Privacy Policy
_Last updated: 4 July 2026_
MaNoArt Gallery (“MaNoArt Gallery”, “website”, “store”, “controller”, “we”, “us”, or “our”) is committed to protecting personal data and respecting user privacy. This Privacy Policy explains how personal data is collected, used, disclosed, stored, and protected when visitors browse the website, contact MaNoArt Gallery, create an account, place an order, request information, or otherwise interact with the website and its e-commerce features.
This Privacy Policy is written to support compliance with Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”) and, where applicable, related national laws including German data protection requirements. It should be published together with a cookie banner and, where legally required, a separate cookie policy or consent management setup.
## 1. Controller
**Data controller:**
MaNoArt Gallery
Manola Petrocco
Peter-Timm-Strasse 1A, 22457 Hamburg, Deutschland
petroccomanola@gmail.com
The above entity is the controller of personal data processed through the website.
## 2. Scope of this policy
This Privacy Policy applies to personal data processed through:
- the public portfolio sections of the website;
- the e-commerce module and checkout process;
- contact forms and email communications;
- newsletter or marketing sign-up forms, if used;
- customer accounts, if available;
- analytics, cookies, and similar technologies, where implemented;
- social media or third-party integrations embedded in the website, where applicable.
## 3. Categories of personal data collected
Depending on how the website is used, MaNoArt Gallery may process the following categories of personal data:
### 3.1 Data provided directly by users
- Full name;
- billing address;
- shipping address;
- email address;
- telephone number;
- account login details, if account registration is available;
- purchase details, including products ordered, order value, and order history;
- messages sent through contact forms, email, or customer service requests;
- information voluntarily submitted in connection with commissions, inquiries, or portfolio-related contact.
### 3.2 Data collected automatically
- IP address;
- browser type and version;
- operating system;
- device type;
- referring website;
- pages visited;
- date and time of access;
- language preferences;
- technical logs and security-related metadata.
### 3.3 Payment and transaction data
Payments may be processed by external payment service providers. In such cases, MaNoArt Gallery generally receives transaction-related information necessary to confirm payment status, manage orders, prevent fraud, and handle refunds, but does not store full payment card details unless explicitly stated.
### 3.4 Cookies and tracking data
Where cookies, pixels, tags, or similar technologies are used, data may be collected regarding browsing behavior, preferences, session activity, cart retention, traffic sources, and interactions with content or products.
## 4. Purposes of processing and legal bases
Personal data is processed only where a valid legal basis under Article 6 GDPR applies.
| Purpose of processing | Types of data | Legal basis under GDPR |
|---|---|---|
| Operating the website and providing requested content | Technical usage data, IP address, logs | Article 6(1)(f) GDPR, legitimate interest in secure and functional website operation |
| Responding to inquiries sent through forms or email | Name, email, message content, related contact details | Article 6(1)(b) GDPR when responding to pre-contractual requests; Article 6(1)(f) GDPR for general communications |
| Processing and fulfilling orders | Identity, billing, shipping, order, transaction, communication data | Article 6(1)(b) GDPR, performance of a contract |
| Managing payments, refunds, and fraud prevention | Transaction data, contact data, order data, payment confirmation data | Article 6(1)(b) GDPR and Article 6(1)(f) GDPR |
| Creating and maintaining customer accounts | Account and login data, order history | Article 6(1)(b) GDPR |
| Sending newsletters or promotional communications | Email address, marketing preferences | Article 6(1)(a) GDPR, consent; in some cases Article 6(1)(f) GDPR where permitted by law |
| Analytics and non-essential cookies | Cookie identifiers, usage data, device/browser data | Article 6(1)(a) GDPR, consent |
| Complying with tax, accounting, and legal obligations | Billing, payment, order, and accounting records | Article 6(1)(c) GDPR, legal obligation |
| Establishing, exercising, or defending legal claims | Relevant transaction and communication data | Article 6(1)(f) GDPR, legitimate interest |
Where processing is based on consent, consent may be withdrawn at any time with effect for the future.
