Privacy Statement

1. Who is responsible

• Seller and website operator: Vincent Raab Streifer, sole trader, trading as SmartShift
• Tax ID (NIF): X8273200P · EU VAT ID: ESX8273200P
• Address: Carrer Verge de Montserrat 16, 17488 Cadaqués (Girona), Spain
• Email: vincent@smartshifts.co
• Phone: +34 641 93 74 02 (WhatsApp)

The website presents and sells the work of the painter Else Streifer-Schröck. Enquiries about her paintings are shared with her so that she can answer them personally.

2. Which data we collect and why

• Enquiry forms (catalogue, question about a work): first and last name, phone number, what you are interested in, an optional price range and your message. We use them to answer you and send you the available works. Legal basis: steps prior to a contract at your request, and our legitimate interest in answering you.
• Orders: name, billing and delivery address, email, phone, the items ordered and payment status. Payment details are processed directly by the payment provider; we never see your full card number. We use these data to fulfil the contract, deliver the goods, issue the invoice and provide after-sales service. Legal basis: performance of a contract and our legal obligations (tax and accounting law).
• Email and WhatsApp: what you write to us, to answer you. Legal basis: legitimate interest or steps prior to a contract.
• Newsletter and offers: only if you tick the corresponding box in the checkout. You can unsubscribe at any time via the link in each email. Legal basis: your consent.
• Technical data: when you visit the site, the hosting provider records the IP address, browser type, pages visited and time of access in server logs for security and stability. Legal basis: legitimate interest.

We do not ask for special categories of data and we do not take automated decisions that produce legal effects for you.

3. Who processes your data on our behalf

We do not sell your data. We share it only with service providers who process it on our instructions, and with authorities where the law requires it:

• Shopify International Ltd. (Ireland) and Shopify Inc. (Canada): hosting of the shop, checkout, order management and, through Shopify Payments, payment processing. Shopify is certified under the EU–US Data Privacy Framework for transfers to the United States.
• Klarna Bank AB (Sweden): if you choose to pay with Klarna, Klarna processes your data as an independent controller under its own privacy notice.
• Gelato ASA (Norway) and its production partners: if you order a print, we transmit your name, delivery address and the items ordered so that the print can be produced close to you and shipped.
• Carriers (for example DHL, UPS or a fine art shipper): name, address and phone number to deliver your order.
• n8n and Google Workspace (Google Ireland Ltd.): the details you enter in our enquiry forms are stored in a spreadsheet and sent to us by email through our automation tool so that we can follow up.
• Google Fonts: the fonts of this website are loaded from Google servers, which receive your IP address when the page loads.

4. International transfers

Some of these providers process data outside the European Economic Area, in particular in the United States and Canada. Transfers are covered by an adequacy decision of the European Commission or by the standard contractual clauses approved by the Commission.

5. How long we keep your data

• Enquiries: until the enquiry is closed and for up to 2 years afterwards, unless you ask us to delete them earlier.
• Orders and invoices: 6 years, as required by Spanish tax and commercial law.
• Newsletter consent: until you unsubscribe.
• Server logs: a few weeks.

6. Cookies

The shop uses cookies that are strictly necessary for it to work (shopping cart, checkout, security, your cookie choices). Analytics and marketing cookies are set only if you accept them in the cookie banner. You can change your choice at any time via the cookie settings link in the banner or by deleting cookies in your browser.

7. Social media

This site links to the artist's Instagram and TikTok profiles. If you follow those links, those platforms process your data under their own privacy policies, over which we have no control.

8. Children

This website is aimed at adults. We do not knowingly collect data from children under 16.

9. Your rights

You can at any time ask us for access to your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw any consent you gave. Write to vincent@smartshifts.co. We will answer within one month.

If you believe we are not handling your data lawfully, you can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es) or to the supervisory authority of the country where you live, for example the Bavarian Data Protection Authority (BayLDA) if you live in Bavaria.

10. Security

The site is served over an encrypted connection (TLS). Payments are handled by PCI-DSS certified providers. We restrict access to your data to the people who need it to serve you.

11. Changes

We may update this statement to reflect changes in the law or in how the shop works. The version in force is always the one published on this page.

12. Contact

For any question about this statement or your data: vincent@smartshifts.co or +34 641 93 74 02 (WhatsApp).