Privacy Policy

This Privacy Policy explains how Atlanta Weiss, trading as Atlanta Weiss / Atlanta Weiss Studio (“we”, “us”, “our”), processes personal data when you visit atlantaweiss.art, contact the studio, subscribe to Newsletter or the Portrait Letter Club, enquire about a portrait commission, purchase artwork, or otherwise interact with Atlanta Weiss Studio.

We process personal data in accordance with applicable data-protection law, in particular the General Data Protection Regulation (“GDPR”).

1. Controller

The controller responsible for data processing on this website is:
Atlanta Weiss, trading as Atlanta Weiss / Atlanta Weiss Studio

Address for legal documents / Ladungsfähige Adresse:
Atlanta Weiss
c/o Postflex PFX-174-085
Emsdettener Str. 10
48268 Greven
GERMANY

Correspondence address / Postanschrift:
Atlanta Weiss
Postfach 72 02 02
50757 Cologne
GERMANY

E-Mail: studio@atlantaweiss.art


2. General Principles and Legal Bases

We process personal data only where there is a lawful basis for doing so.
Depending on the particular interaction, this may include:

Art. 6(1)(a) GDPR — Consent
For example, where you voluntarily subscribe to Studio Notes or another marketing communication.

Art. 6(1)(b) GDPR — Contract or pre-contractual steps
For example, where you enquire about a portrait commission, purchase artwork or ask us to prepare an offer.

Art. 6(1)(c) GDPR — Legal obligation
For example, where information must be retained for tax, accounting or other statutory purposes.

Art. 6(1)(f) GDPR — Legitimate interests
For example, where limited processing is necessary to operate and secure the website, manage legitimate business correspondence, prevent misuse or establish or defend legal claims.

Where consent is the legal basis, you may withdraw it at any time with effect for the future.

3. Website Hosting — Showit

The public Atlanta Weiss Studio website and the associated WordPress Journal are hosted through Showit, Inc.
Showit hosts the website itself, website content such as images and text, and—where a Showit blog subscription is used—the WordPress blog and associated media.

When you access the website, technical information necessary to deliver the website may be processed. Depending on the technical configuration, this may include information such as:

IP address; date and time of access; requested page or resource; browser and device information;
operating system; technical request and error information. Such processing is carried out where necessary for the technically reliable and secure provision of the website.

Showit is a US-based provider. Showit states that it applies privacy safeguards to international processing and transfers in accordance with applicable privacy laws.

We do not use Showit's native contact form for the private Portrait Commission Inquiry; that form is provided through Flodesk.

4. STRATO

We use STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany for:
domain registration; DNS administration; email hosting; webspace.

STRATO may process technical and account information where required to provide these services. STRATO operates German data centres and describes its services as subject to the applicable European and German data-protection framework.

When you email studio@atlantaweiss.art, the email and associated metadata may therefore be processed through STRATO's email infrastructure.

Depending on the nature of the communication, processing is generally based on Art. 6(1)(b) GDPR where it concerns a contract or potential contract, or Art. 6(1)(f) GDPR for other legitimate business correspondence.

5. Server and Technical Data

Technical data may be processed automatically when you access our website. This may include:
IP address; date and time; browser type and version; operating system; referring page; requested URL;
technical error information.

This data is used principally to:
deliver the website; maintain technical stability; detect errors; protect the website against misuse and attacks.

The legal basis is generally Art. 6(1)(f) GDPR.

6. Cookies and Similar Technologies

Our website and services may use cookies or similar technologies where technically necessary to provide requested functionality.

Under § 25 TDDDG, storing information on a user's device or accessing information already stored there generally requires informed consent unless the technology is strictly necessary for transmission of a communication or for a digital service expressly requested by the user.

Where optional analytics, marketing or advertising technologies are introduced in the future, they will only be activated in accordance with applicable consent requirements.

Current analytics status
Atlanta Weiss Studio currently does not use:
Google Analytics through Google Tag Manager;
active Google Tag Manager marketing/analytics tags;
WP Statistics.

If these technologies are introduced in the future, this Privacy Policy and the website's consent settings will be updated accordingly.

7. General Contact Enquiries

When you contact us by email or through a contact form, we process the information you provide in order to respond to your enquiry. This may include: name; email address; location; content of your message; information concerning the artwork, service or subject of your enquiry.

Where your enquiry concerns a potential contract or purchase, processing is generally based on Art. 6(1)(b) GDPR. For other legitimate business correspondence, processing may be based on Art. 6(1)(f) GDPR.

We disclose enquiry information only where necessary for the relevant purpose, to processors acting on our behalf, or where another lawful basis permits or requires disclosure.

8. Private Portrait Commission Enquiries

When you submit a Private Portrait Commission Inquiry, we may process information including:
your name; email address; city and country; who you would like the portrait to depict; which Portrait Experience you are considering; preferred artistic medium; desired timeframe; significant dates or occasions; information about where the finished artwork may live; privacy preferences; personal context or stories that you voluntarily choose to share.

We use this information to evaluate your enquiry, respond to you, determine whether a commission may be appropriate and, where relevant, arrange a private consultation or prepare a proposal.

