Effective Date: October 8, 2026
Last Updated: October 8, 2026
At Inner Light Fine Art, operated within the European Union, we are committed to respecting your privacy and protecting your personal data in full compliance with the EU General Data Protection Regulation (GDPR).
1. Data Controller
For the purposes of applicable data protection laws, the legal entity responsible for collecting and processing your personal data (the “Data Controller”) is:
- Business Name: InnerLightFineArt
- Website: https://innerlightfineart.art
- Contact Email: info@innerlightfineart.art
- Location: Athens, Greece, EU
2. Information We Collect and How We Use It
We collect and process personal data only when necessary to fulfill legal obligations, carry out contractual duties, or serve legitimate business interests.
A. E-Commerce & Order Processing
When you place an order or make an inquiry regarding fine art pieces, we collect:
- Contact & Shipping Details: Full name, email address, billing address, delivery address, and phone number.
- Purpose & Legal Basis: To process orders, deliver artwork, issue invoices, and fulfill our contractual agreement with you (Art. 6(1)(b) GDPR), as well as to comply with legal tax and accounting obligations (Art. 6(1)(c) GDPR).
B. Payment Processing
Payment transactions are processed securely via third-party payment service providers (e.g., Stripe, PayPal, or bank transfers).
- Data Transferred: Transaction IDs and payment confirmation details.
- Security: Inner Light Fine Art does not store or process your sensitive credit card or bank account details directly on our servers.
C. Comments & User Submissions
When visitors leave comments on the site, we collect the data shown in the comments form, along with the visitor’s IP address and browser user agent string to assist in spam detection.
- Gravatar Service: An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to verify usage. The Gravatar privacy policy is available at: https://automattic.com/privacy/. Upon comment approval, your profile picture is visible to the public in the context of your comment.
D. Media Uploads
If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the site can download and extract any location data from uploaded images.
3. Cookies and Analytics
Cookies are small text files stored on your device to enhance site function and analyze site performance.
- Comment Cookies: If you leave a comment, you may opt-in to saving your name, email address, and website in cookies for your convenience. These last for one year.
- Session & Login Cookies: If you visit our login page, a temporary cookie determines if your browser accepts cookies (contains no personal data; discarded when you close your browser). When logging in, cookies save login info (lasts 2 days) and screen display choices (lasts 1 year). Selecting “Remember Me” persists login for 2 weeks.
- Content Editing Cookies: If you edit or publish an article, a cookie containing no personal data indicates the post ID of the article. It expires after 1 day.
- Consent Management: Essential cookies are placed automatically. Non-essential cookies (such as analytics or marketing cookies) are set only after receiving your explicit consent via our cookie consent banner.
4. Embedded Content from Other Websites
Articles or pages on this site may include embedded content (e.g., high-resolution media, video streams, or interactive gallery maps). Embedded content from third-party websites behaves in the exact same manner as if you visited the external site directly.
These third-party websites may collect data about you, use cookies, embed additional tracking, and monitor your interaction with that embedded content—especially if you possess an active account and are logged in to those external websites.
5. Data Sharing and Third Parties
We do not sell, rent, or trade your personal data. We share data only with necessary third-party service providers (Data Processors) bound by confidentiality and GDPR compliance:
- Spam Detection & Security Services: Visitor comments and forms may be processed through automated spam detection services.
- Logistics & Delivery Partners: Name and shipping address are shared with premium art couriers and postal services to deliver artwork safely.
- IT Infrastructure: Trusted web hosting providers, storage systems, and transactional email services.
- Password Resets: If you request a password reset, your IP address will be included in the reset email for security reasons.
6. How Long We Retain Your Data
- Comments & Metadata: Retained indefinitely to automatically recognize and approve follow-up comments without keeping them in a moderation queue.
- User Accounts: For registered users, personal information provided in user profiles is stored indefinitely until deleted or updated by the user or account administrator.
- Financial & Order Records: Order and billing data are stored for the minimum period required by applicable national tax and commercial laws (typically 5 to 10 years).
7. Your GDPR Data Rights
Under EU data protection laws, you possess the following rights regarding your personal data:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data, provided it is not required for legal, administrative, or compliance purposes.
- Right to Restrict or Object to Processing: Limit or object to how we process your personal data under specific circumstances.
- Right to Data Portability: Request transfer of your data to you or a third party in a structured, machine-readable format.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
To exercise any of these rights, please contact us at info@innerlightfineart.art
You also have the right to lodge a complaint with a national Data Protection Authority (DPA) within the EU if you believe our data processing practices violate applicable law.
8. Updates to This Policy
We may update this Privacy Policy periodically to reflect updates in legal requirements or website functionalities. Any updates will be posted on this page with an updated “Effective Date.”