Privacy Policy

Last updated: 21 October 2026

1. Data Controller

Irene Gil Perez, the sole trader behind the activity carried out under the trade name ReinozArt (a studio for commissioned artwork and a drawing academy), with contact email reine@reinoz.art. Further identification details are given in the Terms and Conditions.

2. Purposes and Legal Bases for Processing

  • Contact and enquiries: responding to messages sent through the contact form. Legal basis: consent of the data subject (Art. 6(1)(a) GDPR).
  • Enrolment in Academy courses and workshops: managing enrolment, organising the activity, and communicating with the family. Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR) and, where the student is under 14 years of age, consent of their parent or legal guardian (Art. 7 of Organic Law 3/2018, LOPDGDD).
  • Studio commissions and orders: management, invoicing, and performance of the sales or commission contract. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Website analytics (Google Analytics 4): audience measurement and browsing behaviour analysis to improve the site. Legal basis: user consent, obtained through the site's cookie/consent notice.
  • Payment and invoicing: recording payments (at the studio or remotely), issuing invoices and sending them to you by email. Legal basis: performance of a contract (Art. 6.1.b GDPR) and compliance with a legal obligation (Art. 6.1.c GDPR).
  • Form security (Google reCAPTCHA): telling people apart from automated programs to prevent unwanted messages. Legal basis: the Data Controller's legitimate interest in the security of the site (Art. 6.1.f GDPR).
  • Compliance with legal obligations: tax and commercial obligations arising from the economic activity. Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).

3. Children's Data

The ReinozArt Academy is aimed at anyone aged 8 and above, with no upper age limit, and welcomes both minors and adults. Processing the data of a child under 14 years of age requires the consent of their parent or legal guardian, in accordance with Article 7 LOPDGDD, obtained at the time of enrolment or attendance at an open-day event. ReinozArt also has a child protection protocol and a code of conduct in accordance with Organic Law 8/2021 (LOPIVI), available to families upon request.

ReinozArt may publish photographs of work made in class on its website and social media, without the student's name. It does not publish photographs in which a student can be recognised without their express written permission or, for a minor, that of their parent or legal guardian.

4. Retention Period

Data will be retained for as long as the relationship with the data subject continues (active enrolment, ongoing commission, etc.) and, thereafter, for the applicable statutory limitation periods (in particular, the tax and commercial periods for retaining invoices and receipts, which are generally six years). Data collected solely for a one-off enquiry will be retained for as long as necessary to handle that enquiry.

5. Recipients

Data is not disclosed to third parties except where legally required and except for the providers strictly necessary to deliver the service, which receive the data solely for that purpose:

  • Web hosting and email providers: needed for the site and email to work, acting as data processors.
  • Stripe: payments for shop orders and commissions placed through the website.
  • Square: monthly course fees and payments at the studio (classes, workshops and materials). Square may keep the payer's name, email address and phone number in its customer directory, and provides them to us to issue the invoice.
  • Google: Google Analytics (only if you accept analytics cookies), Google reCAPTCHA (form protection) and Google Fonts (site typefaces, loaded from Google servers).
  • Spanish Tax Agency and other public authorities: where required by law, for example for invoicing.

Some of these providers are established in the United States. The international data transfers this involves are covered, depending on the provider, by the EU-US Data Privacy Framework (European Commission adequacy decision) or by the standard contractual clauses approved by the European Commission.

6. Data Subject Rights

Any data subject (or, in the case of a minor, their parent or legal guardian) may exercise their rights of access, rectification, erasure, objection, restriction of processing, and portability by writing to reine@reinoz.art, indicating the right they wish to exercise and enclosing a copy of a document proving their identity or their legal representation. They also have the right to lodge a complaint with the Agencia Española de Protección de Datos (www.aepd.es) if they consider that the processing does not comply with applicable regulations.

7. Cookies

In accordance with Article 22.2 of Spanish Law 34/2002 (LSSI), we inform you of the cookies this website uses:

  • lang (first-party, technical, 1 year): remembers the language you have chosen. Does not require consent.
  • cookie_consent (first-party, technical, 2 years): stores whether you have accepted or rejected analytics cookies. Does not require consent.
  • _ga and _ga_* (Google Analytics, analytics, up to 2 years): measure site audience in aggregate. They are only set if you click "Accept" on the cookie notice.
  • _GRECAPTCHA (Google reCAPTCHA, security): may be set on pages with a form to tell people apart from automated programs. It is necessary for the security of the form.

You can change your choice at any time from the "Change cookie preferences" link in the footer, and delete or block cookies from your browser settings.

8. Changes to this Policy

This policy may be updated to reflect regulatory changes or changes to ReinozArt's activity. The version in force is always the one published at reinoz.art/privacy.