Privacy Policy

Last updated: September 2026

Who is responsible for your data?

The data controller is Marco José de Sousa Santos, a self-employed artist based in Portugal. You can contact him at [email protected] or through the contact form. His business identification and address are in the Legal Notice.

What data is processed, and why?

  • Enquiries: If you write through the contact form, your name, email address and message are used to answer you and, where relevant, discuss an artwork, purchase or collaboration. The legal basis is our legitimate interest in responding to enquiries or taking steps you request before a possible contract.
  • Newsletter: The newsletter is provided through a separate Mailchimp sign-up page. Your email address is used to send news about paintings, exhibitions and available works only if you subscribe or otherwise give explicit permission. Contacting the artist does not, by itself, subscribe you. The legal basis is your consent, which you may withdraw at any time using the unsubscribe link in each email or by contacting us.
  • Website operation and security: Technical information such as IP address, browser, device and access logs may be processed to deliver and protect the website. The legal basis is our legitimate interest in keeping the site functional and secure.
  • Audience measurement: Google Analytics may process usage information, including pages visited and online identifiers, if you consent to optional analytics cookies. The legal basis is consent for those cookies and related analytics processing.

Who may receive the data?

Service providers may process data only as needed for these purposes: the hosting provider (Sered), Cloudflare for website security and delivery, Google for analytics, and Mailchimp for the newsletter. When you follow a link to a gallery, art platform or social network, that third party applies its own privacy policy. Personal data is not sold.

International transfers

Some providers, including Google and Mailchimp, may process data outside the European Economic Area. Where a transfer requires safeguards under the GDPR, the applicable provider arrangements must be used. Contact us if you would like information about the safeguards relevant to your data.

How long is data kept?

Enquiries are kept for as long as needed to deal with the request and, if necessary, to meet legal obligations or establish, exercise or defend claims. Newsletter contact details are kept until you unsubscribe or withdraw consent, subject to any records that must be retained to demonstrate that choice. Technical and analytics data are retained according to the applicable service settings and only as long as needed for the stated purpose. You can ask about the period applicable to your data using the contact details above.

Your rights

Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction, portability or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. To exercise your rights, email [email protected]. You may also lodge a complaint with the Portuguese data protection authority, CNPD.

Cookies and external sites

See the Cookie Policy for information about cookies and your choices. External websites linked from this site have their own privacy practices.

Changes

This policy may be updated when the website or its services change. The date above shows the latest revision.