LEGAL

Privacy Policy

Effective Date: May 15, 2026

This Privacy Policy describes how Clair Fareio, an independent artist trading as Clair Fareio Art with studio in Sulmona, Italy (the “Artist,” “we,” “our,” or “us”), collects, processes, stores, transfers, and protects personal data relating to visitors to this website, prospective and actual purchasers of original artwork, commission clients, contact-form enquirers, newsletter subscribers, and other individuals whose personal data the Artist may receive (the “Data Subject,” “you,” or “your”). This Policy is issued in accordance with Regulation (EU) 2016/679 (the “GDPR”), Italian Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018 (the “Italian Privacy Code”), the guidelines and decisions of the Italian Data Protection Authority (Garante per la protezione dei dati personali, the “Garante”), and applicable consumer-protection law including the Codice del Consumo. This Policy should be read together with the Terms and Conditions of Sale, which it supplements.

1. Data Controller

The data controller responsible for processing your personal data is Clair Fareio, trading as Clair Fareio Art, an independent artist based in Sulmona (AQ), Italy [partita IVA. The Artist is a sole practitioner and is not required under Article 37 GDPR to appoint a Data Protection Officer. The Artist personally handles all data-protection enquiries and acts as the point of contact for Data Subjects. Contact details are set out in Section 14.

2. Categories of Personal Data Collected

Depending on your interaction with the Artist, the categories of personal data processed include: identity data such as your first and last name, title, and (for business clients) company name and tax identification number; contact data such as billing and shipping address, email address, and telephone number; transaction data such as records of artwork ordered or commissioned, prices, payment method, and payment status (the Artist does not store full payment-card numbers; card data is processed directly by the Artist’s payment processors); commission data such as design briefs, reference materials, photographs, written preferences, and correspondence relating to a commissioned Work; contact-form data such as the name, email address, and free-text message you submit through any enquiry, contact, or commission form on this website; technical data such as IP address, browser type and version, time-zone setting, device type, operating system, and referring URL; usage data such as pages visited, time spent on pages, and click-through behavior on this website; marketing data such as your preferences in receiving communications from the Artist and your consent or refusal regarding such communications; and fraud-prevention data such as payment-anomaly indicators, identity-verification information voluntarily supplied, prior chargeback history with the Artist, and any indicia of suspicious activity described in Section 10 of the Terms and Conditions of Sale.

The Artist does not knowingly collect special categories of personal data within the meaning of Article 9 GDPR (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation, or biometric data). Please do not transmit any such data to the Artist. Where you voluntarily supply such data in the context of a commission (for example, by sending a reference photograph), it will be processed solely for the purpose for which you supplied it and deleted upon completion of the commission unless a longer retention is required by law. Where a reference photograph or other commission material contains the image of a minor or of any third party, you confirm that you hold the necessary authorisations under Italian law, including Article 10 of the Italian Civil Code and Articles 96–97 of Law No. 633/1941, to permit the Artist to process that image for the commission.

3. Sources of Personal Data

Personal data is collected directly from you when you visit this website, submit a contact or commission enquiry, place an order, complete checkout, subscribe to the newsletter, communicate with the Artist by email or messaging service, or otherwise interact with the Artist. Limited technical data is generated automatically when you browse this website, as described in Section 9. Where you supply personal data of a third party (for example, the recipient of a gifted Work, or a person depicted in a reference photograph), you confirm that you have the lawful authority to do so and that the third party has been informed of this Policy.

4. Purposes of Processing and Legal Bases

Each category of processing is carried out for a specific purpose and on a specific legal basis under Article 6 GDPR, as follows.

To respond to contact-form enquiries, prepare quotations, negotiate and conclude contracts, fulfil orders, manage commissions, process payments, arrange shipment, issue invoices, and provide customer service: performance of a contract or pre-contractual measures taken at your request, Article 6(1)(b) GDPR.

To comply with fiscal, accounting, customs, and anti-money-laundering obligations under Italian and EU law, including retention of invoices and supporting documents under Article 22 of Presidential Decree No. 600/1973, Article 39 of Presidential Decree No. 633/1972, and Article 2220 of the Italian Civil Code: compliance with a legal obligation, Article 6(1)(c) GDPR.

