Storefront Privacy Notice

1. Scope and overview

This notice explains how personal data is processed in the public ARVONAR storefront and private Business access. It covers browsing, newsletter subscriptions, inquiries, artist contact, reviews, the chat assistant, reservations, purchases, Business accounts and projects, document delivery and legal evidence.

This notice covers the public ARVONAR storefront, including artist areas served through a custom domain, and the private, authenticated ARVONAR for business area. Artist and admin accounts receive a separate privacy notice.

You can use large parts of the site without actively giving us personal data. However, technical data is processed when the site is called, and additional data is processed when you use interactive features.

2. Controller roles and contact

ARVONAR is responsible for the processing described here to operate the platform, including the website, reservations, technical checkout, document delivery and platform communications. The platform operator's name and address are available in the legal notice. Privacy contact: kontakt@arvonar.de.

The artist is the seller of the artwork. The seller receives the information needed for the sale, shipping, seller support, returns, withdrawal and warranty claims. The seller is responsible for their own processing for these purposes. Their contact details are available in the artist area and during the purchase.

The relevant sections below explain which information we disclose and the legal bases for processing.

3. Hosting, database, security, and logs

To run the storefront and PostgreSQL databases, we use server infrastructure provided by Hetzner Online GmbH in Germany, together with supporting infrastructure for secure delivery, webhooks, document downloads, and email flows. When you access the site, technical request data such as IP address, browser information, requested URL, timestamp, and security-relevant event data may be processed.

We also use Sentry for error monitoring and incident response. Where feasible, we try to avoid or redact direct identifiers in monitoring data.

During the phased storage transition, public artwork images and artist media are stored and delivered either through Cloudinary or through a separate media area in Hetzner Object Storage. Existing media remains with its current provider without automatic migration; changing the configured provider for new uploads does not change where existing media is stored.

Legal basis: Art. 6(1)(f) GDPR. Where providers process data outside the EU/EEA, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.

4. Analytics, marketing measurement, consent, and browser storage

The storefront offers optional consent choices for anonymous analytics via Plausible Analytics and marketing measurement via Google Ads. Plausible events are sent only if you enable analytics in our privacy settings. The Google Ads tag is loaded only if you enable marketing in the privacy settings.

Independently of this optional analytics processing, ARVONAR maintains its own identifier-free, aggregated statistics for public portfolios, galleries, and the artist directory. When a portfolio overview, portfolio artwork, portfolio series, or gallery artwork page is actually requested, when a gallery artwork page initiates a checkout operation, or when a visitor moves from the artist directory to an artist profile, only an existing daily counter is incremented. The statistics dataset contains the artist reference, page type, an artwork or series reference where required, calendar day, event type, language, and count; gallery and checkout counters may additionally contain the artwork status. Search terms from the artist directory are not stored. The dataset contains no IP address, cookie, visitor, session, or browser identifier, no referrer, and no individual usage history. Repeat requests may be counted more than once; unique visitors are not determined. ARVONAR uses the aggregated results for internal product management and makes them available only to the relevant artist and authorized ARVONAR administrators. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is a data-minimized assessment of reach, interest, and demand. These statistics do not use an additional tracking pixel and do not store or read information on your device for this purpose.

When marketing measurement is enabled, Google Ads and the Google tag may process browser-related identifiers, ad click information, usage events, and consent signals to measure advertising performance and provide advertising features after consent. In this first implementation, ARVONAR does not send enhanced conversion data such as email address, name, address, or phone number to Google.

Your preference is stored in your browser. We also use technically necessary cookies and browser storage for storefront operation, for example checkout reservations, duplicate-event prevention after checkout, and remembering your consent choice.

Legal bases: Art. 6(1)(a) GDPR for optional analytics and marketing measurement, and Art. 6(1)(f) GDPR for technically necessary storage and secure operation.

Section 25 TDDDG also governs storing or accessing information on your device. Consent is not required where this is strictly necessary to provide a service you expressly request (section 25(2), no. 2 TDDDG). Optional access for analytics or marketing requires your consent (section 25(1) TDDDG). The GDPR legal bases described above apply to any subsequent processing of personal data.

