Privacy Policy
Last updated: October 2026
KsaveraART (“we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information in accordance with the EU General Data Protection Regulation (GDPR).
1. Data Controller
The data controller responsible for processing your personal data is:
KsaveraART
Artist: Ksavera (Ksenia Sarmatova)
Germany
Email: ksaveraart@pm.me
2. Information We Collect
We collect the following categories of personal data:
- Personal Information: name, email address, shipping address, billing address, phone number (if provided).
- Payment Information: processed securely via Shopify Payments and integrated gateways (we do not store or have access to your credit card numbers or raw payment details).
- Order Information: purchase history, order details, and any communication related to your orders.
- Technical and Usage Data: IP address, browser type, device information, operating system, unique cookie identifiers, and data on how you interact with our website.
3. How We Use Your Information
Your personal data is used for the following strictly defined purposes:
- To process, manufacture, and fulfill your made-to-order purchases.
- To communicate with you regarding order confirmations, shipping updates, and customer support.
- To send marketing communications, newsletters, or updates (strictly on an opt-in basis, only with your explicit prior consent).
- To optimize, secure, and improve our website performance and user experience.
- To comply with statutory legal, tax, and commercial accounting obligations under German and EU law.
4. Legal Basis for Processing (GDPR)
We process personal data based on the following legal grounds under Article 6(1) of the GDPR:
- Contractual Necessity (Art. 6(1)(b) GDPR): To fulfill transactions, process orders, and manage shipping delivery.
- Explicit Consent (Art. 6(1)(a) GDPR): For email marketing subscriptions and the activation of optional analytical or marketing cookies.
- Legitimate Interest (Art. 6(1)(f) GDPR): To maintain website security, prevent fraudulent transactions, analyze traffic patterns, and optimize store presentation.
- Legal Obligation (Art. 6(1)(c) GDPR): To satisfy statutory tax preservation periods and corporate commercial records requirements.
5. Data Sharing and Third-Party Processors
We do not sell, rent, or trade your personal data. To run our store effectively, we transfer necessary data to trusted third-party service providers acting as Data Processors:
- Shopify Inc.: Our e-commerce platform host. Shopify processes your data to store inventory, manage shopping carts, and handle backend administration.
- Payment Gateways: Shopify Payments, PayPal, or other selected providers to execute secure transactions.
- Shipping & Logistics Carriers: External postal and courier services (e.g., DHL, FedEx, UPS) solely to print labels and deliver your package.
International Data Transfers: Some processors, including Shopify Inc., may transfer and store data on servers located outside the European Economic Area (EEA), primarily in the United States. Such transfers are legally secured by appropriate safeguards, including the Standard Contractual Clauses (SCCs) approved by the European Commission and compliance with the EU-U.S. Data Privacy Framework.
6. Data Retention
We retain personal data only as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal mandates.
- Order and Billing Records: Retained for up to 10 years to comply with statutory German commercial and tax laws (e.g., AO, HGB).
- Marketing Information: Stored continuously until you withdraw your consent or click the "unsubscribe" link in our emails.
- Technical Connection Logs: Automatically deleted or anonymized within standard technical cycles (usually 7 to 30 days).
7. Your Rights Under GDPR
As a data subject residing in the EU, you possess comprehensive statutory rights:
- Right of Access: To obtain a copy of the personal data we hold about you.
- Right to Rectification: To correct inaccurate or incomplete data.
- Right to Erasure (“Right to be Forgotten”): To request deletion of your data, provided no statutory retention laws prevent it.
- Right to Restriction of Processing: To limit how we use your information under specific conditions.
- Right to Data Portability: To receive your data in a structured, machine-readable format.
- Right to Object: To challenge data processing based on legitimate interests.
- Right to Withdraw Consent: To instantly cancel permission for elective data actions (e.g., marketing) at any time.
To exercise any of these rights, please email us directly at: ksaveraart@pm.me
You also maintain the legal right to lodge a formal complaint with a competent data protection supervisory authority (Datenschutzbehörde) in Germany or your EU country of residence.
8. Cookies and Tracking Technologies
Our Shopify store utilizes cookies (small text files placed on your device) to ensure basic checkout functionality, recognize return users, and analyze visitor traffic.
Essential cookies are loaded automatically to run the shop. Non-essential analytical, tracking, or marketing cookies will only be deployed if you provide explicit consent via our cookie banner interface. You can adjust your cookie settings or clear your browser cache at any time via your browser application.
9. Data Security
We implement robust technical and organizational security measures (including SSL/TLS encryption for all checkout paths) to minimize risks of unauthorized access, alteration, or data loss. However, please be aware that no data transmission over the internet can be guaranteed as completely secure.
10. Use of AI in the Creative and Marketing Process
We may utilize artificial intelligence tools exclusively for interior design mockup visualizations, general creative research, and marketing copywriting support. These operations involve automated technical design parameters and do not process, track, or analyze your personal data. All original physical paintings are exclusively designed, composed, and hand-painted by the artist Ksavera.
11. Changes to This Privacy Policy
We reserve the right to modify this Privacy Policy at any time to reflect operational or regulatory updates. Any amendments will become effective immediately upon being posted to this page with a revised "Last updated" date.
12. Contact Information
For any inquiries regarding this Privacy Policy or your data rights, please contact us at: ksaveraart@pm.me