Privacy & legal

TODO · Draft for Éva to complete before launch. The controller’s contact address, legal identity details, chosen email service and retention policy need confirmation. This preview is not a completed legal notice.

Draft updated 9 October 2026.

Who is responsible

Éva Major is responsible for the personal information used for her studio letters and correspondence.

TODO: confirm the controller’s full legal name and a working contact email for privacy requests.

Studio letters

If you join the studio letters, Éva collects your email address to send occasional emails about new paintings, work in progress and the stories behind the pieces. The legal basis is your consent. You can withdraw it at any time.

MailerLite processes subscription details and sends these emails on Éva’s behalf. Its forms can also record your subscription time, IP address and confirmation information as evidence of consent. See MailerLite’s privacy information.

TODO: confirm the actual MailerLite group, double opt-in settings, form data, email opening/link tracking settings, contracting entity and retention periods. Describe any tracking that remains enabled. Check the account’s data-processing agreement and any applicable international-transfer arrangements.

This preview links to Éva’s existing MailerLite signup page. That page has its own cookies and privacy behaviour; no embedded form is loaded here.

Your messages

If you contact Éva, she uses the details you send to answer your question. Depending on your request, the legal basis is her legitimate interest in responding to correspondence or steps you request before entering a contract.

TODO: name the chosen mailbox provider and, if used, forwarding provider. Set a reasonable retention period for enquiries. Confirm how transactional records are handled separately from the newsletter.

Hosting and cookies

This website uses Cloudflare Pages for hosting. Cloudflare processes technical information, including IP addresses, to deliver and protect the website. See Cloudflare’s privacy policy.

TODO: describe any additional DNS, email or security services actually enabled when the final domain is connected.

The current site files set no cookies, use no browser storage and load no analytics or third-party scripts. The final hosting configuration must be checked again after deployment; any added proxy/security features may have their own cookie behaviour.

Following an Etsy, Instagram or MailerLite link takes you to that service. Its own privacy policy applies there.

How long information is kept

TODO: set and describe how long subscription, consent and correspondence records are kept. Include how inactive and unsubscribed contacts are removed, and any limited information retained to record consent or respect an unsubscribe request.

Your choices and rights

You can unsubscribe using the link in any studio letter. You may request access, correction, deletion, restriction or portability of your information where applicable, object to processing based on legitimate interests, or withdraw consent without affecting earlier lawful processing.

TODO: insert the working privacy contact email. No live request address has been supplied for this preview.

You may also complain to the Spanish Data Protection Agency (AEPD). Newsletter signup is voluntary.

Legal identity (aviso legal)

TODO: obtain the identifying information and public contact details required for Éva’s activity under Spain’s LSSI-CE, including Article 10 where applicable. Confirm the legal name, service address, direct contact email, tax/registration and other applicable details with her adviser. Do not publish private identity information without Éva’s explicit instructions for that purpose.

References for completing this draft: GDPR, including Article 13 and Spain’s LSSI-CE.