Privacy policy

The controller under the GDPR is:

Kassandra Flinterhoff
PG Sierra d'Espada 8, E3-P25
46120 Alboraya (Valencia), España
Email: hi@kassandra.studio
Phone: +34 611 780 510

I am a self-employed artist and have not appointed a data protection officer, as I am not required to.

This website is a portfolio without an online shop. I only process the data you send me yourself – via the contact form, by email or when you subscribe to my newsletter – and the technical data needed to deliver the website. There is no advertising tracking, no analytics and no cookie that requires consent.

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers). Cloudflare delivers the pages from its data centre closest to you, usually within the EU. Cloudflare processes data on my behalf under a data processing agreement; transfers to the USA are based on the EU Standard Contractual Clauses, and Cloudflare is certified under the EU-US Data Privacy Framework.

When you visit the website, the hosting provider automatically processes technical data that your browser transmits: IP address, date and time, page requested, browser and operating system. This is necessary to deliver the website securely (legal basis: Art. 6(1)(f) GDPR, legitimate interest in a stable and secure website). I do not keep server log files myself; Cloudflare's technical logs of the website are deleted after a few days (currently 3 days).

When you write to me via the contact form, by email, phone or messenger, I process the data you provide (name, email address, optionally phone number, your message and any photos you attach) to answer your inquiry and, if you wish, to prepare an offer for an artwork, print, commission or collaboration.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request) and, for general inquiries, Art. 6(1)(f) GDPR (legitimate interest in answering messages). Your data is not used for advertising and not passed on to third parties, except to the service providers who process it on my behalf: messages from the contact form are delivered to my mailbox by Resend, Inc. (USA; sent via servers in Ireland), and my mailbox is hosted by Google Ireland Limited (Google Workspace). Both act under data processing agreements; transfers to the USA are based on the EU Standard Contractual Clauses.

I delete inquiries that do not lead to a contract no later than 12 months after our last contact. If a contract is concluded, section 6 applies.

For custom silhouettes and commissions you may send me photos of yourself or other people (for example your partner or your children). Please only send photos you are allowed to share; for children, the consent of the parents is required. I use the photos exclusively as a template for your artwork and delete them once the commission has been completed. I will only show the finished artwork in my portfolio or on social media with your express consent, which you can withdraw at any time.

If you buy an artwork or print or commission a painting, I process your name, address, email address and, where applicable, phone number to fulfil the contract, issue the invoice and ship your order (Art. 6(1)(b) GDPR). For shipping, I pass your name and address to the shipping company. For canvas prints produced by Galerie Munk (Günzburg, Germany), your delivery address may be passed on to Galerie Munk if it ships directly to you.

Invoices and accounting records are kept for as long as required by Spanish commercial and tax law (generally six years, Art. 30 Código de Comercio; Art. 6(1)(c) GDPR).

If you subscribe to my newsletter, I process your email address, optionally your first name and the topics you have chosen (Artworks & Insights and/or Art Classes & Workshops) in order to send you the newsletter. Legal basis is your consent (Art. 6(1)(a) GDPR; Art. 21 LSSI-CE).

I use the double opt-in procedure: after signing up you receive an email asking you to confirm your subscription. Only after this confirmation will you receive the newsletter. I store the time of registration and confirmation and your IP address to be able to prove your consent.

You can unsubscribe at any time via the link in every newsletter or by email. Your data will then be deleted from the mailing list; I keep the proof of consent for as long as claims can be made against me.

The newsletter is sent via Resend, Inc., San Francisco, USA. The emails go out through Resend's servers in Ireland (EU); Resend stores the subscriber list (email address, first name, topics, language and the proof of consent described above) in the USA. Resend processes this data on my behalf under a data processing agreement; transfers to the USA are based on the EU Standard Contractual Clauses, and Resend states that it is certified under the EU-US Data Privacy Framework. Resend does not use the data for its own purposes.

This website does not use advertising or analytics cookies and does not include any third-party tracking. The only data stored in your browser is technically necessary or serves a function you have chosen yourself (for example, a remembered display setting). No consent is therefore required (Art. 22(2) LSSI-CE).

Fonts are hosted on the website's own server; no connection is made to Google or other font providers.

The website links to Instagram, Google Maps and press articles. These are plain links: no data is transferred to these services until you click on them. After that, the privacy policies of the respective providers apply.

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability and to withdraw your consent at any time with effect for the future (Art. 15–20 and 7(3) GDPR). To exercise these rights, a short email to hi@kassandra.studio is enough.

Right to object: Where I process your data on the basis of legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for me is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

I will update this privacy policy if the website or the services I use change. The current version is always available on this page; all three language versions have the same content and date.