To prevent, detect, and investigate fraud, payment-instrument abuse, chargeback abuse, identity misrepresentation, sanctions evasion, and unauthorised use of the Artist’s intellectual property; to verify the identity, address, beneficial ownership, and source of funds of prospective purchasers where the Artist has a reasonable concern; and to defend or establish legal claims: the legitimate interest of the Artist in protecting the studio’s business, financial integrity, and intellectual property, Article 6(1)(f) GDPR. The Artist has carried out a balancing test and considers that these interests are not overridden by the rights and freedoms of Data Subjects, given the safeguards described in this Policy and the limited scope of processing. Where a Data Subject objects to such processing under Article 21 GDPR, the Artist may continue processing where compelling legitimate grounds exist that override the Data Subject’s interests, rights, and freedoms, or where the processing is required to establish, exercise, or defend legal claims.

To operate, maintain, secure, and improve this website, including aggregate analytics and anti-abuse monitoring: the legitimate interest of the Artist in ensuring a functional and secure online presence, Article 6(1)(f) GDPR.

To send marketing communications, newsletters, exhibition announcements, or commercial offers, and to install non-essential cookies (including analytical cookies that are not anonymised at source and profiling cookies): your prior, specific, informed, and freely given consent, Article 6(1)(a) GDPR, which you may withdraw at any time without affecting the lawfulness of processing carried out before withdrawal. For email marketing to existing customers about original artwork and commissions similar to those previously purchased, the Artist may rely on the “soft opt-in” regime under Article 130(4) of the Italian Privacy Code, in which case you will be informed at the point of purchase and offered a clear and free means to opt out at every communication.

Failure to provide data necessary to perform a contract (such as your name, shipping address, and payment details) will mean the Artist cannot fulfil an order or commission. Failure to provide data necessary to comply with a legal obligation (such as fiscal data for invoicing) will mean the Artist cannot lawfully complete the transaction. All other provision of data is optional.

5. Recipients and Categories of Recipients

Personal data may be disclosed, on a need-to-know basis and under contractual or statutory confidentiality obligations, to the following categories of recipients: payment processors such as PayPal and the Artist’s credit-card processor for the purpose of processing transactions; banking institutions for the purpose of receiving and reconciling payments; shipping carriers such as Poste Italiane, DHL, FedEx, and UPS for the purpose of delivering Works; customs brokers and customs authorities for the purpose of cross-border shipment; the website-hosting and e-commerce platform on which this website operates (Automattic Inc., operating WordPress.com, based in the United States), together with email-delivery, cloud-storage, and form-handling providers, all under data-processing agreements meeting the requirements of Article 28 GDPR; web-analytics providers such as Google Analytics, only where you have consented to non-essential analytics cookies; social-media platforms such as Meta (Facebook and Instagram), only to the extent you interact with the Artist’s social-media presence or where embedded social-media content loads on this website with your consent; the Artist’s accountants, tax advisors, and legal counsel under professional confidentiality obligations; competent Italian authorities including the Guardia di Finanza, the Polizia Postale, the Unità di Informazione Finanziaria, the Agenzia delle Entrate, and the Garante, where required by law or where the Artist reports suspected fraud, attempted fraud, sanctions evasion, or other unlawful conduct; and courts, judicial officers, and counterparties to litigation, to the extent strictly necessary to establish, exercise, or defend legal claims. The Artist does not sell, rent, lease, or otherwise commercially disclose personal data to third parties for their own marketing or commercial purposes.

6. Transfers Outside the European Economic Area

Some of the recipients listed in Section 5, particularly payment processors, the website-hosting platform, cloud-service providers, and social-media platforms, may process personal data in jurisdictions outside the European Economic Area, including the United States. Where such transfers occur, the Artist relies on one or more of the safeguards permitted by Chapter V of the GDPR, namely: an adequacy decision of the European Commission under Article 45 GDPR (including the EU–U.S. Data Privacy Framework adopted by Commission Decision of 10 July 2023 in respect of certified recipients in the United States); the Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR; or, in the case of occasional and necessary transfers, the derogations of Article 49 GDPR. You may obtain a copy of the safeguards applied to any specific transfer by writing to the contact address in Section 14.