The legal basis is generally Art. 6(1)(b) GDPR, as processing takes place at your request before a potential contract is concluded. Submitting a portrait inquiry does not automatically subscribe you to Studio Notes or other marketing communications.

9. Portrait Reference Materials and Personal Photographs

During a portrait enquiry or commission, you may provide photographs, visual references, documents, stories or other information relating to yourself or another person. These materials are processed for the purpose of:
understanding the commission; developing the artistic concept; creating the commissioned artwork; communicating with you during the commission; documenting the commissioned work where necessary.

Where another identifiable person appears in materials you provide, you should ensure that you are entitled to provide that material to us. Special care is taken where photographs or information concern children.

Publication and privacy
Providing photographs, stories or personal information for the purpose of a private portrait commission does not constitute permission for Atlanta Weiss Studio to publish them. We do not publish or publicly identify:
private portrait photographs; reference materials; your name; your home; your family; personal stories; behind-the-scenes material; details of the existence of a private commission merely because you submitted them to the studio.

Any public use, exhibition, publication, press use or marketing use requiring permission will be agreed separately.
Some collectors welcome public visibility. Others prefer complete discretion.
Both are equally respected.

10. Flodesk — Forms and Email Communications

We use Flodesk, Inc. for certain:
website forms; Private Portrait Commission Inquiries; Newsletter subscriptions; Portrait Letter Club waitlists and membership; email communications; subscriber management; email workflows and segmentation.

Depending on the form or interaction, Flodesk may process:
name; email address; form responses; subscriber status; interests or segments; technical and delivery information; engagement information where applicable.

Flodesk states that, where a business such as Atlanta Weiss determines the purpose of processing, the business acts as controller and Flodesk acts as processor.

Marketing communications
Where you subscribe to Newsletter or another marketing communication, processing is generally based on your consent under Art. 6(1)(a) GDPR.

You may unsubscribe at any time by using the unsubscribe link contained in the relevant email.

Submitting: a portrait inquiry; an artwork enquiry; a purchase; a customer-service request
does not by itself constitute consent to receive marketing emails.

11. Newsletter / Studio Notes

If you subscribe to Newsletter / Studio Notes, we process the information required to send these communications.
This ordinarily includes: name, where supplied; email address; subscription and consent information; date and source of subscription; unsubscribe status.

Your legal basis is your consent under Art. 6(1)(a) GDPR. You may withdraw your consent at any time.

After you unsubscribe, we may retain limited suppression information where necessary to ensure that your unsubscribe request continues to be respected.

12. Portrait Letter Club Waitlist and Membership

If you join the Portrait Letter Club private waitlist, we use your information to:
record your interest; provide relevant pre-launch information; inform you when Portrait Letter Club opens; administer the waitlist. Joining the waitlist does not create a paid membership or subscription.

Any future paid Portrait Letter Club membership will be subject to the applicable terms presented when the membership launches. Where marketing communications are sent on the basis of consent, you may withdraw that consent at any time.

13. Online Shop — Shopify

The Atlanta Weiss Studio online shop is operated using Shopify. When you visit the shop or place an order, Shopify may process personal data including: name; email address; billing address; delivery address; order information; products purchased; payment-related information; IP address; browser/device information;
information used for security and fraud prevention.

Where Shopify processes customer data on our instructions in providing its merchant services, Shopify's current Data Processing Addendum generally identifies the merchant as controller and Shopify as processor, subject to certain Shopify services where Shopify may have a different role.

For European merchants, Shopify's primary contracting entity is generally Shopify International Limited in Ireland.
Data may also be processed outside the EEA. Shopify describes safeguards including adequacy mechanisms and Standard Contractual Clauses for relevant transfers.

Processing connected with a purchase is generally based on Art. 6(1)(b) GDPR.
Information required for tax, bookkeeping or statutory record keeping is processed pursuant to Art. 6(1)(c) GDPR.
Security and fraud-prevention processing may be based on Art. 6(1)(f) GDPR where appropriate.

14. Payments

Payments in the online shop are processed using the payment methods made available at checkout.
The relevant payment provider may process information required to authorise and complete the transaction.
We do not normally receive your complete payment-card information. The payment methods available may vary according to country, device and Shopify configuration. Further information about the relevant payment provider is available through the provider's own privacy information.

15. WhiteWall — Production and Fulfilment

For selected photographic artworks, prints and editions, we use:
WhiteWall Media GmbH
Europaallee 59
50226 Frechen
Germany.

WhiteWall is connected to our ecommerce fulfilment process. When an eligible artwork order is placed through our Shopify shop, the information required for production and fulfilment is transferred automatically to WhiteWall.
Depending on the order, this may include: recipient name; delivery address; order and product specification; format and production information; shipping information; other information necessary to manufacture and deliver the artwork.

This processing is necessary to fulfil your purchase and is generally based on Art. 6(1)(b) GDPR.
WhiteWall or the relevant delivery provider may process the information necessary to ship the finished work.

16. Shipping and Delivery Providers

Where physical artworks or other items are shipped, personal information may be provided to the relevant shipping or logistics provider. This ordinarily includes: recipient name; delivery address; shipment information;
where necessary, email address or telephone number for delivery coordination.

