Legal
Privacy Policy
Version 2026-09-04-v2 · 4 September 2026
1. Controller and contact
The definitive controller identification is pending and data-collection forms are disabled. Privacy requests: .
2. Data, purposes and legal bases
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, telephone and country | Reply to the enquiry and manage the relationship | Steps requested before entering into a contract; performance of a contract |
| Artwork preferences, story, budget and timing | Assess feasibility and prepare an individual proposal | Pre-contractual steps requested by you |
| Reference photographs and file metadata | Study the subject and create the requested artwork | Pre-contractual steps and contract performance |
| Security and request logs | Prevent abuse, protect forms and diagnose faults | Legitimate interests in service and information security |
| Billing and transaction data, if a contract is concluded | Billing, accounting and compliance with legal duties | Contract performance and legal obligation |
| Analytics identifiers, only if accepted | Measure website use and improve content | Consent, which may be withdrawn at any time |
3. Source and required fields
Most data is supplied directly by you. Fields marked with an asterisk are needed to assess and answer an enquiry; without them, the request cannot be submitted. Telephone, photographs and non-marked preferences are optional unless later needed for an agreed commission.
4. Photographs, third parties and publication
Reference photographs are private working materials. Please only submit files you are entitled to share and avoid unnecessary personal or sensitive information. If another identifiable person appears, you must have a lawful reason to provide the image. Submission never authorises publication, advertising, social-media use or disclosure of names or locations. Any publication requires a separate and specific agreement.
5. Recipients and international transfers
Access is limited to the artist and, where necessary, hosting, email, website-security, accounting, legal, payment and delivery providers acting under appropriate duties. Optional Google Analytics or Meta Pixel services are only activated after consent. Where a provider processes data outside the European Economic Area, an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, must support the transfer. More information about the providers actually in use may be requested from the privacy contact.
6. Retention
| Record | Normal period |
|---|---|
| Open or unanswered enquiries | 24 months from submission or latest relevant update |
| Declined enquiries | 12 months after closure |
| Completed commission record and private files | 60 months after completion, unless a claim requires longer retention |
| Rate-limit/security records controlled by this application | 30 days |
| Invoices, accounting and legally required records | For the mandatory statutory period |
An authorised administrator may delete a record earlier where lawful. Expired enquiry records and their uploads are removed by the site’s scheduled retention task.
7. Security and automated decisions
The application uses access control, CSRF protection, restricted private storage, random file names, MIME validation, upload limits, rate limiting and encrypted HTTPS transport when correctly deployed. No decision producing legal or similarly significant effects is made solely by automated means.
8. Your rights
Under applicable law, you may request access, rectification, erasure, restriction, portability or objection. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Requests should be sent to . Identity may be verified proportionately. A response is normally provided within one month, subject to the extensions permitted by law.
9. Complaints and updates
You may complain to your local supervisory authority. In Portugal, the authority is the Comissão Nacional de Proteção de Dados (CNPD). Material policy changes will be identified by a new version and date; where required, a new choice will be requested.