PRIVACY POLICY

Last updated: January 31, 2026

We appreciate your interest in Art Paint Shop. Protecting your personal data is a top priority for our management. Below, we provide a detailed overview of how we process your data in compliance with European and German regulations.

1. CONTROLLER AND CONTACT DETAILS

The "Controller" responsible for data processing on this website pursuant to Art. 4 (7) GDPR is:

Rave Painter's Shop UG (haftungsbeschränkt)
Hauptstraße 194, 79739 Schwörstadt, Germany
Managing Directors: Calin Popa and Elena Andronescu
Email: contact-us@art-paint.shop
Phone: +41 76 268-6578

2. ACCESS DATA AND HOSTING

2.1 Server Log Files

You may visit our website without actively disclosing personal information. However, each time a page is accessed, the web server automatically stores a "server log file." This file documents the access and contains the following data:

• The name of the requested file.
• Your IP address.
• The date and time of the request.
• The volume of data transferred.
• The requesting internet service provider (access data).

This access data is evaluated exclusively to ensure the uninterrupted operation of the website and to improve our online presence. In accordance with Art. 6 (1) lit. f GDPR, this serves our legitimate interest in the correct and optimized presentation of our services. All access data is automatically deleted no later than fourteen (14) days after the conclusion of your visit.

2.2 Hosting Services

The hosting services and the display of this website are partially provided by third-party service providers acting on our behalf. Unless otherwise specified in this policy, all access data and data collected via forms on this website are processed on the servers of these providers. If you have specific inquiries regarding our hosting partners or the technical basis of our collaboration, please contact us using the details provided in this policy.

2.3 Content Delivery Network (CDN)

To optimize loading speeds and ensure a high-performance user experience, we utilize a Content Delivery Network (CDN) for specific assets. This service delivers content (such as large-scale media files or graphics) via regionally distributed servers provided by external CDN operators.

• Data Processing: Consequently, access data is processed on the servers of these external providers.
• International Transfers: These providers may be located in, or utilize servers in, countries outside the European Union (EU) and the European Economic Area (EEA). Currently, there is no adequacy decision by the European Commission for all such countries.
• Legal Safeguards: Our collaboration with these providers is strictly governed by the Standard Contractual Clauses (SCCs) issued by the European Commission to ensure a level of data protection equivalent to the GDPR.

3. DATA PROCESSING FOR CONTRACT FULFILLMENT AND COMMUNICATION

3.1. Contract Processing and Warranty Management

Pursuant to Art. 6 (1) lit. b GDPR, we collect personal data when you voluntarily provide it as part of an order. This data is essential for the performance of the contract, including the processing of inquiries, warranty claims, and any statutory product update obligations.

• Obligatory Data: Information required for contract execution is marked as mandatory; without this data, we are unable to process or ship your order.
• Data Retention: Following the full execution of the contract, your data will be restricted from further use and permanently deleted upon the expiration of statutory retention periods under German commercial and tax law (Art. 6 (1) lit. c GDPR). This does not apply if you have provided express consent for further use (Art. 6 (1) lit. a GDPR) or if we reserve a legally permitted right to further processing as disclosed in this policy.

3.2. Customer Accounts

By choosing to open a customer account, you provide consent (Art. 6 (1) lit. a GDPR) for us to store your details for future orders and to manage your order history.

• Right to Delete: You may delete your customer account at any time. This can be done via the account dashboard or by contacting us directly using the details provided in this policy.
• Deletion Protocol: Once the account is deleted, your data will be removed from our active systems, subject to any overriding statutory retention requirements.

3.3. Contact and Inquiry Handling

As part of our customer service, we collect personal data (such as your name and email address) when you reach out to us via contact form or email. This data is processed in accordance with Art. 6 (1) lit. b GDPR solely to handle your specific request.

• Inquiry Closure: Once your inquiry has been fully resolved, the associated data will be deleted, provided there are no legal grounds for retention and no further consent has been granted for extended storage (Art. 6 (1) lit. a GDPR).

4. DATA TRANSFER FOR ORDER FULFILLMENT AND LOGISTICS

To fulfill our contractual obligations pursuant to Art. 6 (1) lit. b GDPR, we transfer your personal data to the service providers responsible for the logistics and delivery of your order.

• Shipping Carriers: We provide the commissioned shipping company (e.g., DHL, UPS, or specialized freight forwarders) with the data necessary for the physical delivery of the goods (typically your name, delivery address, and, if required for coordination, your telephone number).
• Drop Shipping: In certain instances, shipping is handled directly by our manufacturers or wholesalers (Drop Shipping). In these cases, your data is shared with these partners solely for the purpose of dispatching the ordered items.

5. DATA PROCESSING FOR PAYMENT SERVICES

When processing payments in our online shop, we collaborate with various partners, including technical service providers, credit institutions, and specialized payment service providers.

