Privacy Policy (EN)

Last updated: September 2025

1) Data Controller

Lorenzo Papace — self-employed artist (Ireland)
Co. Carlow, Ireland
Email: contact@lorenzopapace.fr

2) Personal data we process

Depending on how you interact with the site (WordPress / WooCommerce):

• Account & orders: first/last name, email, billing/shipping addresses, phone (if provided), order contents, amounts, payment method reference, order history, order notes.
• Payment: data sent to providers (WooPayments/Stripe, PayPal). Full card details do not pass through or reside on our servers.
• Shipping: delivery details needed by UPS, tracking number.
• Support / Contact / Returns: email, message content, attachments, conversation logs, return number (RMA).
• Blog comments: name/pseudonym, email, content, IP address and user agent (anti-spam). A hashed version of your email may be sent to Gravatar to check for a profile.
• Technical & security logs: IP addresses, user agent, timestamps, login/error events (abuse prevention, anti-spam, anti-doxxing).
• Cookies & analytics: see § 6.

3) Purposes & legal bases

• Contract performance: order processing, payments, delivery, customer service, returns/refunds.
• Legal obligations: invoicing, accounting, tax and commercial obligations, consumer rights.
• Legitimate interests: site security, fraud/abuse prevention (incl. anti-spam), service improvement, evidence in case of disputes, protection of individuals (anti-doxxing).
• Consent: newsletter (if you subscribe), non-essential cookies, third-party embeds that require consent. You may withdraw consent at any time.

4) Recipients / processors (categories)

• Hosting & maintenance (WordPress/OVH) and backups.
• Payments: WooPayments/Stripe, PayPal (authentication, anti-fraud, settlement).
• Shipping: UPS (label, tracking).
• Anti-spam / security: filtering extensions, application firewall where applicable.
• Emailing / forms / newsletter (if enabled).
• Embedded services: Gravatar (comments), video players (YouTube, Vimeo, etc.).

A named, up-to-date list of processors is available on request.

5) Transfers outside the EEA

Some providers may be located outside the European Economic Area. We rely on a lawful transfer mechanism (EU Standard Contractual Clauses, adequacy decisions, etc.).

6) Cookies & embedded content

• Necessary cookies: site operation, cart, authentication, security (legal basis: legitimate interest / contract performance).
• Analytics / marketing cookies: only after consent via the cookie banner.
• Embedded content (videos, social posts): these third-party services may set their own cookies and track your interactions under their policies.

If you upload images, please remove EXIF metadata (geolocation). When commenting, a cookie may remember your name/email for convenience.

7) Retention periods (principles)

• Orders / invoicing: statutory retention in Ireland (generally up to 6 years from the end of the fiscal year).
• Customer accounts: while the account is active; deletion on request (except data we must retain by law).
• Support / returns: duration of the case + up to 3 years for evidential archiving.
• Comments: for the life of the content; related anti-spam data kept as long as needed for security.
• Cookies: by category (consent logs typically up to 13 months in line with EU guidance).

8) Your rights (GDPR)

You have the rights to access, rectify, erase, restrict, object (including to processing based on legitimate interests), data portability (where applicable), and to withdraw consent at any time.
To exercise your rights: contact@lorenzopapace.fr
Supervisory authority: Data Protection Commission (Ireland) — www.dataprotection.ie

9) Security

Proportionate technical and organisational measures: TLS encryption, strict access control, backups, regular updates, anti-spam/anti-bot filtering, security logging.
We do not publish any private residential address; a business correspondence address is used.

10) Minors

The site is not intended for children under 16. We do not knowingly collect their data without authorisation from the holder of parental responsibility.

11) External links

Third-party sites have their own privacy and cookie policies. Please consult them directly.

12) Updates

We may update this policy for legal, technical or operational reasons. The header shows the last update date. In case of material changes, we will take appropriate steps to inform you.

WordPress / WooCommerce annex

Comments & Gravatar
When you comment, we collect the form data plus IP and user-agent (anti-spam). A hashed version of your email may be sent to Gravatar to check for a profile (policy: automattic.com/privacy). After approval, your avatar may appear publicly.

Payments
Payments are processed by WooPayments/Stripe and PayPal, which act as independent controllers for certain operations (anti-fraud, compliance). We do not store your full card details.

Shipping
To fulfil orders we share necessary data with UPS (name, delivery address, email/phone for tracking).

Forms & anti-abuse
To protect the site and users (anti-doxxing, anti-spam), we log certain technical information (IP, user-agent, timestamp). Legal basis: legitimate interests.