Privacy policy

1. Data Controller Information

• Website Owner: Yuliya Spiridonova Pokhylko (Artistic name: Julia Spiri)

• NIF / Tax ID: 38885253G

• Address: C/ Avet 20, 08490 Tordera (Barcelona), Spain (Private studio — Not open to the public. Visits by appointment or correspondence only)

• Contact Email: contact@juliaspiri.com

• Website URL: https://juliaspiri.com

For the purposes of the GDPR, we are the data controller of your personal data.

2. Personal Data We Collect and Purposes

We collect and process personal data for the following specific purposes:

• Order Processing & Shipping: We collect your name, billing and physical shipping address, email address, phone number, and payment information to process orders for physical goods or digital download files, issue invoices, handle refunds, and deliver packages.

• Customer Account Management: We collect a username, encrypted password, and email address to grant secure access to private account features, digital downloads, and purchase history.

• Customer Support & Contact Forms: Information submitted via contact forms or direct emails is strictly used to answer inquiries and provide support. It is not used for marketing without explicit consent.

• Marketing & Newsletter Subscriptions: With your explicit consent, we send periodic news, updates, and announcements about new art releases or products. You can unsubscribe at any time via the link in any marketing email.

• Abandoned Cart Reminders: If you begin a purchase and do not complete it, we may send you a reminder email, where permitted by law and subject to your consent.

• Product Reviews: If you submit a review, we collect your name and email address. Please note that the name you provide is published publicly alongside your review.

• Online Courses (Thinkific): To process course enrollments and manage access to online learning content.

3. Legal Basis for Processing (GDPR)

Under the European Union General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• Performance of a Contract: Required to fulfill purchases, deliver digital downloads, ship orders, or provide course access.

• Consent: Required to send marketing emails and newsletters, to publish your product review, and to place non-essential analytics or affiliate cookies.

• Compliance with Legal Obligations: To retain tax, billing, and commercial accounting records required by applicable Spanish and European laws.

• Legitimate Interests: To maintain website security, prevent fraudulent transactions, and optimize store usability. Where we rely on legitimate interests, you have the right to object at any time.

4. Data Retention

• Order & Transaction Data: Retained for a minimum of 5 years to fulfill legal, tax, and accounting record-keeping requirements.

• User Account Data: Retained until you request the deletion of your account.

• Newsletter Subscriptions: Retained until you withdraw your consent or click the unsubscribe link.

• Contact Form & Support Messages: Retained for up to 2 years after your enquiry has been resolved.

• Reviews: Retained for as long as the review remains published, and removed upon request.

• Cookie Consent Records: Retained as proof of consent for as long as required by applicable law.

5. Data Sharing, E-Commerce Platform, and International Transfers

We do not sell or rent your personal information to third parties. We share your personal data only with trusted third-party service providers essential to operating our business and completing transactions:

• E-Commerce Platform (Shopify): Our online store is hosted by Shopify Inc. They provide us with the online e-commerce platform that allows us to sell our physical and digital products to you. Your data, including order details, payment details, and contact information, is stored through Shopify's data storage, databases, and general Shopify application on secure servers protected by firewalls. Shopify also processes certain data as an independent controller; see the Shopify Privacy Policy.

• Automated Decision-Making & Fraud Risk Prevention: When you place an order, Shopify uses automated algorithms to analyze transaction risks and flag potential risk or fraud (such as verifying IP address consistency and payment card details). These checks do not produce legal effects concerning you; any flagged order is reviewed manually before we take a decision.

• Payment Processors: Shopify Payments, PayPal, Stripe, or other integrated payment gateways. Your payment credentials are processed securely according to PCI-DSS compliance standards. We never see or store your full card number.

• Product Reviews (Judge.me): Used to collect, store, and publish customer reviews, including the reviewer name displayed publicly.

• Website Translation (Google Translate): Our website loads Google's translation service to offer the store in several languages. When it loads, your IP address and the content of the page you are viewing are transmitted to Google. See Google's Privacy Policy.

