including the European Commission's standard contractual clauses.

Data retention

Order-related data is retained for as long as necessary to fulfil the purchase and to comply with tax and accounting obligations under Italian law. Messages received through the contact form are retained only for as long as necessary to handle your request.

Your rights

As a data subject, you have the right to access your data, request its rectification, erasure or restriction of processing, object to processing, and request data portability (Art. 15-21 GDPR). You can exercise these rights by contacting us through the form on the Commissions page. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

Security

This website uses secure HTTPS/TLS connections for all communications. No payment card data ever passes through or is stored on our servers: the entire payment process is handled by Stripe, a PCI-DSS Level 1 certified provider.

Changes to this policy

This policy may be updated periodically to reflect changes in our practices or legal obligations. The date of the last update is shown at the top of this page.