Privacy Policy
Privacy Policy
1. General Information and Principles of Data Processing
Thank you for visiting our website. Protecting your privacy and personal data when using our website is very important to us.
According to Article 4(1) of the General Data Protection Regulation (GDPR), personal data refers to any information relating to an identified or identifiable natural person. This includes information such as your first and last name, address, telephone number, email address, and IP address.
Data that cannot be linked to an individual, for example through anonymization, is not considered personal data.
Under Article 4(2) GDPR, the processing of personal data (e.g., collection, storage, retrieval, consultation, use, transmission, deletion, or destruction) always requires a legal basis or your consent.
Personal data must be deleted once the purpose of its processing has been fulfilled, provided that no statutory retention obligations apply.
This Privacy Policy provides information about how we handle your personal data when you visit our website. In order to provide the functions and services available on our website, it is necessary for us to collect and process certain personal data.
We also explain the nature and scope of the respective data processing activities, their purposes, the applicable legal bases, and the relevant retention periods.
This Privacy Policy applies exclusively to this website. It does not apply to external websites that can be accessed through hyperlinks on our website. We cannot assume responsibility for the confidential handling of your personal data by third-party websites, as we have no influence over whether these companies comply with applicable data protection regulations. Please refer directly to the privacy policies of the respective websites for information about how they process your personal data.
2. Data Controller
The person responsible for processing personal data on this website is (see Legal Notice):
Isabeau Schmikowski
Am Königsforst 1
52388 Nörvenich
Germany
Telephone: +49 176 45887236
Email: kontakt@isasmobart.com
3. Provision and Use of the Website / Server Log Files
a) Nature and Scope of Data Processing
When you visit this website without otherwise providing us with personal data (e.g., by registering or using the contact form), technically necessary data is automatically transmitted to our server and collected through server log files.
This may include:
IP address
Date and time of the request
Name and URL of the requested file
Website from which the request originated (referrer URL)
Access status / HTTP status code
Browser type
Language and version of the browser software
Operating system
b) Purpose and Legal Basis
This processing is technically necessary to display our website to you. We also use this data to ensure the security and stability of our website.
The legal basis for this processing is Article 6(1)(f) GDPR. Processing the aforementioned data is necessary to provide our website and therefore serves our legitimate interests.
c) Retention Period
The personal data mentioned above will be deleted as soon as it is no longer required to display the website.
The collection of data for the provision of the website and its storage in server log files is essential for the operation of the website. Consequently, users cannot object to this necessary processing.
Data may be retained for a longer period in individual cases where required by law.
4. Use of Cookies and Similar Technologies
a) Nature, Scope, and Purpose of Data Processing
Our website uses cookies and similar technologies. Cookies are small text files stored on your device that enable certain functions of our website.
We distinguish between technically necessary cookies and those used, for example, to analyze and improve our website.
Technically Necessary Cookies
These cookies are essential for ensuring the basic functionality of our website. They include, for example, cookies required to manage the shopping cart, complete the checkout process, and store certain website preferences.
Analytics Cookies
We use Squarespace Analytics to statistically evaluate how visitors use our website.
These analytics features help us better understand page views, traffic sources, and website usage, allowing us to improve our online services.
Where cookies or similar technologies require consent, they are used only after you have given your prior consent.
Further information can be found on our page "Third-Party Services and Social Media."
b) Legal Bases
The storage of and access to technically necessary cookies are governed by Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
Where personal data is processed in this context, the processing is based on Article 6(1)(b) or Article 6(1)(f) GDPR, depending on the purpose.
The use of non-essential cookies and similar technologies, where legally required, is based exclusively on your consent pursuant to Section 25(1) TDDDG.
The associated processing of personal data is based on Article 6(1)(a) GDPR.
c) Retention Period and Withdrawal of Consent
The retention period of cookies depends on their respective functions.
Some cookies are deleted at the end of your browsing session, while others remain stored for a certain period.
You may change or withdraw your consent to the use of non-essential cookies at any time with effect for the future through the cookie settings on our website.
You can also delete or block cookies through your browser settings. Please note that doing so may limit the functionality of certain website features.
5. Collection of Data for Pre-Contractual Measures and Contract Performance
a) Nature and Scope of Data Processing
We collect personal data when taking pre-contractual measures and entering into contractual agreements.
This may include your first and last name, address, email address, telephone number, or bank account details.
b) Purpose and Legal Basis of Data Processing
We collect and process this data exclusively for the purpose of fulfilling contractual obligations or carrying out pre-contractual measures.
The legal basis for this processing is Article 6(1)(b) GDPR.
