Yahaira Lidia Reyes-Forkan, trading as Naïve Art by Y.L.R. ("I", "me", "my"), is the data controller for personal data collected through this website and in connection with the sale of artwork and Everydays goods. This policy explains what data I collect, why, how I use it, and your rights under the General Data Protection Regulation (GDPR) and the Data Protection Acts 1988–2018. 1. What Data I Collect Depending on how you interact with this website, I may collect: Contact and identity data: your name and email address (from enquiries, newsletter signups, or purchases) Transaction data: purchase details, delivery address, and payment records (payment card data is processed by my payment provider and is not stored by me) Communications data: the content of emails or messages you send me Technical data: IP address, browser type, device information, and pages visited, collected automatically through website analytics tools 2. How I Use Your Data Purpose Legal Basis Processing and fulfilling your order Performance of a contract Responding to enquiries Legitimate interests / pre-contractual steps Sending the newsletter (if you opt in) Consent Improving the website and understanding visitor behaviour Legitimate interests Complying with legal obligations (e.g. tax records) Legal obligation I do not use your data for automated decision-making or profiling. 3. Newsletter and Marketing I will only send you marketing emails if you have explicitly opted in. You can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting me at [email protected]. Withdrawing consent does not affect the lawfulness of processing before withdrawal. 4. Who I Share Your Data With I share your data only where necessary: Payment processors (e.g. Stripe, PayPal) — to process transactions securely Shipping providers — your name and delivery address to fulfil orders Email marketing platform (e.g. Mailchimp) — if you subscribe to the newsletter Website platform (Webador) — which hosts this website and processes technical data Tax and legal advisers — where required by law I do not sell your data to third parties. Where I use third-party processors, I ensure they handle your data in accordance with GDPR. 5. International Data Transfers Some third-party services I use may transfer data outside the European Economic Area (EEA). Where this occurs, I ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions). 6. How Long I Keep Your Data Order and transaction records: 7 years (required for tax purposes under Irish law) Email enquiries: up to 2 years after the last contact Newsletter subscriber data: until you unsubscribe Website analytics: as set by the analytics platform (typically 26 months) 7. Cookies This website uses cookies. A cookie is a small file placed on your device. I use: Strictly necessary cookies: required for the website to function Analytics cookies: to understand how visitors use the site (only placed with your consent) You can manage your cookie preferences through the cookie banner on the website. For more information see my Cookie Policy [link if separate] or your browser settings. 8. Your Rights Under GDPR you have the right to: Access the personal data I hold about you Rectify inaccurate or incomplete data Erase your data in certain circumstances (right to be forgotten) Restrict processing of your data in certain circumstances Object to processing based on legitimate interests Data portability — receive your data in a structured, machine-readable format Withdraw consent at any time where processing is based on consent To exercise any of these rights, contact me at [email protected]. I will respond within one month. 9. Complaints If you are unhappy with how I handle your data, you have the right to lodge a complaint with the Data Protection Commission of Ireland: Data Protection Commission 21 Fitzwilliam Square South, Dublin 2, D02 RD28 www.dataprotection.ie | [email protected] | +353 1 765 0100 10. Changes to This Policy I may update this policy from time to time. The current version will always be published at naiveart-therapy.com with the effective date shown at the top. 11. Contact For any data protection queries: Yahaira Lidia Reyes-Forkan Leixlip, Co. Kildare, Ireland [email protected]