7. Retention Periods

Personal data is retained only for as long as necessary for the purposes for which it was collected, subject to applicable statutory retention periods, as follows. Transaction, invoicing, and tax records: ten (10) years from the end of the fiscal year of the transaction, in accordance with Article 2220 of the Italian Civil Code, Article 22 of Presidential Decree No. 600/1973 (income tax), and Article 39 of Presidential Decree No. 633/1972 (VAT). Commission correspondence and design materials: the duration of the commission plus five (5) years thereafter, to permit handling of post-delivery enquiries, warranty claims, and authenticity disputes. Contact-form and customer-service correspondence not associated with a transaction: two (2) years from the last contact. Marketing-consent records and the underlying contact data: until withdrawal of consent or two (2) years of inactivity, whichever is earlier, after which the data is deleted or pseudonymised. Fraud-prevention records relating to refused orders, suspicious activity, or wrongful chargebacks: five (5) years from the date of the relevant event, to permit defence of legal claims and prevention of repeat attempts. Website analytics in aggregated or pseudonymised form: up to twenty-six (26) months. Cookies: as described in Section 9. Upon expiry of the applicable retention period, personal data is securely deleted or anonymised.

8. Your Rights as a Data Subject

Subject to the conditions and limitations established by Articles 15 to 22 GDPR, you have the right to: obtain confirmation of whether personal data concerning you is being processed, and, if so, access to that data and the information specified in Article 15 GDPR; obtain rectification of inaccurate or incomplete data under Article 16 GDPR; obtain erasure of your data (the “right to be forgotten”) under Article 17 GDPR, where the grounds set out in that article apply; obtain restriction of processing under Article 18 GDPR; object to processing carried out on the basis of legitimate interest under Article 21 GDPR, including objection to direct marketing at any time; receive your data in a structured, commonly used, and machine-readable format and have it transmitted to another controller (data portability) under Article 20 GDPR; withdraw consent at any time under Article 7(3) GDPR, without affecting the lawfulness of processing carried out before withdrawal; and lodge a complaint with the Garante (Piazza Venezia 11, 00187 Rome, Italy; garante@garanteprivacy.it; garanteprivacy.it) or with the supervisory authority of your place of habitual residence within the European Union.

Where you object under Article 21 GDPR to processing carried out for fraud-prevention or the establishment, exercise, or defence of legal claims, the Artist may continue such processing where compelling legitimate grounds for the processing exist that override your interests, rights, and freedoms, or where the processing is necessary for those legal purposes.

To exercise any of these rights, please contact the Artist at the address listed in Section 14. The Artist will respond without undue delay and in any event within one (1) month of receipt of the request, extendable by a further two (2) months where necessary, taking into account the complexity and number of requests, in accordance with Article 12(3) GDPR. The Artist may request additional information reasonably necessary to verify your identity before fulfilling a request. The exercise of these rights is, in principle, free of charge; however, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Artist may charge a reasonable fee or refuse the request, in accordance with Article 12(5) GDPR.

9. Cookies and Similar Technologies

This website uses cookies and similar technologies. In accordance with the Garante’s Guidelines on cookies and other tracking tools of 10 June 2021 and the ePrivacy Directive (2002/58/EC) as transposed into Italian law, the Artist distinguishes between technical cookies and non-technical cookies. Technical cookies, which are strictly necessary for the operation of the website and the provision of services explicitly requested by you (such as session identifiers and security cookies), are installed without the need for consent. Non-technical cookies, including analytical cookies that are not anonymised at source, profiling cookies, and any cookies served by third parties for tracking, retargeting, or advertising purposes, are installed only after you have provided specific, informed, and freely given consent through the cookie banner displayed on first visit and at any time accessible through the cookie-preferences control on this website. The cookie banner offers equivalent prominence to acceptance and refusal options. Continued browsing of the website without an explicit choice does not constitute consent.