5.1. Transaction Processing

Depending on the payment method you select during the checkout process, we transmit the data necessary to process the transaction to our commissioned technical service providers (acting as our processors), the respective credit institutions, or the selected payment service provider.

• Legal Basis: This transfer is essential for the performance of the contract pursuant to Art. 6 (1) lit. b GDPR.
• External Processing: In many instances, the payment service providers collect the required data themselves. In these cases, the data is processed under the responsibility of the respective provider, and their specific privacy policies apply.

5.2. Fraud Prevention and Payment Optimization

Where necessary, we provide our service providers with additional data which they—acting as our processors—utilize in conjunction with the transaction data for the purposes of fraud prevention and the optimization of payment processes.

Legal Basis: Pursuant to Art. 6 (1) lit. f GDPR, this serves our overriding legitimate interest in protecting the Vendor against payment defaults and fraudulent activity.

6. ADVERTISING VIA EMAIL AND POSTAL MAIL

6.1. Email Newsletter with Consent and Tracking

If you subscribe to our newsletter, we use the data required based on your explicit consent pursuant to Art. 6 (1) lit. a GDPR.

• Unsubscribing: You may revoke your consent at any time via the "unsubscribe" link included in every newsletter.
• Newsletter Tracking: To optimize our content, we analyze your user behavior (open and click rates). Our emails contain "web beacons" or "tracking pixels."
• Objection to Tracking: If you wish to prevent this tracking, you must unsubscribe from the newsletter entirely.

6.2. Newsletters for Existing Customers (§ 7 Para. 3 UWG)

If we receive your email address in connection with the sale of goods and you have not objected, we reserve the right to send you offers for similar products based on Section 7 (3) UWG and Art. 6 (1) lit. f GDPR.

6.3. Newsletter Distribution and International Transfers

We utilize external service providers. Transfers to the UK are covered by an adequacy decision. Transfers to the USA are based on the Data Privacy Framework or SCCs. Transfers to Australia are secured through SCCs.

6.4. Postal Advertising

We reserve the right to use your name and postal address for our own advertising purposes based on Art. 6 (1) lit. f GDPR. You may object to this at any time.

7. COOKIES AND OTHER TECHNOLOGIES

7.1. General Information

We utilize cookies to provide an attractive user experience. Session cookies are deleted after closing the browser; persistent cookies remain to recognize your browser on subsequent visits.

7.2. TDDDG Compliance

• Essential Technologies: Strictly necessary for the service requested. Consent is not required.
• Non-Essential Technologies: Require your explicit, informed consent for web analytics or marketing.

7.3. Legal Basis

Processing is based on Legitimate Interest (Art. 6 (1) lit. f GDPR) for essential functions or Consent (Art. 6 (1) lit. a GDPR) for analytics and marketing.

7.4. Consent Management

We use the 'CookieConsent' library (v3) by Orest Bida to fulfill our legal obligation under Art. 7 (1) GDPR. User preferences are stored in a local cookie ('cc_cookie') including a unique Consent ID and timestamp.

7.5. Third Country Transfers

Some providers are in third countries (USA, China, Russia). For countries without an adequacy decision, your consent explicitly includes the risk of local authority access pursuant to Art. 49 (1) lit. a GDPR.

8. THIRD-PARTY TECHNOLOGIES AND ANALYSIS TOOLS

8.1. Google Services

We utilize services provided by Google Ireland Ltd. These include Google Analytics, Google Ads, Google Maps, Google Fonts, reCAPTCHA, and the YouTube Video Plugin.

8.2. Microsoft Advertising

We use Universal Event Tracking (UET) to track behavior after clicking a Bing or Yahoo ad under a joint controllership agreement.

8.3. Meta (Facebook) Services

We use the Facebook Pixel and Custom Audiences to show targeted ads on Facebook and Instagram.

8.4. Pinterest and Vimeo

We use the Pinterest Tag for analytics and the Vimeo Video Plugin to embed video content.

9. SOCIAL MEDIA PRESENCE

We operate business profiles on Instagram and YouTube. The processing of your data serves our legitimate interest in effective customer communication (Art. 6 (1)(f) GDPR).

10. YOUR RIGHTS AND CONTACT INFORMATION

10.1. Overview of Your Rights

• Right to Access (Art. 15)
• Right to Rectification (Art. 16)
• Right to Erasure (Art. 17)
• Right to Restriction of Processing (Art. 18)
• Right to Data Portability (Art. 20)
• Right to Lodge a Complaint (Art. 77)

10.2 Right to Object (Art. 21 GDPR)

You have the right to object to processing based on legitimate interests at any time. If you object to direct marketing, we will immediately cease processing for those purposes.

10.3. Contacting the Data Protection Officer

Data Protection Officer: Rave Painter's Shop UG (haftungsbeschränkt)
Attn: Data Protection Dept.
Hauptstraße 194, 79739 Schwörstadt, Germany
Email: contact-us@art-paint.shop