Privacy Policy

As of 5 October 2026

1. Controller

Marek Ehrenfeuchter, Jareks Art, Edith-Stein-Straße 10, 67354 Römerberg, Germany, email: marekefeu@web.de

2. Overview

We process personal data only as far as necessary to run this shop, process your orders and communicate with you, or where you have given consent. The legal bases are Art. 6(1)(a) GDPR (consent), (b) (contract), (c) (legal obligations) and (f) (legitimate interests).

3. Hosting and shop system: Shopify

This shop runs on Shopify. The contracting entity for European merchants is Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland. When you visit the site, Shopify processes technically necessary data (e.g. IP address, browser information, pages visited, time) and all data you enter in the shop and at checkout (Art. 6(1)(b) and (f) GDPR; our legitimate interest is the secure and stable operation of the shop). We have a data processing agreement with Shopify. Data may also be transferred to Shopify Inc. in Canada and the US on the basis of an adequacy decision (Canada, EU-US Data Privacy Framework) or EU standard contractual clauses. More: Shopify privacy policy.

4. Orders

For your order we process your name, shipping and billing address, email address, phone number if provided, order contents and payment information (Art. 6(1)(b) GDPR). Without this data we cannot fulfil the contract.

5. Production and shipping: Gelato

Our prints are produced and shipped by our print partner Gelato ASA, Eufemias gate 8, 0191 Oslo, Norway, and its partner printers close to your delivery address. For this we pass on your name, shipping address, email and phone number if provided, and the order contents (Art. 6(1)(b) GDPR). Norway is part of the European Economic Area. For US deliveries the print is made in the US, and the necessary data is transferred to the US as required to perform the contract (Art. 49(1)(b) GDPR). Gelato passes the delivery data to the carrier.

6. Payment

Payments are processed by the payment providers offered at checkout (e.g. Shopify Payments with Stripe Payments Europe Ltd., Ireland, or PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). They receive the data needed for payment (Art. 6(1)(b) GDPR) and partly process it under their own responsibility, e.g. for fraud prevention. Their privacy notices also apply.

7. Customer account

If you create an account, we store your details so you can view orders and manage your data (Art. 6(1)(b) GDPR). You can have your account deleted at any time.

8. Contact and online withdrawal

If you write to us by email, via the contact form or via “Withdraw from contract”, we process your details to handle your request (Art. 6(1)(b) or (c) GDPR). Messages are delivered via Shopify to our mailbox (WEB.DE, 1&1 Mail & Media GmbH, Germany).

9. Newsletter

If you subscribe to our newsletter, we use your email address based on your consent (Art. 6(1)(a) GDPR) to send you news about new artwork. Emails are sent via Shopify Email, and we measure whether emails are opened and links clicked. You can unsubscribe at any time via the link in every email or by emailing us.

10. Cookies and consent

We use technically necessary cookies, e.g. for the cart and checkout (Section 25(2) TDDDG, Art. 6(1)(b) and (f) GDPR). Analytics, marketing and personalization cookies are only used with your consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via “Privacy settings” in the footer.

11. Retention

We delete your data once it is no longer needed for its purpose. Order and invoice data is kept for up to eight or ten years due to German commercial and tax law (Section 147 AO, Section 257 HGB). Newsletter data is kept until you unsubscribe.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). You have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). An email to us is enough.

13. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

14. No automated decision-making

We do not use automated decision-making, including profiling, under Art. 22 GDPR.