Privacy policy

Website	rocioarrupe.com
Website owner	Rocío Arrupe (NIF 44590278V)
Data controller	Rocío Arrupe
Purpose for web users	Answering enquiries made through the website and, where applicable, preparing commission quotes. Commercial communications are only sent if you subscribe to the newsletter.
Legal basis	Consent of the user (enquiries, blog comments and newsletter), which can be withdrawn at any time; pre-contractual measures (commission quotes); performance of a contract and legal obligations (orders and invoicing).
Consent and legal age	The User certifies that they are over 14 years of age and therefore has the necessary legal capacity to provide consent regarding the processing of their personal data and all of this, in accordance with the provisions of this Privacy Policy.
Recipients	Data is only communicated to service providers that process it on our behalf to carry out the purposes described (see section 5), and to public authorities where required by law. In no case will data be transferred to third parties for purposes other than those described in this document.
Rights	Access, rectify and delete the data, withdraw your consent at any time, as well as other rights, as explained in the additional information.

ADDITIONAL INFORMATION ON DATA PROTECTION

1. Who is the owner of this website?

Identity	Rocío Arrupe (NIF 44590278V)
Email	info@rocioarrupe.com

2. Who is responsible for the processing of your personal data?

Identity	Rocío Arrupe
Email	info@rocioarrupe.com

3. For what purpose will we process your personal data and for how long will we keep it?

Rocío Arrupe will process your personal data exclusively for specific, explicit, and legitimate purposes, and they will not be processed in a way that is incompatible with said purposes.

Purposes:

Purpose 1: users of the website.	Answering enquiries made through the website, by email or by WhatsApp and, where applicable, preparing commission quotes and wall previews. Retention: 1 year from the last contact if no order or commission follows. WhatsApp conversations: until their purpose has been fulfilled, and no longer than 1 year.
Purpose 2: customers	Management of orders placed through the website. Billing to customers. Customer management, accounting and tax. Retention: for the duration of the contractual relationship and, afterwards, for 6 years (art. 30 of the Spanish Commercial Code), which also covers the 4-year limitation period of tax obligations.
Purpose 3: commercial communications	Sending commercial communications (newsletter) to people who have subscribed and, for existing customers, information about similar products. Retention: until you unsubscribe or object.
Purpose 4: custom commissions	Creating your commission and its wall preview with the photos and details you send us. Retention: until the commission is completed and, afterwards, for 3 years to handle any claims.
Purpose 5: blog comments	Moderating and publishing your comment on the blog. Your name and comment are publicly visible; your email is not published. Retention: while the comment remains published or until you ask us to delete it.

Once these periods have ended, your data will be kept blocked, only at the disposal of the competent authorities for the period in which liabilities may arise, and will then be deleted.

We do not take decisions based solely on automated processing, including profiling, that produce legal effects on you or similarly significantly affect you.

4. What is the legal basis for processing your data?

Purposes:
For website users	Consent given by the user when sending the form (contact, commission or blog comment), after being informed in the data protection notice shown next to it. For commission quotes, also the application of pre-contractual measures at your request.
For customers	Performance of the purchase contract and compliance with legal obligations (invoicing, accounting and tax).
For sending advertising	Consent of the user when subscribing to the newsletter, which can be withdrawn at any time through the unsubscribe link in each email. For existing customers, legitimate interest in sending information about similar products (art. 21.2 LSSI), to which you can object at any time.

Where processing is based on your consent, you can withdraw it at any time by writing to info@rocioarrupe.com, without affecting the lawfulness of the processing carried out before its withdrawal.

The fields marked as required in each form and at checkout are necessary to answer your enquiry or to process your order; if you do not provide them, we will not be able to do so.

5. To which recipients will your data be communicated?

Your data may be communicated to the following recipients, which act as data processors or service providers, solely for the following purposes:

RECIPIENTS:	PURPOSE:
SHOPIFY	E-commerce platform: website hosting, checkout, order management, payment processing and newsletter subscriptions.
PAYMENT PROVIDERS	Payment processing through the methods shown at checkout.
GELATO	Printing and delivery of canvas prints and art prints (name, shipping address, contact details and order details).
SHIPPING CARRIERS	Delivery of orders and tracking notifications.
GOOGLE, META PLATFORMS (FACEBOOK/INSTAGRAM) AND OPENAI	Advertising and measurement, only if you accept the corresponding cookies.
TRUSTPILOT	Management of customer reviews, only if you choose to leave one.
META PLATFORMS (WHATSAPP)	Messaging with you, including any photos you send us (for example, for a commission or a wall preview), only if you choose to contact us via WhatsApp.
HCAPTCHA (INTUITION MACHINES, INC.)	Anti-spam and anti-bot protection of the website forms (contact, commissions, newsletter and comments). It may process technical data such as your IP address, browser and device data, and how you interact with the form.
ADVISERS, BANKS AND PUBLIC AUTHORITIES	Compliance with legal, accounting and tax obligations.

International transfers: some of these providers (such as Shopify, Google, Meta, OpenAI or hCaptcha) may process data outside the European Economic Area. These transfers are covered by an adequacy decision of the European Commission (EU-US Data Privacy Framework) or by Standard Contractual Clauses approved by the European Commission.

For detailed information about the cookies and similar technologies we use, and how to accept, reject or withdraw your consent, please see our Cookie Policy.

6. What are your rights when you provide us with your data?

Anyone has the right to obtain confirmation as to whether Rocío Arrupe is processing personal data that concerns them.

Specifically, you can contact Rocío Arrupe at the email address provided in this document (info@rocioarrupe.com) to exercise the following rights:

Right to request access to personal data relating to the interested party.

Right to request its rectification or deletion.
Right to request restriction of processing.
Right to object to processing.
Right to data portability.
Right to withdraw your consent at any time.

You can request the necessary forms to exercise these rights by sending an email to the email address provided in this document.

Given the very personal nature of the exercise of any of these rights, you must attach a copy of your identity card or equivalent supporting document to the request.

You can contact the Spanish Data Protection Agency to obtain additional information about your rights or file a claim with it, especially when you have not obtained satisfaction in the exercise of your rights, obtaining all the necessary information for this through the website www.aepd.es