Shop artworks

Privacy Policy

Last updated: October 1, 2026

This Privacy Policy explains how personal data is collected, used and protected when you visit or use hexedbyart.com, contact me, purchase an artwork, request a custom artwork, or otherwise interact with this website.

The website is operated by Martyna Nowak, an independent artist currently based and working in Spain.

I currently operate as an independent individual and do not operate through a registered company. Any future business structure may be established separately.

For the purposes of Regulation (EU) 2016/679 (“GDPR”), Martyna Nowak is the data controller responsible for the processing of personal data collected through this website.

1. What personal data may be collected?

Depending on how you use the website, the following personal data may be collected:

  • name and surname;
  • email address;
  • telephone number, if provided;
  • shipping and delivery address;
  • information necessary to process an order or payment;
  • information provided when contacting me or submitting an enquiry;
  • messages and other information submitted through contact forms;
  • information necessary to process orders, returns, complaints or customer requests;
  • IP address and technical information relating to your device or browser;
  • information collected through cookies and similar technologies, where applicable.

I only collect personal data that is reasonably necessary for the relevant purpose.

2. How is your personal data used?

Your personal data may be used to:

  • process and fulfil orders for artworks;
  • arrange delivery and shipping;
  • communicate with you regarding your order or enquiry;
  • respond to messages sent through the website;
  • handle returns, complaints and customer requests;
  • comply with applicable legal, accounting and tax obligations;
  • maintain the security and proper functioning of the website;
  • analyse website usage where applicable and where the required consent has been obtained;
  • send marketing communications where the required consent has been obtained.

3. Legal basis for processing

Depending on the circumstances, personal data may be processed on the following legal bases under Article 6 of the GDPR:

  • performance of a contract or steps taken at your request before entering into a contract — for example, when processing an artwork order;
  • compliance with a legal obligation — where processing is required by applicable law;
  • legitimate interests — for example, maintaining website security, preventing misuse and responding to enquiries;
  • consent — where consent is required, including for certain marketing activities or non-essential cookies.

4. How long is personal data stored?

.

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required by law.

Information relating to purchases, payments, accounting and tax matters may be retained for the period required by applicable legal obligations.

Information submitted through contact forms may be retained for as long as reasonably necessary to respond to the enquiry and maintain appropriate records.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Who may receive your personal data?

Where necessary, personal data may be shared with trusted third-party service providers involved in operating the website and fulfilling orders, such as:

  • website hosting and technical service providers;
  • payment service providers;
  • shipping and delivery providers;
  • accounting or professional service providers;
  • analytics or cookie providers, where applicable;
  • public authorities where disclosure is required by law.

Personal data is not sold to third parties.

Where a service provider processes personal data on my behalf, appropriate contractual and data protection arrangements will be used where required by law.

6. Your rights

Under the GDPR, you may have the right to:

  • access your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of your personal data, where legally applicable;
  • request restriction of processing;
  • receive your personal data in a portable format, where applicable;
  • object to certain processing;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with the competent data protection supervisory authority.

These rights may be subject to the conditions and limitations provided by applicable law. 

7. Cookies

This website may use cookies and similar technologies that are necessary for the operation and security of the website.

Depending on the services and tools used on the website, additional cookies may be used for analytics, functionality or marketing purposes.

Where required by applicable law, non-essential cookies will only be used after obtaining the appropriate consent.

You may be able to manage your cookie preferences through the cookie settings available on the website.

8. Data security

I take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.

9. Contact

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

Martyna Nowak
Email: martyna@hexedbyart.com

10. Changes to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to the website, the services used or applicable legal requirements.

The most recent version will always be published on this page.