1. Data Controller Information

• Website Owner: Yuliya Spiridonova Pokhylko (Artistic name: Julia Spiri)

• NIF / Tax ID: 38885253G

• Address: C/ Avet 20, 08490 Tordera (Barcelona), Spain (Private studio — Not open to the public. Visits by appointment or correspondence only)

• Contact Email: contact@juliaspiri.com

• Website URL: https://juliaspiri.com

2. Personal Data We Collect and Purposes

We collect and process personal data for the following specific purposes:

• Order Processing & Shipping: We collect your name, billing and physical shipping address, email address, phone number, and payment information to process orders for physical goods or digital download files, issue invoices, handle refunds, and deliver packages.

• Customer Account Management: We collect a username, encrypted password, and email address to grant secure access to private account features, digital downloads, and purchase history.

• Customer Support & Contact Forms: Information submitted via contact forms or direct emails is strictly used to answer inquiries and provide support. It is not used for marketing without explicit consent.

• Marketing & Newsletter Subscriptions: With your explicit consent, we send periodic news, updates, and announcements about new art releases or products. You can unsubscribe at any time via the link in any marketing email.

• Online Courses (Thinkific): To process course enrollments and manage access to online learning content.

3. Legal Basis for Processing (GDPR)

Under the European Union General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Performance of a Contract: Required to fulfill purchases, deliver digital downloads, ship orders, or provide course access.

• Consent: Required to send marketing emails/newsletters and to place non-essential analytics or advertising cookies.

• Compliance with Legal Obligations: To retain tax, billing, and commercial accounting records required by applicable Spanish and European laws.

• Legitimate Interests: To maintain website security, prevent fraudulent transactions, and optimize store usability.

4. Data Retention

• Order & Transaction Data: Retained for a minimum of 5 years to fulfill legal, tax, and accounting record-keeping requirements.

• User Account Data: Retained until you request the deletion of your account.

• Newsletter Subscriptions: Retained until you withdraw your consent or click the unsubscribe link.

• Comments & Reviews: Retained indefinitely to maintain the continuity of public discussions or review entries.

5. Data Sharing, E-Commerce Platform, and International Transfers

We do not sell or rent your personal information to third parties. We share your personal data only with trusted third-party service providers essential to operating our business and completing transactions:

• E-Commerce Platform (Shopify): Our online store is hosted by Shopify Inc. They provide us with the online e-commerce platform that allows us to sell our physical and digital products to you. Your data, including order details, payment details, and contact information, is stored through Shopify’s data storage, databases, and general Shopify application on secure servers protected by firewalls.

• Automated Decision-Making & Fraud Risk Prevention: When you place an order, Shopify uses automated algorithms to analyze transaction risks and flag potential risk or fraud (such as verifying IP address consistency and payment card details).

• Payment Processors: Shopify Payments, PayPal, Stripe, or other integrated payment gateways. Your payment credentials are processed securely according to PCI-DSS compliance standards.

• Online Courses: Thinkific.com for processing course access and materials.

• Shipping & Fulfillment: Postal and courier delivery services for shipping physical merchandise.

• Analytics & Affiliate Programs: Google Analytics, Meta (Facebook), and Amazon Associates.

International Data Transfers

Shopify processes data globally. Personal data of European Economic Area (EEA) residents is initially collected and processed through Shopify’s European entity (Shopify International Limited in Ireland) and may subsequently be transferred to Shopify Inc. in Canada and the United States.

Transfers to Canada are backed by the European Commission's adequacy decision for Canadian commercial organizations. Transfers to the United States comply with the EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) to ensure your data remains protected under European privacy standards.

6. Your Rights Under GDPR

As an EU resident or data subject, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.

• Right to Rectification: Request the correction of inaccurate or incomplete personal data.

• Right to Erasure ("Right to be Forgotten"): Request the deletion of your data when it is no longer needed for legal or operational requirements.

• Right to Restrict or Object to Processing: Request limits on how we process your data or object to specific processing activities.

• Right to Data Portability: Request a structured, commonly used copy of your data for transfer to another service.

• Right to Withdraw Consent: Withdraw your consent at any time for marketing or cookies without affecting past processing activities.

To exercise any of these rights, please email us at contact@juliaspiri.com. If you believe your data has been handled improperly under GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

7. Cookies Policy

Cookies are small text files stored on your computer or device when visiting a website to ensure proper operation and improve user experience.

Shopify Essential Cookies:

Shopify automatically sets necessary cookies on your device to ensure core functions of the store work correctly. These include cookies that:

• Keep track of items added to your shopping cart (_shopify_s, _shopify_y).

• Maintain user session security and authentication during checkout.

• Remember your account login state and preferences.

Non-Essential Cookies:

• Analytics Cookies: Allow us to collect aggregated, anonymized usage statistics to measure traffic and performance (e.g., Google Analytics).

• Advertising & Affiliate Cookies: Used to track referral sales (such as Amazon Associates) or display relevant marketing.

Cookie Management:

Non-essential analytics and advertising cookies are activated only upon your consent via our website banner. You can manage, block, or clear cookies at any time through your browser settings or preferences panel.

8. Children’s Privacy

Our website and products are not directed to individuals under 14 years of age. We do not knowingly collect personal data from children under 14. If we learn that a child under 14 has provided us with personal information without parental consent, we will promptly delete it.