Processing is based on Art. 6(1)(b) GDPR to the extent necessary to fulfil the purchase.

17. Google Drive and Google Workspace

We may use Google Workspace and Google Drive internally for studio administration, document storage, collaboration or controlled delivery of certain materials. Where personal data is stored or processed through these systems, we limit access according to the relevant business purpose. Google may process information internationally in accordance with its own contractual and privacy safeguards.

18. Recipients of Personal Data

Personal information may be disclosed where reasonably necessary to: hosting and infrastructure providers; email and form providers; ecommerce providers; payment providers; production and fulfilment partners; shipping and logistics providers; IT and cloud-storage providers; accountants, tax advisers, lawyers or other professional advisers; public authorities where disclosure is legally required.

We do not sell our collector, client or subscriber lists to data brokers.

19. International Data Transfers

Some service providers used by Atlanta Weiss Studio are based outside Germany or the European Economic Area. This can include, in particular: Showit; Flodesk; certain Shopify entities or subprocessors; Google services.

Where personal data is transferred to a country outside the EEA, appropriate safeguards are used where required by law. Depending on the provider and destination, these may include:

an adequacy decision by the European Commission;
EU Standard Contractual Clauses;
other recognised international-transfer mechanisms.

Flodesk's current DPA expressly covers international processing of customer personal data, while Shopify's current DPA describes its mechanisms for EEA transfers.

20. Data Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose and any applicable legal requirements. As a general internal framework:

General enquiries
Information relating to an enquiry that does not develop into a continuing relationship may ordinarily be retained for up to approximately 24 months after the last substantive communication, unless a shorter or longer period is appropriate.

Portrait commission enquiries
Information relating to an unsuccessful portrait enquiry may ordinarily be retained for up to approximately 24 months, unless you request earlier deletion and no legal reason requires continued retention.
Particularly sensitive reference materials that are no longer required should be deleted earlier where reasonably practicable.

Completed commissions and collectors
Contractual, transaction and accounting information is retained for the periods required under applicable law.
Limited information relating to: artwork ownership; edition records; provenance; certificates; authenticity; commission history may be retained for longer where reasonably necessary to document the artwork and protect the legitimate interests of the artist and collector.

Portrait reference materials
Reference photographs and related materials are retained only for as long as reasonably required for the commission, agreed studio documentation, legal claims or another legitimate and lawful archival purpose.
Public use remains subject to the separate privacy/publication arrangements agreed with the client.

Newsletter / Studio Notes
Subscriber information is retained while you remain subscribed. Following unsubscribe, limited information may be retained where necessary to record and respect the unsubscribe request.

Shop orders
Order, invoice and transaction records are retained for applicable statutory commercial and tax retention periods.

21. Security

We take appropriate technical and organisational measures designed to protect personal data against:
accidental loss; unauthorised access; unlawful disclosure; alteration; destruction.
However, no electronic transmission or storage method can be guaranteed to be completely secure.

22. Your Rights

Subject to the requirements and exceptions of applicable law, you may have the right to:
obtain information about the personal data we process about you; receive a copy of your personal data; correct inaccurate data; request deletion; request restriction of processing; object to certain processing; receive certain personal data in a portable format; withdraw consent at any time where processing is based on consent.

Where you object to direct marketing, we will stop using your personal data for that purpose. To exercise your rights, contact: studio@atlantaweiss.art

We may request information necessary to verify your identity before fulfilling certain requests.

23. Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal applies for the future and does not make earlier lawful processing unlawful. Marketing emails contain an unsubscribe option where applicable.

24. Right to Object

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, you may have the right to object to processing for reasons relating to your particular situation. Where personal data is processed for direct marketing purposes, you may object at any time.

25. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority. For a business established in North Rhine-Westphalia, the competent supervisory authority is generally:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf
Germany

26. Children

The general website, Newsletter/Studio Notes and commercial services are intended for adults.
Portrait commissions may involve children. Where a child's personal data or photographs are supplied for the purpose of a portrait commission, they should be supplied by or with the appropriate authority of a parent, guardian or other person entitled to provide them. We treat such materials with particular care.

27. External Links

Our website may link to external websites and services. Once you follow an external link, the relevant third party's privacy practices apply. We are not responsible for the privacy practices of independent external providers.

28. Changes to This Privacy Policy

We may update this Privacy Policy where our services, technology, providers or applicable legal requirements change. The current version will always display the date of the most recent update. Where a material change requires specific notice or renewed consent, this will be handled as required by applicable law.

29. Contact

For questions concerning privacy or your personal data:
Atlanta Weiss trading as Atlanta Weiss / Atlanta Weiss Studio

Address for legal documents / Ladungsfähige Adresse:
Atlanta Weiss
c/o Postflex PFX-174-085
Emsdettener Str. 10
48268 Greven
GERMANY

Correspondence address / Postanschrift:
Atlanta Weiss
Postfach 72 02 02
50757 Cologne
GERMANY


Email: studio@atlantaweiss.art

Website: https://atlantaweiss.art