Where you have additionally provided consent, Article 6(1)(a) GDPR serves as an additional legal basis.
c) Retention Period
Personal data will be deleted as soon as it is no longer required for the purpose for which it was processed.
However, statutory retention obligations may apply, particularly under the German Commercial Code (HGB) or the German Fiscal Code (AO).
Where such obligations exist, the relevant data will be restricted or deleted once the applicable statutory retention periods have expired.
6. Orders Placed Through Our Online Shop
a) Nature and Scope of Data Processing
You can purchase selected artworks directly through our online shop.
To process your order, we collect and process the personal data necessary for completing the transaction.
This includes, in particular:
First and last name
Billing and shipping address
Email address
Telephone number, where applicable
Information about the products ordered
Order and transaction information
Information about the selected payment method
The technical processing of orders is carried out using the e-commerce functions provided by our website platform, Squarespace.
Payments are processed through the respective payment service providers, particularly Squarespace Payments or PayPal.
Further information can be found on our page "Third-Party Services and Social Media."
b) Purpose and Legal Basis
Your personal data is processed for the purpose of handling and fulfilling your order, processing payments, shipping purchased artworks, and communicating with you regarding your order.
The legal basis for this processing is Article 6(1)(b) GDPR (performance of a contract).
Where processing is necessary to comply with legal obligations, particularly tax and commercial record-keeping requirements, it is based on Article 6(1)(c) GDPR.
c) Disclosure of Data
Where necessary to fulfill your order, personal data may be transferred to service providers involved in the transaction, particularly payment and shipping service providers.
Such transfers are carried out exclusively in accordance with applicable legal requirements.
d) Retention Period
Your personal data will be stored only for as long as necessary to process and fulfill your order and comply with statutory obligations.
Where legal retention requirements apply, the relevant data will be retained for the prescribed period and subsequently deleted, provided that no other legal basis justifies its continued storage.
7. Disclosure and Transfer of Personal Data
We disclose your personal data to third parties only where:
a) You have expressly consented to such disclosure in accordance with Article 6(1)(a) GDPR.
b) The disclosure is legally permitted and necessary for the performance of a contract with you or for taking pre-contractual measures pursuant to Article 6(1)(b) GDPR.
c) We are legally required to disclose the data pursuant to Article 6(1)(c) GDPR.
We may be legally required to provide personal data to public authorities, such as tax authorities, social security institutions, health insurance providers, supervisory authorities, or law enforcement agencies.
d) The disclosure is necessary to safeguard legitimate business interests or to establish, exercise, or defend legal claims pursuant to Article 6(1)(f) GDPR, provided that there is no reason to assume that your overriding legitimate interests prevent such disclosure.
e) We engage external service providers acting as data processors in accordance with Article 28 GDPR, who are contractually required to handle your personal data with appropriate care.
We use such service providers in the following areas:
Logistics
When transferring personal data to external recipients in third countries, meaning countries outside the European Union (EU) or the European Economic Area (EEA), we ensure that appropriate safeguards are in place.
We transfer personal data to third countries only where the European Commission has recognized an adequate level of data protection or where appropriate contractual arrangements or other suitable safeguards ensure the protection of personal data.
8. Contact Form / Custom Artwork Inquiry Form
a) Nature and Scope of Data Processing
Our website provides various forms that allow you to contact us and inquire about custom artwork commissions.
When you use one of these forms, we process the personal data you provide. This may include your name, email address, telephone number where applicable, and the content of your message.
For inquiries regarding custom artwork commissions, we additionally process the information you provide about the requested artwork. This may include details about the subject, desired painting size, artistic preferences, special requests, and uploaded reference photographs.
Form submissions are technically processed through our website provider, Squarespace. The submitted data may be stored by Squarespace and forwarded to our designated email address for the purpose of handling your inquiry.
b) Purpose and Legal Basis
Your personal data is processed for the purpose of handling your inquiry and communicating with you in connection with your request.
For custom artwork inquiries, the information and reference photographs you provide are used in particular to assess the feasibility of the requested artwork, prepare a quotation, and, where applicable, carry out the subsequent commission.
Where your inquiry relates to entering into or performing a contract, processing is based on Article 6(1)(b) GDPR.
For other inquiries, processing is based on our legitimate interest in appropriately handling and responding to your message pursuant to Article 6(1)(f) GDPR.
c) Spam Protection Using Google reCAPTCHA
We use Google reCAPTCHA to protect our forms against automated submissions and misuse.
The service helps distinguish between human users and automated access.
