Privacy Policy

1. Who is responsible for your data

Bruno Pinho is the data controller for personal data processed in connection with this website, artwork acquisitions and related enquiries. You can contact me about privacy and your rights at bruno@pinho.com.pt. Website: https://bruno.pinho.com.pt.

2. Personal data that may be collected

Depending on how you use the website and whether you enquire or purchase, the following information may be processed:

• Your name, email address and telephone number.
• Your billing address, delivery address and country.
• The artwork or edition purchased, amount, currency, payment status and Stripe transaction or customer identifiers needed to manage the payment.
• Enquiries, delivery proposals, correspondence, collection or transport arrangements and related service records.
• Technical website information, such as request and security logs, browser and device information, visited pages, interactions and referring websites, to the extent collected by the infrastructure or permitted website measurement.

3. Purposes and legal bases

Data is used only for relevant and lawful purposes. The applicable legal basis depends on the processing activity:

• Performance of a contract and steps at your request before entering a contract: responding to acquisition enquiries, processing payment, identifying the purchased work, managing the acquisition, arranging delivery or collection, communicating with you and handling applicable returns or refunds.
• Legal obligation: accounting, tax, record-keeping and other legal or regulatory requirements, and responding to legally binding requests.
• Legitimate interests, where appropriate and balanced against your rights: maintaining website and transaction security, preventing fraud, protecting legal claims and managing ordinary correspondence or necessary service administration.
• Consent, where legally required: optional analytics or marketing technologies and any optional communications that require consent. You may withdraw consent at any time without affecting the lawfulness of earlier processing.

4. Payments and private buyer information

Stripe processes payments and handles complete card details within its secure payment environment. Bruno Pinho does not store complete card numbers or card security codes. Payment status, amounts and relevant Stripe identifiers may be retained to confirm and administer an acquisition.

Buyer names, contact details, addresses and private payment records are not publicly accessible through the website or its public artwork catalogue. The public catalogue is limited to artwork and acquisition information. Personal data is not sold.

5. Service providers and other recipients

Personal data is shared only where necessary for the stated purposes, with appropriate contractual or legal safeguards. Recipients may include:

• Stripe, for checkout, payments, fraud prevention and payment administration.
• Supabase, for securely hosting and operating the artwork catalogue and private acquisition records.
• Delivery, packaging, insurance and logistics providers, to arrange and fulfil an agreed delivery or collection.
• Technical infrastructure, hosting and communications providers supporting the website and its operation.
• Professional, legal or accounting advisers where needed, and public authorities where disclosure is legally required.

6. International data transfers

Some service providers may process data outside the European Economic Area. Where such transfers occur, applicable GDPR safeguards must be used, such as an adequacy decision or approved contractual safeguards, as appropriate to the transfer. You may contact bruno@pinho.com.pt for information about relevant safeguards.

7. Retention and security

Personal data is retained only for as long as necessary for the purposes for which it was collected, including completing an acquisition and delivery, managing correspondence, addressing claims and meeting applicable accounting, tax or other legal retention obligations. Retention depends on the type of record and the legal requirements that apply. Data is deleted or anonymised when it is no longer needed.

Appropriate technical and organisational measures are used to restrict access and protect personal data. Access is limited to those who need it for authorised purposes. No online service can guarantee absolute security, but private buyer records are not published as part of the artwork archive.

8. Cookies and website information

The website and its service providers may use technologies needed for functionality, security, language preferences and payment processing. Any optional analytics or marketing cookies or comparable device-storage technologies require appropriate prior consent where the law requires it. Refusing or withdrawing optional consent must not prevent access to basic website functions.

Payment pages hosted by Stripe are subject to Stripe’s own information about cookies and privacy. This policy does not authorise optional tracking without the required consent.

9. Your GDPR rights

Subject to the conditions and limitations in the GDPR, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests and withdraw consent where processing relies on consent.

To exercise your rights, email bruno@pinho.com.pt. Proportionate identity verification may be necessary to protect your data. Requests are answered within the applicable legal time limits, normally one month, with any lawful extension explained to you.

You may complain to Portugal’s Comissão Nacional de Proteção de Dados (CNPD), at https://www.cnpd.pt, or to another competent supervisory authority. Contacting me first does not limit your right to complain.

10. Providing information and policy updates

Information required for payment, acquisition and delivery is necessary to perform those services; without it, a purchase or delivery may not be possible. Optional information is not a condition of purchase. Personal data is not used by Bruno Pinho to make solely automated decisions producing legal or similarly significant effects; Stripe may apply its own payment-security checks under its own privacy information.

This policy may be updated when the website, services or legal requirements change. The current version and its update date are published here. Material changes will be communicated where legally required.

11. Contact

Bruno Pinho

Website: https://bruno.pinho.com.pt

Email: bruno@pinho.com.pt