Privacy Policy

This website is operated by [your name / business name], [street and number], [postal code, city], [country]. For any question about this policy or about your personal data you can reach me at [your@email.com] or [phone number]. [Chamber of Commerce number, if applicable.]

Personal data is only collected when you choose to send a message through the contact form on this website, either from the Contact page or from the “Interested in this work” button in the Gallery. The form asks for:

• Your name
• Your email address
• Your phone number (optional)
• The content of your question or message, and — when you enquire about a specific painting — the title of that work

No account is required, and no special categories of personal data are requested.

Your data is used for one purpose only: to read your message and reply to you about your enquiry, a painting, a commission or an exhibition. It is never used for profiling or automated decision-making, and it is never sold or rented.

[If you plan to send a newsletter or other marketing, describe that here and explain that it only happens with separate, explicit consent.]

Under Article 6 of the General Data Protection Regulation, the processing of the data you submit is based on your consent, given when you voluntarily complete and send the contact form, and on the legitimate interest of responding to an enquiry you have made. Where a request may lead to a sale or commission, processing may also be necessary in order to take steps at your request prior to entering into a contract.

Messages and the contact details they contain are kept for as long as needed to handle your enquiry and any resulting correspondence, and are then deleted. As a guideline, enquiries that do not lead to a sale are removed after [e.g. 12 months]. Where a sale takes place, the related records are kept for [e.g. 7 years] to meet statutory administrative and tax obligations.

Your data is read by [your name] only. It may be stored with the service providers used to run this website and its email, such as [hosting provider] and [email provider], who act as processors and may only process the data on my instructions. [Name any other third parties here, for example a payment provider.] Data is not transferred outside the European Economic Area unless an appropriate safeguard, such as the European Commission’s standard contractual clauses, is in place.

This website does not use tracking cookies or advertising cookies. [If you later add analytics or embedded content, describe it here and state whether consent is asked.]

Under the GDPR you have the right to access the personal data held about you, to have inaccurate data corrected, to have your data erased, to restrict or object to its processing, and to receive your data in a portable format. Where processing is based on consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, write to [your@email.com]. You will receive a reply within one month. If you believe your data is not handled properly, you also have the right to lodge a complaint with your national supervisory authority — in the Netherlands this is the Autoriteit Persoonsgegevens.

Reasonable technical and organisational measures are taken to protect your data against loss or unauthorised access, including encrypted connections to this website and access-protected email and storage. [Add any further measures you take.]

This policy may be updated when the website or the way enquiries are handled changes. The date at the top of this page shows when it was last revised.