Privacy Policy

01 · Who we are

Two partners, distinct responsibilities

AGOP MTÜ and Värvikaru OÜ are separate Estonian legal entities working together to present and sell original artworks through this website.

02 · Information we collect

Data connected with your visit or purchase

• Identity and contact data: name, billing and delivery address, country, email address and telephone number.
• Order data: artwork ordered, price, delivery method, order status, correspondence, return, refund or complaint information.
• Payment and accounting data: chosen payment method, payment status, transaction reference, invoice and information required for bookkeeping or tax compliance. We do not receive or store your complete payment-card number.
• Account data: login and account details if you choose to create a customer account.
• Communication data: the information you provide when contacting us about an artwork, order, delivery or another request.
• Technical and usage data: IP address, browser and device information, timestamps, requested pages, security logs, cookie identifiers and analytics data.
• Cookie choices: the consent or preferences you provide through the Site’s cookie controls.

Please do not send payment-card details or other unnecessary sensitive information by email.

03 · Purposes and legal bases

Why we use personal data

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

04 · Sharing personal data

Who may receive your information

We do not sell personal data. We disclose it only where necessary for the purposes described above, including to:

• AGOP MTÜ and Värvikaru OÜ, within their respective roles described in this Policy;
• the relevant artist or fulfilment partner, where needed to confirm the work, prepare documents, pack the artwork or arrange dispatch;
• postal, courier, insurance and customs providers, using the delivery and contact details required to complete the shipment;
• payment providers and banks, including the card-payment or PayPal provider selected at checkout;
• website, hosting, ecommerce, security and email service providers, including services used to operate WordPress and WooCommerce;
• Google Analytics, when analytics consent has been provided;
• accountants, legal advisers, insurers, courts and public authorities, where reasonably necessary or legally required.

Artists and fulfilment partners receive only the information they need for the relevant order. They may not use buyer information for their own marketing without a separate lawful basis.

05 · Payments

Payment information

Card and PayPal payments are processed through the payment service selected at checkout. Payment providers process information under their own privacy terms and security requirements. Värvikaru OÜ receives the information needed to identify the payment and administer the order, but not your complete payment-card number or security code.

For bank transfers, the payer’s name, account details, payment reference and transaction information are processed by the relevant banks and appear in Värvikaru OÜ’s banking and accounting records.

06 · Cookies and analytics

How the Site uses cookies

The Site uses essential cookies and similar technologies for functions such as the shopping cart, checkout, security, load balancing and saving privacy preferences. These technologies are necessary for the Site and online store to work.

The Site also uses Google Analytics through Google Site Kit to understand, in aggregated form, how visitors use the Site. Analytics technologies may collect online identifiers, device and browser information, approximate location derived from IP address, pages visited and interaction data. Non-essential analytics cookies are used on the basis of consent where required.

You can refuse or withdraw consent for non-essential cookies through the Site’s cookie controls and can also delete cookies through your browser. Blocking essential cookies may prevent the cart or checkout from working correctly.

07 · Retention

How long we keep data

• Order, invoice, payment, refund and accounting records: seven years from the end of the financial year in which the transaction was recorded, or longer if required for an active dispute or another legal obligation.
• Customer account data: while the account remains active or until deletion is requested, except for information that must be retained with transaction records.
• Artwork and order enquiries: normally up to two years after the enquiry is resolved, unless the information becomes part of an order or is needed for a legal claim.
• Security and technical logs: normally up to twelve months, unless a longer period is necessary to investigate an incident.
• Google Analytics data: for the retention period configured in the relevant Analytics property, normally no longer than fourteen months.

Data may be deleted or anonymised earlier where it is no longer needed. Back-up copies may remain for a limited period until they are securely overwritten.

08 · International transfers

Processing outside the EEA

Some technology, analytics, payment or delivery providers may process personal data outside the European Economic Area. Where this occurs, the responsible controller relies on a lawful transfer mechanism, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, or another safeguard permitted by the GDPR.

09 · Your rights

Control over your personal data

Subject to the conditions and limits in applicable law, you may:

• request access to your personal data and a copy of it;
• ask us to correct inaccurate or incomplete information;
• request erasure or restriction of processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain data in a portable, machine-readable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a data-protection supervisory authority.

To exercise a right, email agop@globalpainters.net. We may request reasonable information to verify your identity. We normally respond within one month, as required by the GDPR.

The Site does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

10 · Security

Protecting your information

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. No internet service is completely secure, but access to personal data is limited to those who need it for the purposes described in this Policy.

11 · Children

Age of visitors

The Site is intended for adults and is not directed at children. We do not knowingly collect personal data from children through the online shop. If you believe a child has provided personal data to us, please contact us so that we can review and delete it where appropriate.

12 · Contact and complaints

How to reach us

Questions and requests concerning this Policy or the use of personal data can be sent to agop@globalpainters.net.

You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, email info@aki.ee, website aki.ee, or to the competent supervisory authority in your country of residence.

13 · Changes

Updates to this Policy

We may update this Privacy Policy when the Site, our services, providers or legal requirements change. The current version will be published on this page with its revision date.