5. Reservations, orders, payments, and documents

If you reserve or buy an artwork, we process data such as your name, email address, shipping address, locale, order amount, reservation token, and Stripe session/payment identifiers.

Payments are processed through Stripe. Invoices and certificates of authenticity are stored privately in Hetzner Object Storage and delivered through first-party download routes or by email. Transactional emails are sent via IONOS. Where necessary for sale fulfillment, delivery coordination, after-sales support, return or withdrawal handling, warranty handling, or legally required business operations, the relevant artist or seller may also receive the required customer and order data. Depending on the operational setup, this data may be made available through the ARVONAR admin area, first-party document or download routes, operational mailboxes, or other ARVONAR-supported communication channels. Where email is used, communication may take place through an ARVONAR-managed email address on the arvonar.de domain or through the artist's own business email address.

Order, invoice and accounting data are retained for necessary contract performance and the applicable statutory duties. Statutory periods are generally eight years for invoices and accounting vouchers, six years for relevant business correspondence, and ten years for books, records and the corresponding tax documentation. Where legally required, periods begin at the end of the relevant calendar year. Statutory extensions and necessary preservation of outstanding receivables or legal claims remain applicable; contract and acceptance evidence is reviewed according to its specific evidential purpose. There is no blanket ten-year period for all contact details. Legal bases: Art. 6(1)(b), (c) or (f) GDPR.

6. Contact, artist contact, artwork inquiries, B2B, and commissions

If you contact us by email or use artwork inquiry, B2B inquiry, or commission forms, we process the information you submit in order to answer your request and handle follow-up. Depending on the form, this may include your name, email address, company, project details, size preferences, budget, timeline, and free-text message.

If you use the public artist contact form, we process the contact details you provide, your email address, an optional link to your website or social media profile, and your free-text message in order to answer your contact request and communicate with you about a possible later presentation of your works on ARVONAR. This artist contact data is not passed to individual sellers; it is handled internally at ARVONAR and processed through the email infrastructure we use.

If you use the public artist registration, we store your name, email address, optional artist name, portfolio link, and voluntary short introduction in the ARVONAR database. We send a single-use confirmation link through IONOS that expires after 48 hours. Only a hash of the activation token is stored in the database. After successful confirmation, a non-public ARVONAR Portfolio profile and an admin account with a password hash are created. The profile becomes public only after your own submission and one manual publication review by an ARVONAR super admin. Review status and required change notes are stored with the account; ordinary later profile edits do not trigger another review. The legal bases are Art. 6(1)(b) GDPR for pre-contractual steps and account provision, and Art. 6(1)(f) GDPR for verification, abuse prevention, and quality assurance before publication.

To answer your request, the relevant artist or seller may receive the necessary inquiry or commission data. Depending on the operational setup, this data may be made available in the ARVONAR admin area, in operational mailboxes, or through other ARVONAR-supported communication channels. Where email is used, communication may take place through an ARVONAR-managed email address on the arvonar.de domain or through the artist's own business email address. Commission requests may later include quote or payment-link metadata if the request advances. Emails are sent through IONOS.

Legal basis: Art. 6(1)(b) GDPR where your request is aimed at a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR. Our current retention targets are generally up to 12 months after the last reply for artwork inquiries, up to 24 months after last activity for commission and B2B requests, and up to 24 months after last activity for artist contact requests unless the request converts into an artist or admin relationship; mailbox copies may remain in operational mailboxes for the applicable operational or legal retention period.

6.1 ARVONAR newsletter

If you subscribe to the central editorial ARVONAR newsletter, we process your normalized email address, selected language, signup source, request and confirmation timestamps, subscription status, and technical evidence such as IP address and user agent. We also store the consent-text version and the associated double-opt-in evidence.

The subscription is initially pending. We send a confirmation link through IONOS that remains valid for 48 hours. The address only becomes active after explicit confirmation. The newsletter is used solely to provide information about curated artworks, artistic practices, and news from ARVONAR; the data is not provided to individual artists as their own mailing list. The legal basis is your consent under Art. 6(1)(a) and Art. 7 GDPR.

