Privacy policy

Who is responsible for your data

The controller of your personal data is Sofia Kyriakou, trading as Sofistike, in Aradippou, Larnaca, Cyprus. [TODO(client): legal form and registration details of the business, if any]

For anything about your personal data, write to us at hello@sofistikehandpainted.com.

What data we collect

The website has no user accounts and does not ask for any details just to browse it. We collect data only when you send a request through the contact form:

• What you write: your name, your phone number or email address (or both), the category you chose and the description of your idea.
• Reference photos, up to three, if you choose to send them. They are shrunk on your device before sending, and location and other metadata are removed. The file name is not sent.
• How you reached the website: the UTM parameters of the link you followed (if any) and the address of the page you came from, without anything after the question mark.
• The language of the page and the time the request was sent.

Sending a request is voluntary. Without a name, a way to contact you and a description of your idea, we cannot reply. Please do not put sensitive data (for example about your health or beliefs) in your message or photos.

To keep the form safe, the check against automated messages (Cloudflare Turnstile) and the request limit briefly process your IP address and details of your browser (see below).

If you call me or message me on WhatsApp, I see your number and what you send, and I use them only to reply to you. WhatsApp belongs to Meta, so its own privacy policy also applies to messages there.

Why we use it, and the legal basis

The box “I have read the privacy policy” on the form confirms that you have been informed. It is not the legal basis of the processing: we do not rely on your consent.

• To answer your request and send you a proposal and a price and, if we go ahead, to make and deliver the piece: steps taken at your request before a contract, and performance of a contract (Article 6(1)(b) GDPR).
• To send you an automatic confirmation, if you gave an email address: the same reason (Article 6(1)(b)).
• To keep the form safe and stop spam: a check against automated messages and a limit on requests per connection. It is our legitimate interest that nobody abuses the form (Article 6(1)(f)).
• To understand where requests come from (for example Instagram or TikTok) and how the website is doing, with combined statistics and no cookies: our legitimate interest in improving how we reach customers and the website (Article 6(1)(f)).
• To meet accounting and tax obligations, when a request becomes an order (Article 6(1)(c)).
• To establish or defend legal claims, if needed (Article 6(1)(f)).

We make no automated decisions and build no profiles from your data. We do not sell or rent personal data.

Who processes the data

Sofia and the web studio that maintains the website on her behalf can see the data. To run the website and the form we use the providers below, which process data on our behalf (processors) under the data processing terms they offer:

• Vercel: hosting of the website, storage of the photos you send, and server logs. The code of the website runs in a data centre in Frankfurt.
• Neon: the database where requests are stored. It is located in Frankfurt.
• Upstash: the request limit per connection. For a few minutes it keeps only a coded form (hash) of the IP address. It is located in Frankfurt.
• Resend: sending of emails, that is the notification to us and the automatic confirmation to you. Sending runs from Ireland. It keeps the content of the emails it sends for as long as its own policy says.
• Cloudflare: the check against automated messages (Turnstile) on the form, which sees your IP address and details of your browser when you use the form, and the forwarding of email sent to hello@sofistikehandpainted.com (Email Routing).
• Google (Gmail): messages to hello@sofistikehandpainted.com arrive in Gmail inboxes, where we also receive the notification of every new request with its photos, and where our replies stay.

We do not pass your data to anyone else, unless the law or an authority requires it.

Transfers outside the European Economic Area

Vercel, Neon, Upstash, Resend, Cloudflare and Google are companies based in, or owned from, the United States. Your data is stored mostly in data centres in the European Union (Frankfurt, Ireland), but access by these companies can mean a transfer to the United States. Depending on the provider, the transfer relies on the EU-US Data Privacy Framework, in which the company takes part, or on the standard contractual clauses of the European Commission.

How long we keep it

We keep data only as long as it is needed:

• Requests that did not become an order: 12 months after our last contact. Then they are deleted.
• Requests that became an order: as long as accounting and tax law requires for the related documents. Then they are deleted.
• Reference photos: deleted together with the request.
• Copies in the Gmail inboxes: deleted together with the request.
• The coded IP address for the request limit: a few minutes.
• Server logs of the hosting provider: for the short time Vercel keeps them. We do not write the content of requests to them.

You can ask us to delete your request earlier (see “Your rights”).

Cookies and storage on your device

The public website does not store cookies on your device. It has no advertising or tracking tools, so there is no cookie banner.

• Visit statistics: we use Vercel Web Analytics and Vercel Speed Insights. They measure pages, countries, devices, sources of visits and loading speed, without cookies and without building a profile of the visitor. Sending the form shows up as a visit to the “Thank you” page.
• Source of the visit: when you open the website, the page keeps the UTM parameters of the link (if any) and the address of the page you came from, without anything after the question mark, in the sessionStorage of your browser tab. This holds nothing that identifies you, is not read by third parties, is deleted when you close the tab, and reaches us only if you send the form. It tells us which channel brought the request.
• Security check of the form: when you start to use the form, Cloudflare’s Turnstile loads. It may use its own cookies or browser storage, which it needs for security. If you do not touch the form, there is no contact with Cloudflare at all.
• Site administration: the administration area (/admin), used only by Sofia and her collaborators, uses one session cookie that is strictly necessary for logging in. No visitor of the public website receives it.

Your rights

Under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) you have the right to:

• access your data and get a copy of it,
• have inaccurate data corrected,
• have it erased, when it is no longer needed or there is no legal basis for us to keep it,
• restrict the processing,
• receive the data you gave us in a portable form,
• object to processing that is based on legitimate interest.

To exercise a right, write to us at hello@sofistikehandpainted.com. We may ask for details that confirm the request comes from you, such as the email or phone number you gave in the form. We reply within one month at most. If the request is complex, the deadline can be extended by two more months and we will tell you. Exercising your rights is free.

If you think the processing breaks your rights, you can lodge a complaint with the data protection authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection.

Changes to this policy

If anything changes in the way we process data, we will update this page and its date at the top.