Privacy Policy

Last updated: April 2026

Who we are

This website is operated by Olaf Wollmerstedt, a self-employed visual artist based in Vila Nova de Cacela, Portugal (NIF: 306329425). To get in touch, please use the contact form on this website.

What data I collect and why

Contact form When you use the contact form, I collect your name and email address. I use this only to respond to your enquiry. The legal basis is legitimate interest (responding to your message).

Newsletter signup If you subscribe to my newsletter, I collect your email address with your explicit consent. You can unsubscribe at any time via the link in any email I send you.

Orders and payments When you purchase from my shop, I collect your name, email, delivery address, and order details. This is necessary to fullfil your order. Payments are processed by Squarespace Payments, Stripe, and/or PayPal — I never see or store your full payment details. Each processor handles your payment data under their own privacy policies:

Analytics This site uses Squarespace Analytics and Google Analytics to understand how visitors use the site. These tools collect anonymised data such as pages visited, time on site, device type, and approximate location via IP address. This data is aggregated and not used to identify you personally. See the Cookie Policy for more detail.

Data sharing

I do not sell your personal data. I share it only with the service providers necessary to run this website and fulfil orders: Squarespace (hosting and e-commerce), Google Analytics (website analytics), Squarespace Payments, Stripe, and PayPal (payment processing). All are bound by their own GDPR-compliant data processing agreements.

International transfers

Squarespace, Google, Stripe, and PayPal are US-based companies. Your data may be transferred to and processed in the United States. All rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data is protected in line with GDPR.

How long I keep your data

Contact form enquiries are kept for up to 12 months. Newsletter subscriber data is kept until you unsubscribe. Order and fiscal records are kept for 10 years as required by Portuguese tax law (Article 113 of the IRS Code and related legislation).

Your rights

Under GDPR you have the right to access, correct, or delete your personal data, to restrict or object to its processing, and to data portability. To exercise any of these rights, please use the contact form on this website. I will respond within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) at cnpd.pt.

Security

This site uses HTTPS encryption. I take reasonable steps to protect your data, but no online transmission is 100% secure.

Changes to this policy

I may update this policy from time to time. The date at the top of this page will always reflect the latest version.