• Cookie Consent Management: Used to record and store your cookie preferences as proof of consent.

• Online Courses: Thinkific.com for processing course access and materials.

• Shipping & Fulfillment: Postal and courier delivery services for shipping physical merchandise.

• Affiliate Programs: Amazon Associates, used to track referral sales of our books on Amazon.

International Data Transfers

Shopify processes data globally. Personal data of European Economic Area (EEA) residents is initially collected and processed through Shopify's European entity (Shopify International Limited in Ireland) and may subsequently be transferred to Shopify Inc. in Canada and the United States. Course enrollment data is processed by Thinkific Labs Inc., located in Canada.

Transfers to Canada are backed by the European Commission's adequacy decision for Canadian commercial organizations. Transfers to the United States comply with the EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) to ensure your data remains protected under European privacy standards.

6. Your Rights Under GDPR

As an EU resident or data subject, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.

• Right to Rectification: Request the correction of inaccurate or incomplete personal data.

• Right to Erasure ("Right to be Forgotten"): Request the deletion of your data when it is no longer needed for legal or operational requirements.

• Right to Restrict or Object to Processing: Request limits on how we process your data or object to specific processing activities, including processing based on our legitimate interests.

• Right to Data Portability: Request a structured, commonly used copy of your data for transfer to another service.

• Right to Withdraw Consent: Withdraw your consent at any time for marketing or cookies without affecting past processing activities.

To exercise any of these rights, please email us at contact@juliaspiri.com. We will respond within one month, as required by the GDPR. If you believe your data has been handled improperly under GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

7. Cookies Policy

Cookies are small text files stored on your computer or device when visiting a website to ensure proper operation and improve user experience. The periods indicated below are the maximum lifetime set by each provider; you can delete any cookie earlier from your browser at any time.

Strictly Necessary Cookies

These are set without consent, because the store cannot function without them:

• cart, cart_currency, cart_ts — keep track of the items you add to your shopping cart. Duration: 2 weeks.

• _secure_session_id — maintains session security during checkout. Duration: 24 hours.

• secure_customer_sig — keeps you securely signed in to your customer account. Duration: up to 20 years.

• localization — remembers your country and language preference. Duration: 2 weeks.

• _tracking_consent, _cmp_a — store the cookie choices you have made, as proof of consent. Duration: 1 year and 1 day respectively.

Analytics Cookies (consent required)

• _shopify_y — Shopify store analytics; identifies a unique visitor. Duration: 1 year.

• _shopify_s — Shopify store analytics; identifies a single browsing session. Duration: 30 minutes.

Third-Party Cookies and Services

• Judge.me (product reviews). Judge.me sets technical cookies and browser storage entries so that reviews can be displayed, to prevent duplicate submissions, and to remember whether you have already reviewed a product. These are placed by Judge.me as a third party and their retention is governed by the Judge.me Privacy Policy.

• Google Translate (website translation). Our website loads Google's translation service, which sets a googtrans cookie to remember the language you selected. Duration: browser session. Loading this service transmits your IP address and the content of the page to Google, which may set further cookies under its own domains. See Google's Privacy Policy.

• Amazon Associates (affiliate tracking, consent required). Referral tracking used to attribute sales of our books on Amazon.

Cookie Management

Non-essential cookies are activated only upon your consent given through our website banner. You can change or withdraw your choices at any time using the "Cookie settings" link in the footer of every page, which reopens the preferences panel. You can also block, change, or delete cookies through your browser settings or preferences panel.

8. Children's Privacy

Our website and products are not directed to individuals under 14 years of age, which is the age of digital consent in Spain. We do not knowingly collect personal data from children under 14. If we learn that a child under 14 has provided us with personal information without parental consent, we will promptly delete it.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our service providers, or our legal obligations. The revised version will be published on this page with an updated "Last updated" date. We encourage you to review it periodically.