You may withdraw your consent or modify your cookie preferences at any time through the cookie-preferences control, with effect for the future. Refusing non-technical cookies will not prevent you from browsing this website or completing purchases. A complete list of the cookies used on this website, together with their purposes, duration, and the identity of any third-party providers, is published in the dedicated cookie panel accessible through the cookie banner.

10. Automated Decision-Making and Profiling

The Artist does not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing, including profiling, within the meaning of Article 22 GDPR. Fraud-screening signals generated by payment processors or platform tools are reviewed by the Artist before any decision to refuse, suspend, or cancel an order is taken.

11. Data Security and Breach Notification

The Artist implements appropriate technical and organisational measures within the meaning of Article 32 GDPR to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access. Measures include encrypted transmission (SSL/TLS) for all data exchanged through this website, access controls, segregated storage, regular software updates, multi-factor authentication where supported, and contractual data-protection obligations imposed on processors. No method of electronic transmission or storage is, however, completely secure, and the Artist cannot guarantee absolute security.

In the event of a personal-data breach likely to result in a risk to the rights and freedoms of natural persons, the Artist will notify the Garante through the Authority’s official channel without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, the Artist will communicate the breach to you without undue delay, providing the information required by Article 34 GDPR, including the nature of the breach, likely consequences, measures taken, and contact point for further information.

12. Minors

This website and the services offered by the Artist are not directed to children. In accordance with Article 2-quinquies of the Italian Privacy Code, the age of digital consent in Italy is fourteen (14) years. Minors below this age may not provide personal data to the Artist without the consent of the holder of parental responsibility. The Artist does not knowingly collect personal data from minors below fourteen (14) years of age; where the Artist becomes aware that such data has been collected, the data will be promptly deleted. Sales of original artwork and acceptance of commissions are reserved to persons of full legal capacity under the Terms and Conditions of Sale. Where a commission involves the image of a minor (for example, a portrait or a reference photograph), the parent or legal guardian must furnish written authorisation in accordance with Italian law before processing begins.

13. Notice to Residents of the United States and Other Non-EU Jurisdictions

If you are a resident of a United States jurisdiction with a comprehensive consumer-privacy statute, you may have additional rights under that statute. Those rights typically include the right to know what personal information is collected, used, shared, or sold; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information and of cross-context behavioural advertising; the right to limit the use and disclosure of sensitive personal information; and the right to non-discrimination for exercising these rights. The Artist does not sell personal information for monetary consideration and does not engage in cross-context behavioural advertising. To exercise any rights available to you under the law of your jurisdiction, please contact the Artist at the address listed in Section 14, identifying the jurisdiction of your residence; the Artist will respond in accordance with the applicable statute.

Residents of other jurisdictions outside the European Union are protected by the Italian and EU framework described in this Policy and by any mandatory protections of their place of residence to the extent applicable.

14. Contact, Third-Party Links, Changes

For any enquiry regarding this Policy or the processing of your personal data, including to exercise the rights set out in Section 8, please contact the Artist by email at clairvegas [at] gmail [dot] com. The Artist monitors this email regularly and will respond within the timeframes set out in Section 8.

This website may contain links to third-party websites, including social-media platforms and payment providers. The privacy practices of those websites are governed by their own privacy policies, which the Artist does not control and for which the Artist accepts no responsibility. You are encouraged to review the privacy policies of any third-party website before providing personal data to it.

The Artist may update this Policy from time to time to reflect changes in law, regulation, the Garante’s guidance, or the Artist’s processing activities. The current version is identified by the Effective Date at the top of this page. Material changes will be notified by a prominent notice on the website and, for active customers and newsletter subscribers, by direct email communication. Where the change affects processing carried out on the basis of consent and a change to the scope of that consent is required, fresh consent will be sought before the change takes effect. Continued use of the website following publication of an updated Policy constitutes acknowledgement of the updated terms to the extent the processing is not consent-based.