Privacy Policy
This website is run by Attila Kovács (Att CoWatch), who sells his own artworks as a private individual, not as a business. He is responsible for your personal data (the data controller). In this policy, “we” means Attila Kovács.
What we collect and why
You can browse this website without telling us who you are. We only process personal data in these cases: – When you contact us (through the form or by email): your name, email address, the subject and your message, so that we can answer you. Legal basis: steps you ask us to take before a possible purchase, and our legitimate interest in answering messages (GDPR Article 6(1)(b) and (f)). – When you buy a work: your name, delivery address and, if the delivery needs it, your phone number. We ask for these by email once a sale is agreed, and use them only to complete the sale and deliver the work. Legal basis: the sale contract (Article 6(1)(b)). – To keep the website running and safe: technical data such as your IP address and browser type, handled by our hosting provider and by the contact form’s spam protection. Legal basis: our legitimate interest in a secure, working website (Article 6(1)(f)). – To see how the website is used: anonymous visit statistics (see “Analytics” below). Legal basis: our legitimate interest in improving the website (Article 6(1)(f)). Giving us your data is voluntary, but we cannot answer a message without an email address. We do not make automated decisions about you or build a profile of you.
Contact form and emails
When you submit the contact form, your name, email address, subject and message are delivered to our inbox by Resend, our email delivery service. Messages you send us directly by email arrive in the same inbox, which is a Gmail account (a Google service). After you submit the form, we send a short automatic confirmation to the email address you gave. It only says that your message arrived; it never repeats what you wrote, because we cannot check that the address is yours. To protect the form from abuse, we keep your IP address in the server’s working memory to limit how many messages can be sent from one address within 10 minutes. It is never saved to a database or included in either email, and it is cleared the next time a message is processed after the 10-minute window, or when the server restarts.
How long we keep your data
– Messages and emails: we keep them in our inbox until you ask us to delete them. Just write to us and we will. – Purchase details (name, delivery address, phone number): as long as needed to complete the sale and the delivery, and after that only as long as the law requires. – IP address for spam protection: a short time, in working memory only (see above). – Server logs and analytics: only for the short periods set by our hosting provider, Vercel. – Copies of sent form emails at Resend: only for the limited period set by Resend.
Cookies and browser storage
We only use what the website needs to work, so there is no cookie banner: – NEXT_LOCALE cookie: remembers your language (English or Hungarian) for up to one year. – Browser session storage (gallery-return): remembers which artwork you opened in the gallery, so that Back takes you to the same place. It stays in your browser, is never sent to us, and is deleted when you close the tab. We do not use advertising or tracking cookies.
Analytics
We use Vercel Web Analytics and Speed Insights to see how the website is used and how fast it loads: which pages are visited, where visitors come from (the referring website and the country), what kind of device and browser they use, and how often features such as the gallery filters, the Inquire button or the contact form are used. These tools do not use cookies and do not store your IP address: visits are counted with an identifier that is reset every day, so they cannot follow you from day to day or across websites. We never send them names, email addresses or message text.
Who else handles your data
We use these service providers. They process data only to provide their service to us: – Vercel (hosting, analytics, performance measurement): https://vercel.com/legal/privacy-policy – Resend (sending the contact form emails): https://resend.com/legal/privacy-policy – Google (Gmail, the inbox where your messages arrive): https://policies.google.com/privacy – Cloudinary (storing and delivering the images and video; it sees your IP address when your browser loads them): https://cloudinary.com/privacy – When you buy a work, the courier or postal service we choose receives your name, delivery address and phone number to deliver it. Some of these companies are based in the United States or may process data there. Such transfers rely on the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We never sell your data or pass it on to anyone else, unless the law requires it (for example, at the request of an authority).
Links to other websites
The website links to Instagram, Facebook and Google Maps, and has share buttons for social networks. These are plain links: nothing is loaded from those services until you click one. Once you do, their own privacy policies apply.
Your rights
Under the General Data Protection Regulation (GDPR) you have the right to: – access the personal data we hold about you and get a copy of it; – have inaccurate data corrected; – have your data deleted; – restrict how we use your data; – receive the data you gave us in a portable format; – object to processing that is based on our legitimate interest. To use any of these rights, email us or use the contact form. We will answer within one month. If you believe we handle your data unlawfully, you can lodge a complaint with the competent data protection authority, or go to court.
Changes to this policy
We may update this policy from time to time. The latest version is always on this page, and the date at the top shows when it last changed.
How to contact us
If you have any questions about this privacy policy or your data, please contact us.
attcowatch@gmail.com