## 5. Orders and e-commerce processing
When a user places an order through the website, MaNoArt Gallery processes the personal data necessary to complete the transaction, including order administration, payment confirmation, shipping, delivery, invoicing, customer support, and where necessary return or refund handling.
Without the required personal data, the order cannot be processed or fulfilled.
## 6. Payment providers
The website may use third-party payment providers such as Stripe, PayPal, Shopify Payments, WooCommerce integrations, or similar services, depending on the technical setup actually used.
When users choose a payment method offered by a third-party provider, their payment data is processed directly by that provider under its own privacy terms. MaNoArt Gallery recommends listing each payment provider actually used on the website and linking to its privacy information.
Example wording for configuration after deployment:
- Stripe: [insert Stripe privacy policy link]
- PayPal: [insert PayPal privacy policy link]
- Other provider: [insert provider name and link]
## 7. Shipping and logistics providers
Where physical products are sold, personal data may be shared with shipping or logistics providers strictly to the extent necessary to prepare, dispatch, and deliver orders.
This may include:
- recipient name;
- shipping address;
- email address, if needed for delivery updates;
- phone number, if needed by the carrier;
- order reference and delivery information.
The website owner should list the actual shipping partners used, such as DHL, UPS, Hermes, DPD, or other carriers.
## 8. Contact forms and communications
When users contact MaNoArt Gallery by email or through a contact form, the data provided is processed to answer the request, provide customer support, manage pre-sales or post-sales questions, and keep a record of the communication where necessary.
If the communication relates to a potential purchase or commission request, processing may be necessary to take steps prior to entering into a contract.
## 9. Newsletter and direct marketing
If the website offers a newsletter, mailing list, or promotional emails, users will only receive such communications where legally permitted. In most cases this requires prior consent.
Where consent is required:
- subscription must be voluntary;
- the email address must be processed for the purpose of sending the requested newsletter;
- users must be able to unsubscribe at any time through a clear and simple mechanism.
If national law permits marketing to existing customers for similar products under a soft opt-in rule, this should be assessed specifically and implemented only if legally justified.
## 10. Cookies and consent management
The website may use cookies and similar technologies for essential and non-essential purposes.
### 10.1 Essential cookies
Essential cookies may be used without consent where strictly necessary for the operation of the website, such as:
- shopping cart functionality;
- secure login sessions;
- language preferences;
- security and fraud prevention;
- technical load balancing.
### 10.2 Non-essential cookies
Non-essential cookies, including analytics, advertising, retargeting, personalization, and social media tracking cookies, should only be activated after valid user consent where required by applicable law.
The website should use a consent banner or consent management platform that allows users to:
- accept all cookies;
- reject non-essential cookies;
- select categories of cookies;
- withdraw or change consent later.
If analytics or advertising tools are used, they should be listed here individually.
Example tools to specify only if actually used:
- Google Analytics;
- Meta Pixel;
- Pinterest Tag;
- Hotjar;
- Microsoft Clarity;
- Mailchimp tracking.
## 11. Recipients of personal data
Personal data may be disclosed, on a need-to-know basis, to the following categories of recipients:
- website hosting providers;
- e-commerce platform providers;
- payment processors;
- shipping and logistics companies;
- IT maintenance and security service providers;
- newsletter or CRM providers;
- analytics and marketing technology providers, where enabled with valid consent;
- accountants, auditors, legal advisors, and public authorities where legally required.
Personal data is not sold to third parties.
## 12. International data transfers
If personal data is transferred to recipients outside the European Economic Area (“EEA”), MaNoArt Gallery will ensure that such transfers take place only where permitted under GDPR.
This may include:
- an adequacy decision by the European Commission;
- Standard Contractual Clauses;
- other appropriate safeguards recognized under GDPR.
Users may request additional information on the safeguards used for international transfers, where applicable.
