Privacy Policy

1. Data Controller

The controller responsible for the personal data collected on this website is:

• Name: Francisco Javier Camacho Ramos-Clemente
• Activity: Visual artist — original artwork sales
• Artist name: wavesbyjavier
• Location: Huelva, Andalusia, Spain
• Contact email: contact@wavesbyjavier.com

2. What data do we collect?

Depending on your activity on our website, we may collect the following data:

When placing an order or sending an enquiry:

• First and last name
• Email address
• Phone number (optional)
• Delivery address
• Message or description of your commission request

Automatically when visiting the website:

• IP address (anonymised)
• Browser type and device
• Pages visited and browsing time

3. Why do we use your data?

• To manage and ship your order
• To respond to your enquiries and custom commission requests
• To send you updates on your order status
• To improve your browsing experience on the website
• To comply with our legal and tax obligations

We will not use your data to send you unsolicited marketing. If we ever wish to send you a newsletter, we will ask for your explicit consent first.

4. Legal basis for processing

• Contract performance: when you place an order, processing is necessary to manage and deliver it.
• Consent: when you fill in the contact or commission request form.
• Legitimate interest: to improve the website and detect technical issues.
• Legal obligation: retention of tax data for the legally required period.

5. Who do we share your data with?

We only share your data with third parties that are essential to provide the service:

• Shipping companies: to manage delivery of paintings (name and delivery address only).
• Payment processor (Stripe): to process payments securely. Stripe has its own privacy policy and is GDPR compliant.
• Email service: to respond to your messages.

We never sell your data to third parties or pass it on for advertising purposes.

6. How long do we keep your data?

• Order data: 5 years (Spanish tax law obligation)
• Enquiries and commissions: 2 years from last communication
• Browsing data: maximum 13 months

7. Your rights

You may exercise the following rights over your data at any time:

• Access: know what data we hold about you
• Rectification: correct inaccurate or outdated data
• Erasure: request deletion of your data ("right to be forgotten")
• Objection: object to certain uses of your data
• Portability: receive your data in a readable format
• Restriction: request that we limit processing

To exercise your rights, write to us at contact@wavesbyjavier.com with the subject "GDPR Rights". We will respond within 30 days.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with your local data protection authority within the EU.

8. Security

We take technical and organisational measures to protect your data: HTTPS connection, restricted access to data, and storage on encrypted servers. However, no system is 100% failsafe. In the event of a security breach affecting your data, we will inform you within the legally required timeframes.

9. Cookies

This website uses technical cookies (essential for functionality) and, if you accept, analytical cookies to improve your experience. See our Cookie Policy for more details.

10. Changes to this policy

We may update this policy when necessary. The "last updated" date in the header reflects the current version. We recommend reviewing it periodically.