Privacy

1. Controller

The controller of your personal data is Anna Harsanyi-Zorandy:

Name

Anna Harsanyi-Zorandy

Address

Heggenstraat, 6211 GW Maastricht

Email

studio@annaharsanyi-zorandy.com

KVK (Chamber of Commerce)

82891605

For any privacy question or request, contact us at studio@annaharsanyi-zorandy.com.

2. What we collect and why

• Buyers (Buy Now and auction winners): name, email address, phone number, delivery address, the work bought, amounts paid, payment status and shipping details. Purpose: to perform the contract, take payment, ship the work and handle returns and complaints. Legal basis: performance of a contract (Art 6(1)(b) GDPR) and our legal obligations, such as tax record-keeping (Art 6(1)(c)).
• Bidders: name, email address, delivery country and address, your bids (amount and time), and a reference to your Stripe customer record and saved card. Purpose: to run the auction, verify that you can pay, charge the winning bid and send bid notifications such as “you have been outbid”. Legal basis: performance of a contract and steps taken at your request before entering into one (Art 6(1)(b)). Your full card details are held by Stripe, not by us.
• Bidder session cookie: after you register as a bidder we set a signed cookie (bidder_session) for 180 days, so you stay recognised as a registered bidder on this device. It contains only an identifier and a signature. It is strictly necessary for the bidding service you asked for, so no consent is required. We do not use analytics, advertising or tracking cookies.
• Contact form and inquiries: your name, email address, phone number (optional), message and, where given, an offer amount and the work concerned. Purpose: to answer you. Legal basis: steps at your request before a contract (Art 6(1)(b)) or our legitimate interest in answering messages (Art 6(1)(f)).
• Technical data: our hosting provider processes IP addresses and request logs to deliver the website and keep it secure. Legal basis: legitimate interest in a secure, working website (Art 6(1)(f)).

You are not obliged to give us your data, but without the details needed for payment and delivery we cannot sell you a work or let you bid. We do not use automated decision-making or profiling with legal effects.

3. Who processes your data for us

• Stripe (payments, saved cards, payment links). Stripe also processes some data as an independent controller, for example to prevent fraud and meet financial regulations; see Stripe’s own privacy policy.
• Supabase (database and file storage, hosted in the European Union).
• Vercel (website hosting and delivery).
• Resend (sending transactional emails such as receipts, winner and outbid notices).
• Shipping carriers and art handlers receive your name, delivery address and phone number to deliver your work.

We have data processing agreements with our processors. We do not sell your data.

4. Transfers outside the EEA

Some of these providers, or their sub-processors, are based in or give access from the United States or other countries outside the European Economic Area. Where that happens, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework, for certified recipients) or on the European Commission’s Standard Contractual Clauses. When we ship a work outside the EEA, your delivery details are transferred to the carrier and the destination country’s customs authorities because this is necessary to perform the contract (Art 49(1)(b) GDPR). You can ask us for a copy of the relevant safeguards.

5. How long we keep it

• Orders, invoices and payment records: 7 years, as required by Dutch tax law.
• Bidder accounts and bids that did not lead to a purchase: up to 2 years after your last bid.
• Contact inquiries: up to 2 years after our last contact, unless they lead to a purchase.
• The bidder session cookie: 180 days, or until you clear your cookies.
• Saved cards are kept by Stripe until you ask us to delete your bidder account.

6. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to data portability, and to object to processing based on our legitimate interests. To use these rights, contact us at studio@annaharsanyi-zorandy.com. We will answer within one month.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also contact the authority in the country where you live or work.

7. Changes

We may update this notice. The current version is always on this page.