You may withdraw your consent at any time with effect for the future through your personal unsubscribe link or by emailing kontakt@arvonar.de. Every future newsletter campaign must include this unsubscribe link. Unconfirmed requests are never used as subscriptions and are deleted no later than 30 days after the confirmation window expires. Active subscription data is stored until withdrawal; afterwards, the email address, suppression reason, and evidence needed to prevent further messages and demonstrate the former consent are retained. Technical suppression following a complaint or permanent delivery failure cannot be removed through public resubscription; a voluntary unsubscription can only be replaced by a new double-opt-in subscription.

7. Reviews and post-purchase feedback

If you voluntarily submit a review using a valid review link, we process your name, your email address from the related order, the order reference, review token, star rating and optional comment. Approved reviews may be published. ARVONAR and, where necessary, the responsible artist have access for handling and moderation. Processing serves authentic purchase feedback and the prevention of abuse (Article 6(1)(f) GDPR). Retention periods are described in section 10. ARVONAR currently does not send review requests by email.

8. Chat assistant, “view in room” and email reply assistance

If you use the storefront chat assistant, we process the live message content you send, your locale, artwork/artist context, and interaction metadata in order to generate a reply and evaluate broad outcomes such as whether the conversation led to a CTA.

Chat responses are currently generated through Anthropic or OpenAI, depending on the active provider configuration or controlled experiments. New raw chat transcripts are no longer stored in our application database. We only retain minimized chat insight/outcome records for a short operational window, currently targeted at 90 days.

If you use “view in room” with your own room photo, that image stays on your device/browser in the current implementation. It is not uploaded to our servers. Legal basis: Art. 6(1)(f) GDPR for requested storefront assistance and feature operation.

AI assistance for email replies

Authorised staff may request AI assistance to summarise correspondence and prepare a reply for mailboxes they can access. Where this function is used, Anthropic receives excerpts from up to eight messages, sender and subject information, available customer contact details and related order or inquiry references. The assistance produces a summary and a draft reply. It does not send emails; an authorised person reviews, where necessary edits, and sends the reply. Processing supports the handling of your inquiry. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to answer inquiries promptly and consistently. Section 9 explains recipients and possible international transfers.

9. Processors, recipients, and international transfers

Depending on the feature you use, our processors and recipients may include the relevant artist or seller, Hetzner for application and database servers as well as Object Storage, Stripe, IONOS, Plausible, Google Ads, Sentry, Cloudinary for existing and, depending on configuration, new storefront media, and Anthropic and OpenAI for chat and Anthropic for optional email reply assistance. Where artist communication or fulfillment is involved, the artist may receive data through the ARVONAR admin area, first-party document or download routes, operational mailboxes, or other ARVONAR-supported channels. Where email is used, this may include an ARVONAR-managed email address on the arvonar.de domain or the artist's own business email address.

Some of these providers may process data outside the EU/EEA or use global support structures. Where this happens, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses. More information about the relevant safeguards can be requested via kontakt@arvonar.de, and we update this notice when the processor setup changes materially.

Where communication is routed through ARVONAR-managed operational mailboxes, ARVONAR may access mailbox content and related metadata where needed for support, security, abuse prevention, continuity, legal compliance, or technical administration. If communication is routed to the artist's own business mailbox, that mailbox is operated outside ARVONAR's direct technical control.

10. Retention and deletion principles

We keep personal data only as long as needed for the relevant purpose, legal obligations, or the defense or enforcement of claims. The main target periods in the current storefront model are:

