Legal

Privacy Policy

1. Controller

[Full legal name], [street, postcode] Delmenhorst, Germany — e-mail: studio@marlet.com.ua.

2. What we process, and why

a) Website hosting

This website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit the site, the server processes technical access data (IP address, date and time, requested page, browser information) to deliver the pages securely and to detect abuse. Legal basis: Art. 6 (1)(f) GDPR — legitimate interest in operating the website. Data transfer to the USA is safeguarded by the EU Standard Contractual Clauses; we have concluded a data processing agreement with Vercel.

b) Orders and payment

When you place an order we process your name, e-mail address, delivery address, phone number (optional), the ordered items and payment status — to perform the contract (Art. 6 (1)(b) GDPR). Payments are processed by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin, Ireland). Your card or payment details are entered directly on Stripe's secure payment page and never reach our server. Stripe is an independent controller for the payment transaction; see Stripe's privacy policy.

c) Availability and reservations

While you check out, a short-lived reservation for the selected artwork (product ID and a random browser token — no name or address) is stored in a database operated by Upstash, Inc. so that the same original cannot be sold twice. Reservations expire automatically after about 30 minutes. Legal basis: Art. 6 (1)(b) GDPR.

d) Transactional e-mail

Order confirmations and replies are sent via Resend (Plus Five Five, Inc., USA) using your e-mail address and order details. Legal basis: Art. 6 (1)(b) GDPR; transfers are safeguarded by EU Standard Contractual Clauses.

e) Commission enquiries

If you use the enquiry form we process the data you provide (name, e-mail, message) to answer you (Art. 6 (1)(b) GDPR). To protect the form against abuse, the request rate per IP address is limited; the IP is not stored longer than technically necessary.

f) Newsletter

If you subscribe to the studio letter we store your e-mail address on the basis of your consent (Art. 6 (1)(a) GDPR), confirmed by double opt-in. You can unsubscribe at any time using the link in each letter or by writing to us.

g) Local storage — no tracking

Your cart and wishlist are stored only in your own browser (localStorage) and are not transmitted to us until you order. We use no tracking cookies and no advertising or analytics services; that is why you see no cookie banner.

3. Retention

Order and invoice data are kept for the statutory retention periods of German commercial and tax law (up to 10 years, § 147 AO). Enquiries are deleted once the conversation is finished, unless a contract follows.

4. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), and the right to lodge a complaint with a supervisory authority — for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.