For this purpose, technical information such as your IP address, browser and device information, and details of your interactions with the website may be processed. reCAPTCHA may also use cookies or similar technologies for risk analysis.
This processing serves our legitimate interest in protecting our website and forms against spam and misuse pursuant to Article 6(1)(f) GDPR, where this legal basis is applicable in the specific circumstances. Any access to or storage of information on users' devices that requires consent is additionally subject to Section 25 TDDDG.
d) Retention Period
Personal data submitted through our forms will be stored only for as long as necessary to process your inquiry.
For custom artwork inquiries, this also applies to submitted reference photographs and other supporting materials. If a commission is agreed upon, the data and reference materials required for the commission may continue to be processed for the purpose of fulfilling the contract.
Data may be retained for a longer period where statutory retention obligations apply or where continued storage is necessary for contract performance or the protection of legitimate interests.
Once the purpose of processing no longer applies and any applicable statutory retention periods have expired, the data will be deleted.
9. Contact by Email
Our website provides the option of contacting us directly by email.
a) Nature and Scope of Data Processing
You may contact us by email.
The personal data collected is limited to the email address used to contact us and any additional personal information you voluntarily provide in your message.
b) Purpose and Legal Basis
The purpose of processing this data is to respond appropriately to your inquiry.
The legal basis is Article 6(1)(f) GDPR.
We have a legitimate interest in processing the aforementioned personal data in order to handle your request appropriately.
c) Retention Period
The retention period depends on the nature and purpose of your inquiry.
Your personal data will generally be deleted once the purpose of the communication has been fulfilled and further storage is no longer necessary.
This may be the case, for example, once your inquiry has been fully resolved.
10. Tracking and Analytics Tools
Further information about the services used on this website, payment processing, and our social media presence can be found on the page "Third-Party Services and Social Media."
11. Data Security and Protective Measures
We are committed to protecting your privacy and treating your personal data confidentially.
For this purpose, we implement comprehensive technical and organizational security measures, which are regularly reviewed and adapted to technological developments.
These measures include the use of recognized encryption technologies such as SSL or TLS.
However, data transmitted without encryption, for example through unencrypted email communication, may potentially be accessed by third parties.
We have no influence over such transmissions. Users are responsible for taking appropriate measures, including encryption where necessary, to protect the data they provide against misuse.
12. Changes to This Privacy Policy
We reserve the right to update this Privacy Policy whenever necessary.
13. Your Rights
The following section provides information about your rights concerning your personal data.
Further details can be found in Articles 7, 15–22, and 77 GDPR.
You may contact the data controller identified in Section 2 to exercise these rights.
Right to Withdraw Consent Pursuant to Article 7(3) GDPR
You may withdraw your consent to the processing of your personal data at any time with effect for the future.
The lawfulness of processing carried out before your withdrawal remains unaffected.
a) Right of Access Pursuant to Article 15 GDPR
You have the right to request confirmation as to whether we process personal data concerning you.
Where this is the case, you have the right to obtain access to that personal data and additional information, including the purposes of processing, the categories of personal data concerned, the recipients of the data, and the intended retention period or the criteria used to determine that period.
b) Right to Rectification and Completion Pursuant to Article 16 GDPR
You have the right to request the immediate correction of inaccurate personal data.
Taking into account the purposes of processing, you also have the right to have incomplete personal data completed.
c) Right to Erasure ("Right to Be Forgotten") Pursuant to Article 17 GDPR
You have the right to request the deletion of your personal data where its processing is no longer necessary.
This may apply, for example, where your data is no longer required for its original purpose, you have withdrawn your consent, or the data has been processed unlawfully.
d) Right to Restriction of Processing Pursuant to Article 18 GDPR
You have the right to request the restriction of processing in certain circumstances, for example, if you believe that the personal data we hold about you is inaccurate.
e) Right to Data Portability Pursuant to Article 20 GDPR
You have the right to receive the personal data concerning you in a structured, commonly used, and machine-readable format.
f) Right to Object Pursuant to Article 21 GDPR
You have the right to object at any time, on grounds relating to your particular situation, to certain types of processing of personal data concerning you.
Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to direct marketing.
g) Automated Individual Decision-Making, Including Profiling, Pursuant to Article 22 GDPR
You have the right not to be subject to a decision based solely on automated processing, including profiling, except in the circumstances specified in Article 22 GDPR.
We do not engage in decision-making based solely on automated processing, including profiling.
h) Right to Lodge a Complaint with a Supervisory Authority Pursuant to Article 77 GDPR
You have the right to lodge a complaint with a data protection supervisory authority at any time, particularly if you believe that the processing of your personal data does not comply with applicable data protection regulations.