Privacy Policy

This English translation is provided for convenience. The version in the shop’s own language is the legally binding one.

1. Controller

UAB „ARTAREA“, Vytauto pr. 60, LT-47423 Kaunas, Lithuania
E-mail: bestellingen@paveikslai.be

2. General

We process personal data only as necessary to provide this website, to process orders, or based on your consent. Legal bases are the GDPR and the applicable ePrivacy rules.

3. Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server logs (IP address, date and time, requested page, referrer, browser, operating system) are processed to keep the site running and secure (Art. 6(1)(f) GDPR). The database runs with MongoDB Inc. (MongoDB Atlas) on servers in the EU. Images and static content are delivered via Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA (Art. 6(1)(f) GDPR).

Data processing agreements per Art. 28 GDPR are in place; transfers to the USA rely on the EU-U.S. Data Privacy Framework and/or EU standard contractual clauses.

4. Orders

To process your order we handle: name, addresses, e-mail, phone, order data and payment information (Art. 6(1)(b) GDPR), shared with carriers (FedEx/DHL or the courier named at checkout) and payment providers as required. Order and invoice data are retained for 10 years under accounting law (Art. 6(1)(c) GDPR).

5. Payment providers

Stripe — Stripe Payments Europe Ltd., Dublin, Ireland (cards, Apple Pay, Google Pay, and processing of PayPal and Klarna payments). Payment data is processed directly by the provider, not stored on our servers.

6. Customer account and Google sign-in

Account data is stored until the account is deleted (Art. 6(1)(b) GDPR). Optional Google sign-in (Google Ireland Ltd.) shares your e-mail address and name with us.

7. Contact and transactional e-mail

Contact requests are processed to handle your enquiry. Order and account e-mails are sent via Resend (Resend, Inc., USA; EU standard contractual clauses). Marketing e-mails only with your consent.

8. Cookies and consent

Technically necessary storage (cart, login, cookie choice, bot protection) is used under the ePrivacy rules and Art. 6(1)(f) GDPR. Everything else (statistics, marketing) only with your consent via the cookie banner, changeable at any time via “Cookie settings” in the footer. Details: Cookie policy.

9. Analytics and marketing

We use Vercel Web Analytics (cookie-free, Art. 6(1)(f) GDPR). Only with consent: Google Analytics 4 (Google Ireland Ltd.) and the Meta pixel (Meta Platforms Ireland Ltd.); data may be transferred to the USA (Data Privacy Framework).

10. Google reCAPTCHA

Our forms are protected by Google reCAPTCHA v3 (Google Ireland Ltd.), which analyses visitor behaviour (Art. 6(1)(f) GDPR — protection against bots and fraud).

11. Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and may revoke consent at any time with future effect. You may complain to a supervisory authority — the authority responsible for us is the Lithuanian Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt — or to the authority of your country of residence.

12. Security, changes

The site uses TLS encryption. We update this policy when the legal situation or our processing changes; the published version applies.

Version: September 2026