• Orders and legal evidence: according to contractual and evidential purpose; invoices and accounting vouchers generally eight years, relevant business correspondence six years, books and corresponding tax records ten years, with the statutory qualifications described above.
• Identifier-free portfolio and artist-directory statistics: aggregated daily figures for up to 24 months. Identifier-free gallery and checkout artwork statistics: daily figures for up to 24 months, then condensed into monthly figures and retained for up to 5 years. Individual visitor events are not stored.
• Minimized chat insight/outcome data: 90 days.
• Artwork inquiries: generally up to 12 months after the last reply.
• Commission, B2B request, and artist contact data: generally up to 24 months after last activity unless converted into an order, accounting, or artist-account context.
• Structured artist registrations: up to 30 days after expiry or account creation; the created admin and artist account then follows the account-based retention periods.
• Unconfirmed newsletter requests: no later than 30 days after the confirmation link expires. Active subscriptions: until withdrawal; afterwards only the necessary suppression and consent evidence.
• Pending and rejected reviews: the regular cleanup policy provides for deletion after 360 days without an update, in the next successful cleanup run. Submitted and approved reviews are not automatically deleted; we assess continued necessity and erasure requests individually. New review links are generally valid for 90 days. For older links without a stored expiry, only the time limit is absent; the other access requirements still apply. Link expiry and data deletion are separate processes.
• Operational mailbox copies and purely operational email flows: the applicable operational or legal retention period, followed by deletion or anonymization where feasible.

If data must be kept longer for legal reasons, dispute handling, or fraud prevention, we restrict access and keep only what is necessary.

11. Your rights, consent choices, required data, and automated decisions

You have the rights under the GDPR, especially access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You can also withdraw optional analytics and marketing-measurement consent at any time through our privacy settings with effect for the future. Newsletter consent can be withdrawn through your personal unsubscribe link or by emailing kontakt@arvonar.de.

To exercise your rights, contact kontakt@arvonar.de. If your request concerns a completed sale or fulfillment by the respective seller, we may need to coordinate with that artist in order to answer properly. Some checkout, payment, shipping, and inquiry data is contractually or operationally required so that we can start checkout, process an order, answer a request, or coordinate fulfillment. If required data is not provided, we may be unable to provide the relevant order or inquiry flow.

ARVONAR does not currently use solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you in the storefront flows described here.

You may withdraw consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing based on that consent before its withdrawal.

Your right to object: Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you may object for reasons relating to your particular situation. We will stop this processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons; we will then stop using your data for that purpose. Contact kontakt@arvonar.de.

12. Complaints and changes to this notice

You have the right to lodge a complaint with a data protection supervisory authority, especially in the member state of your habitual residence, place of work, or the place of the alleged infringement. A German overview is available here: Federal Commissioner for Data Protection — contact details.

We update this notice when processors, retention rules, or storefront data flows change materially.

13. External links to social networks

Our social media links lead to external profiles, for example on Instagram, TikTok, Pinterest, LinkedIn or Facebook. We do not embed social media plugins or feeds. Clicking a link takes you to the provider, whose privacy notice then applies. The provider may process your IP address, device and usage data and the referral from our website. We do not control that processing.

14. Additional information for ARVONAR for business

14.1. Requesting access

When you request access for your company, we process your name, email address and company to personally review and answer the request (Article 6(1)(b) or (f) GDPR). Authorised ARVONAR staff can see the request in administration and receive an internal email through our existing email service. Submitting a request creates no account, invitation or newsletter subscription. Requests and related delivery metadata are deleted after 24 months without business handling. Merely opening a request or attempting email delivery does not extend this period. Invitations, subsequent accounts and legally retained contractual records follow their own retention rules.

14.2. Account, invitations and deletion

For ARVONAR for business we process company name, contact person, business email address, language, billing details including a VAT ID where required and its validation evidence, invitation and verification status, necessary session data and evidence of accepted membership terms. These data support the free membership and purchases (Article 6(1)(b) GDPR). For company contacts and security measures, processing is based on our legitimate interest in secure business communication and account management (Article 6(1)(f) GDPR). Invitation details are provided by the inviting ARVONAR administrator, for example from an existing business contact; additional details come from you. Access cannot be established without the required contact and verification details.

Invitations are restricted to the named recipient. When changing an email address, you verify the new address; during activation, the code sent to the invited address is additionally required first. Previous email addresses and change timestamps are retained in a protected account history for traceable account management and abuse prevention (Article 6(1)(f) GDPR). Previous addresses are not additional sign-in credentials. A VAT ID is used for billing details; providing or validating it alone does not establish a tax exemption. Invitation and session secrets and sign-in codes are stored as hashes. Access uses a technically necessary session. Membership and newsletter enrolment are separate. Membership does not expire automatically.

