ENGLISH VERSION

Last updated: 22nd September 2025

1. Data Controller
This website is owned and operated by Camille Thirifay, located in Barcelona, Spain. You can contact me at:

• Email: thilli.art@gmail.com

• Address: /

I am responsible for the collection, use, and protection of your personal data (the “Data Controller”) under applicable law (including the EU General Data Protection Regulation (GDPR) and Spanish data protection regulations).

2. What Information I Collect

When you use the booking form on Book Your Project (and other similar forms) I may collect:

• Name

• Email address

• Phone number

• Any project-details you send (e.g. description of what you want, style, references etc.)

• Possibly location or address (if needed for the booking or for quotes)

• IP address, browser type, device info (collected automatically)

Also, if you sign up for a newsletter, I will collect your email (and name if you provide it) for that purpose.

3. Why I Collect It & Legal Basis

Purpose of collection:

• To respond to your booking/project requests.

• To communicate with you (confirmation, follow-ups, scheduling etc.).

• To send you newsletters or updates only if you have explicitly consented.

• To improve my services, understand how people use the website (analytics).

Legal basis:

• Consent: for newsletters or any marketing.

• Contractual / pre-contractual necessity: for booking / project requests.

• Legitimate interests: for analytics and improving the website, provided it does not override your privacy rights.

4. How I Collect It

• Via your submission of forms (booking/project forms, newsletter signup).

• Via my Instagram page @thilli.art

• Automatically via website analytics (Squarespace) when you visit the site (pages viewed, time, device, etc.).

• Through cookies and similar tracking technologies.

5. What I Do With the Information

• Store it securely on Squarespace servers / associated services.

• Use it to reply to your requests, schedule bookings, provide my service.

• Use it to send newsletters/updates if you opted in.

• Use analytics data to understand traffic, website performance, user behaviour, to improve my site/designs/service.

6. Sharing the Information

I do not sell your personal data.

I may share personal data with:

• Squarespace (as my hosting / website provider).

• Email service provider (if using one for newsletters).

• Other service providers only as necessary (e.g. payment processors, if ever needed, or scheduling tools).

• If required by law (e.g. by courts or legal authorities), I might have to disclose data.

7. Cookies & Similar Technologies

Squarespace uses cookies and similar technologies. Key points:

• Necessary / essential cookies: always used, allow the site to work securely and properly. Examples: cookies that manage sessions, logins, etc.

• Analytics / performance cookies: these collect info about how visitors use the site (traffic sources, page views, etc.). They help me understand site performance and improve. Examples from Squarespace include cookies such as ss_cid, ss_cpvisit, ss_cvisit, ss_cvr, ss_cvt.

• Use of a cookie banner: visitors can see a banner when they arrive, can accept or decline non-essential cookies.

8. How Long I Store Information

GDPR requires that personal data be kept only as long as necessary for the purposes for which it's collected, unless law requires keeping it longer. European Commission

Type of Data —>Retention Period

• Booking & project request info (name, contact, project details) —> Until the project is completed + 2 years after for follow-ups, tax/accounting, possible disputes.

• Newsletter subscriber data —> Until you unsubscribe; if inactive for 3 years, I may delete unless there is renewed interest.

• Analytics / web visit data (cookies / logs) —> Usually kept for up to 2 years (depending on the cookie, e.g. ss_cid is 2 years in Squarespace) (Squarespace Help)

• Data needed for legal / tax obligations —> For the period required by Spanish law, up to 5-6 years

After the retention period, data will either be securely deleted or anonymised so it cannot be linked back to you.

9. Your Rights

Under the GDPR (and Spanish law) you have the following rights:

• Right to access your personal data.

• Right to correct/rectify incorrect or incomplete data.

• Right to erasure (“right to be forgotten”) in certain cases.

• Right to restrict or object to processing.

• Right to data portability (in some cases).

• Right to withdraw consent (for marketing/newsletters) without affecting the lawfulness of processing before withdrawal.

If you wish to exercise any of these rights, contact me at the contact details given above.

You also have the right to make a complaint with the Spanish Data Protection Authority (AEPD).

10. Security

I take appropriate technical and organisational measures to protect your data: secure storage, encryption (where possible), limiting access only to those who need it. While I strive to protect your data, no system is perfect and I cannot guarantee absolute security, but I’ll do my best.

11. Children

My site is not directed to children under 16. I do not knowingly collect personal information from children under 16 for bookings or newsletter signup. If you believe I have done so, contact me and I will delete that data.

12. Squarespace & Third-Party Policies

• Squarespace acts as a processor or service provider in many cases. They store data on their servers. For information about how Squarespace handles visitor data, cookies, etc., see section 12 of Squarespace’s Privacy Policy. Squarespace

• Also third-party tools (analytics, email service) may have their own privacy policies.

13. Changes to this Policy

I may update this policy from time to time. If changes are significant, I will try to inform you (e.g. via newsletter or notice on website). The date at the top will be updated.