## 13. Data retention
Personal data is retained only for as long as necessary for the purposes for which it was collected, and thereafter only for as long as required by law or necessary for the establishment, exercise, or defense of legal claims.
Typical retention periods may include:
- contact inquiries: for the time needed to handle the request and a reasonable follow-up period;
- customer account data: until account deletion or for as long as the account remains active;
- order and invoice data: for the statutory retention period required under tax and commercial law;
- marketing consent records: for as long as needed to demonstrate consent and manage unsubscribe requests;
- technical logs: for a limited period required for security and troubleshooting.
Actual retention periods should be reviewed and adapted to the website’s real operational setup and legal obligations.
## 14. Data subject rights
Subject to the conditions set out in GDPR, users may have the following rights:
- the right of access under Article 15 GDPR;
- the right to rectification under Article 16 GDPR;
- the right to erasure under Article 17 GDPR;
- the right to restriction of processing under Article 18 GDPR;
- the right to data portability under Article 20 GDPR;
- the right to object under Article 21 GDPR;
- the right to withdraw consent at any time, where processing is based on consent.
To exercise these rights, users may contact MaNoArt Gallery using the contact details listed in this Privacy Policy.
## 15. Right to object under Article 21 GDPR
Where personal data is processed on the basis of legitimate interests under Article 6(1)(f) GDPR, users have the right to object, on grounds relating to their particular situation, to such processing at any time.
Where personal data is processed for direct marketing purposes, users have the right to object at any time to such processing, including profiling related to direct marketing.
## 16. Right to lodge a complaint
Users also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement.
If the controller is established in Germany, the competent authority may depend on the relevant federal state.
## 17. Security measures
MaNoArt Gallery implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
Such measures may include:
- HTTPS encryption;
- access restrictions;
- secure password practices;
- up-to-date software and security patches;
- backup and recovery procedures;
- role-based access where applicable.
However, no internet-based transmission or storage system can be guaranteed to be completely secure.
## 18. Requirement to provide data
The provision of certain personal data may be necessary to enter into a contract, complete a purchase, receive delivery, or obtain a response to an inquiry. If required data is not provided, MaNoArt Gallery may be unable to supply the requested service or complete the transaction.
## 19. Automated decision-making
MaNoArt Gallery does not carry out automated decision-making, including profiling, that produces legal effects concerning users or similarly significantly affects them, unless explicitly stated otherwise.
If such processing is introduced in the future, this Privacy Policy will be updated accordingly.
## 20. Children’s data
The website is not intended for children, and products or services are not knowingly offered directly to children where parental consent would be required by law.
If MaNoArt Gallery becomes aware that personal data has been collected from a child in violation of applicable law, reasonable steps will be taken to delete such data.
## 21. Third-party websites and embedded content
The website may contain links to third-party websites or embedded content from third-party services. Their operators process personal data under their own privacy policies.
MaNoArt Gallery is not responsible for the privacy practices of third-party websites or services that are not under its control.
## 22. Changes to this Privacy Policy
MaNoArt Gallery reserves the right to amend this Privacy Policy at any time in order to reflect legal, technical, or business developments.
The current version will always be published on the website with the updated effective date.
## 23. Website-specific completion checklist
Before publishing this Privacy Policy, replace all placeholders and tailor the text to the actual website setup. In particular, insert and verify the following:
- full legal name and contact details of the controller;
- actual hosting provider;
- e-commerce platform used;
- payment providers used;
- shipping providers used;
- newsletter provider, if any;
- analytics, advertising, and tracking tools actually active;
- actual retention periods where known;
- whether a customer account exists;
- whether user reviews, wishlists, or commission request forms are available;
- whether any international data transfers take place.
## 24. Contact regarding privacy
For all privacy-related requests, users may contact:
**MaNoArt Gallery**
Manola Petrocco
Peter-Timm-Strasse 1A, 22457 Hamburg, Deutschland
petroccomanola@gmail.com