Account data are stored on our existing Hetzner infrastructure; sign-in codes are delivered through the email infrastructure described in this notice. When you purchase, the relevant artist receives the company, contact and order data necessary for their sale. Stripe processes payments as described in section 5. Artists cannot access the complete business member directory.

The technically necessary Business session cookie `arvonar_business` lasts seven days. The temporary `arvonar_business_invite` cookie supports secure invitation setup, expires after 30 minutes and is removed on activation. These cookies are not used for advertising or analytics.

Expired verification data and sessions become eligible for deletion in the regular cleanup run after one day. Expired, revoked or redeemed invitations are cleaned up after 30 days. Previous email addresses remain in the protected account history for the duration of membership. Unnecessary contact details of closed accounts, including this email history and the VAT ID and its validation evidence, are removed after 30 days. Purchase prices and invoice data follow the order retention rules in sections 5 and 10; closing membership does not automatically erase these records. The privacy rights described in sections 11 and 12 also apply to business access.

14.3. VAT ID validation

We validate EU VAT IDs provided at activation and when billing details are saved through the European Commission’s VIES service. We transmit only the country code and VAT ID, not names, addresses, email addresses or payment data. We store the validated number, country, validation time and any returned request reference with billing details and, on purchase, in the billing snapshot. This supports fulfilment of Business access and accountable account administration (Article 6(1)(b) or (f) GDPR). VIES is a public-authority information service, not an ARVONAR processor. This is not personal identity verification. Account validation evidence is cleared with account contact data; order evidence follows order retention rules.

14.4. Basket and order requests

The Business basket stores selected artworks and reservation deadlines. Order requests additionally retain delivery details, immutable price/billing/legal-version evidence, artist responses, dispatch dates, payment and refund references, and reminder/document status. For review, each artist receives only their own items and necessary delivery details; billing information is available for their confirmed orders. Processing supports requests, contract performance and evidence obligations (Article 6(1)(b), (c) or (f) GDPR). Operational notifications use the existing email infrastructure, payments use Stripe and private documents use Hetzner. Basket selections are deleted after 90 days without changes; the shared one-hour reservation expires independently. Requests and accounting records follow their respective evidential and statutory retention purposes and are not deleted with the basket. Access and erasure reviews can be requested through the privacy contact in section 2.

14.5. Private projects and inquiries

Private Business projects store your selected artworks, project names, location, desired date, an optional private artwork budget, notes and room assignments. The private budget is excluded from shared links and is not automatically transmitted to artists with project inquiries. Projects do not reserve artworks. Project inquiries and their offer, contractual, payment and delivery history are linked as one case. The responsible artist receives only the information necessary for their inquiry or contract and their own artworks, not your internal project or item notes or other artists’ items. Procurement references such as PO number, cost centre and project name are retained in immutable order details. Private projects are cleaned up after 24 months without changes. Closed non-binding inquiries without remaining execution are cleaned up after 90 days, other non-binding inquiries after 24 months without activity and after 30 days for closed accounts. Accepted offers, payments, refunds, delivery, invoice evidence and disputes, including the related inquiry identity, are excluded from these short inquiry periods; further retention follows contractual and statutory evidence purposes and substantiated claims.

14.6. Project offers

For private Business project offers, we store the requested artworks, delivery and billing details, procurement references, versioned terms and approvals. Each participating artist receives only their own items and the project and delivery details necessary for their offer. Revision and extension requests, deadlines and delivery status are recorded to perform and document the process (Article 6(1)(b) or (f) GDPR). Ended or expired offers without an order are cleaned up after 90 days, or after 30 days for closed accounts, provided no active reservation remains. Accepted offer versions remain with the related order records as contractual evidence.

14.7. Sharing a selection by link

Business members may share explicitly selected project artworks with their clients through a time-limited, revocable read-only link. Prices, item notes and room assignments are included only when separately selected; internal project notes, account and billing details are excluded. The disclosed note version is stored. Anyone receiving the link may view the selection while it is valid, but gains no account, ordering or reservation access. We store only a verification hash of the secret link token and limit requests to prevent abuse; expiry or revocation blocks further access. Share data is cleaned up no later than 30 days after expiry or revocation and is removed when the project is deleted. Content already copied by recipients cannot be recalled. Processing is based on providing the requested sharing function and preventing abuse (Article 6(1)(b) or (f) GDPR).

14.8. Additional invoice email address

You may configure an additional company invoice email address for new orders. We confirm this address using a time-limited code; it receives no account access. Once confirmed, invoice copies and any related correction documents are sent to it as PDF attachments through the existing email infrastructure. This discloses the company, contact, order and billing information contained in each document to the mailbox you designate. The recipient assignment is recorded for the order. Changing or removing the address stops further copies to the previous address; emails already sent cannot be recalled. New addresses do not automatically receive documents from earlier orders. We retain confirmation and revocation times and delivery status for secure delivery and accountability (Article 6(1)(b) or (f) GDPR). Revoked addresses not linked to orders or documents are deleted after 90 days, or after 30 days for closed accounts. Order-related recipient and delivery evidence follows the retention of the associated documents.

14.9. Invoice credit and payment evidence

Separate manual platform approval of a company for new invoice-credit purchases is recorded with its status, version, timestamp and acting ARVONAR administrator account. This supports accountable authorisation checks and secure contractual handling (Article 6(1)(b) or (f) GDPR), not automated credit scoring. The approval valid at an artist's commitment is retained as order-related evidence. The current account status and timestamp are included in the company's data export; internal administrator identities are excluded. Current approval data is removed when a closed account is cleaned up, while required contractual evidence and audit records follow their separate retention rules.

For Business bank transfers and invoice credit, we store the agreed terms, invoice availability and deadline, the company-specific limit set by the artist, their explicit approval, payment allocations, partial amounts, refunds, receivable corrections, extensions and write-offs. The artist sets the limit; there is no automated credit scoring or credit-agency inquiry. Only the relevant seller and authorised ARVONAR staff can access the receivable. Stripe receives the company name, payment email address, currency and payment references within the connected seller account. Stripe may directly email the customer to collect missing refund bank details. We retain provider references and payment information necessary for allocation; funds are not offset between artists. Processing serves contractual performance and evidence, accounting and secure payment handling (Article 6(1)(b), (c) or (f) GDPR). Order-related credit and payment evidence follows the retention purposes of the related contractual and accounting records and is not automatically deleted at account closure. Unaccepted, expired offers and released credit commitments follow the offer cleanup in section 14.6. Account export includes the company's payment terms and receivable movements; further access may be requested through the privacy contact.

14.10. Optional newsletter

An explicit voluntary selection together with successful verification of Business access or a valid own-account Business session records consent for the verified contact address (Article 6(1)(a) GDPR). No additional confirmation email is required. Membership remains unchanged without consent.

Records include account ID, verified contact address, consent source and time, displayed statement with its version and checksum, linked privacy notice version, and withdrawal or invalidation details. Server-side access evidence includes the method, a non-secret reference and time: consumption of the valid login code on activation, or creation of the currently valid session in the account. No login code, session token or their hashes are stored in this consent evidence. Records are included in the Business data export.

Consent can be withdrawn at any time using the unsubscribe link in every newsletter email or in the Business account. A verified address change or account closure ends consent; the new address is not automatically enrolled. Active consent does not expire after 30 days. Ended consents not used for sending are cleaned up after 30 days. After actual or possibly completed sending attempts, consent, frozen newsletter content and minimal attempt time and controlled outcome are retained for three years after the later of termination or the last attempt. Operational sending and feedback metadata is cleaned up after 90 days. Permanent delivery failures or complaints create a technical block across both marketing channels, retaining a keyed address digest, reason and time while associated consent is active and for three years thereafter. Article 6(1)(f) GDPR supports evidence and safe delivery. These are operational policies, not statutory periods. Earlier unconfirmed requests are never automatically converted into consent. Necessary account and order messages and independent ordinary newsletter consent remain unaffected by Business withdrawal. No additional double opt-in, new delivery provider, opening or click tracking is introduced.