Datenschutz­erklärung

Privacy Policy

Contract languages are German and English. In case of doubt, the German version prevails.

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. For detailed information on the subject of data protection, please refer to our privacy policy below.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Controller" in this privacy policy.

How do we collect your data?

Your data is collected in part when you provide it to us — for example, data you enter in a contact form or when signing up for our newsletter.

Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the error-free provision of the website. Other data may be used for communicating with you (e.g. newsletter, responding to contact inquiries) or for processing payments.

What rights do you have regarding your data?

You have the right to receive information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

2. Controller and Mandatory Information

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Daria Beizerov
Postreitweg 13
45145 Essen
Germany

Email: legal@daria.gallery

Supervisory Authority

The competent supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LfDI NRW)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
https://www.ldi.nrw.de

Data Retention

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke consent for data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place after these reasons cease to apply.

General Information on the Legal Bases for Data Processing

The legal bases for the processing of your personal data are explained in the respective sections of this privacy policy. Where the legal basis is not explicitly stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) GDPR and Art. 7 GDPR. The legal basis for processing to fulfil our services and to carry out contractual measures as well as to respond to inquiries is Art. 6(1)(b) GDPR. The legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR. The legal basis for processing to safeguard our legitimate interests is Art. 6(1)(f) GDPR.

Note on Data Transfers to Third Countries Not Deemed Safe under Data Protection Law and to Non-DPF-Certified US Companies

We use tools from companies based in the USA or other countries that are not deemed secure under data protection law. Where these tools are active, your personal data may be transferred to and processed in these third countries. We point out that in these countries no level of data protection comparable to that of the EU can be guaranteed. Where US companies are certified under the EU-US Data Privacy Framework (DPF), an adequate level of data protection can be assumed. In addition, we have concluded Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR with the respective providers.

Revocation of Your Consent

Many data processing operations are only possible with your express consent. You may revoke any consent you have already given at any time. The legality of the data processing carried out before the revocation remains unaffected by the revocation.

Right to Object to Data Collection in Special Cases and to Direct Marketing (Art. 21 GDPR)

Where data processing is based on Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing.

3. Your Rights as a Data Subject

You have the following rights with respect to your personal data:

  • Right of access (Art. 15 GDPR) — You have the right to obtain confirmation as to whether personal data concerning you is being processed and, if so, to access that data.
  • Right to rectification (Art. 16 GDPR) — You have the right to obtain the rectification of inaccurate personal data and the completion of incomplete data.
  • Right to erasure ("right to be forgotten") (Art. 17 GDPR) — You have the right to request the erasure of your personal data where one of the grounds set out in Art. 17 GDPR applies.
  • Right to restriction of processing (Art. 18 GDPR) — You have the right to request the restriction of processing where one of the conditions set out in Art. 18 GDPR is met.
  • Right to data portability (Art. 20 GDPR) — You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
  • Right to object (Art. 21 GDPR) — You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.
  • Right to withdraw consent (Art. 7(3) GDPR) — You have the right to withdraw your consent at any time. The legality of the processing carried out on the basis of the consent until withdrawal is not affected thereby.
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is: LfDI NRW, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

4. Hosting

Cloudflare

Our website is hosted with Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare provides both the delivery of pages and the serverless database for our application data. Processing takes place on Cloudflare's global edge network. The primary database, in which all write operations occur, is stored in the Western Europe region (including Frankfurt and Amsterdam). As a significant share of our members reside outside Europe (in particular the USA and the United Kingdom), we use Cloudflare D1 read replication: Cloudflare automatically creates read-only replicas of the database in further regions — including outside the EU, in particular the USA — so that members can read their data from a geographically nearby region. Read operations are served from the nearest replica; write operations continue to take place exclusively in the European primary database. A deletion in the primary database is automatically propagated to all replicas. For the associated third-country transfer and the safeguards (DPF, SCC) see the paragraph "Third-country transfer" below and section 3.

When you visit our website, Cloudflare processes technically necessary browser information:

  • IP address of the requesting device
  • Date and time of access
  • Pages accessed / name of the retrieved file
  • HTTP status code and protocol information
  • Browser type and version, operating system
  • Referrer URL (previously visited page)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in ensuring server security, stability, protection against abuse (DDoS and bot mitigation) and the error-free provision of the website.

Storage period: Cloudflare keeps request logs only briefly for abuse prevention. We ourselves do not write personally identifiable access logs. Application errors (Worker runtime errors) are retained in Cloudflare logs for a maximum of 7 days and then deleted.

Transfer to third countries: Cloudflare is a US company and is certified under the EU-US Data Privacy Framework (DPF). In addition, standard contractual clauses (Art. 46(2)(c) GDPR) are in place with Cloudflare as a supplementary safeguard.

Data processing agreement: We have concluded a Data Processing Addendum (DPA) with Cloudflare pursuant to Art. 28 GDPR.

For more information, see Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

Provision of the legal documents as PDF

We additionally make our legal documents (Terms, Privacy Policy, Withdrawal Notice) available for download as versioned, immutable PDF files (e.g. daria.gallery/legal/agb/v2026-05-30.pdf). These files are generated server-side from the respective source text and served via the same Cloudflare infrastructure. No processing takes place beyond the technical access data described above: we keep no separate access logs, set no cookies and run no behavioural tracking. The files are accessible without logging in.

Legal basis: Art. 6(1)(c) GDPR (compliance with statutory information and record-keeping duties, including §§ 312f, 312i BGB) and Art. 6(1)(f) GDPR (reliable provision).

Cloudflare Stream (live video and recordings)

We deliver our free live painting sessions and any recordings we publish afterwards through Cloudflare Stream, a video service from the same provider that hosts our website (see above). Cloudflare Stream takes care of getting the video to your browser at a quality that matches your connection.

When you open /live or /live/watch while a live session is running, your browser connects directly to Cloudflare Stream to receive the video. As with any web request, your IP address and a few details about your browser are transmitted. No cookies are set and no behavioural tracking takes place during this delivery.

Note on data usage: So that the video starts immediately when you tap the play prompt, your browser quietly begins loading the first video data in the background as soon as the page loads. If you would prefer to avoid this – for example when you are on a mobile data plan – please close the page without starting playback.

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in delivering live sessions and recordings reliably and without stuttering.

Third-country transfer, data processing agreement, storage period: Cloudflare Stream belongs to the same Cloudflare account we use for hosting (see above). The safeguards described there – the EU-US Data Privacy Framework, the standard contractual clauses, and our Data Processing Addendum with Cloudflare – cover Cloudflare Stream automatically; no additional provider and no additional contract are involved. Recordings remain stored until we actively delete them or mark a session as "no replay".

Product information about Cloudflare Stream: https://www.cloudflare.com/products/cloudflare-stream/

5. Newsletter (Sendy / Amazon SES)

Description and Scope of Data Processing

We offer you the option of subscribing to our newsletter on our website. For sending the newsletter, we use the self-hosted software Sendy. Sendy runs on our own IONOS server in Germany; subscriber data (email address, name, IP address, timestamp) therefore remains on our server.

The technical sending of emails is handled by Amazon Simple Email Service (SES), provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The SES endpoint we use is in the eu-west-1 (Ireland) region; data is therefore processed within the European Union. AWS is certified under the EU-US Data Privacy Framework (DPF).

Double Opt-In Process

Subscription to our newsletter follows a double opt-in process. After signing up, you will receive an email asking you to confirm your subscription. Only after clicking the confirmation link is the subscription complete. This process serves as proof of your consent.

Signing up from the Studio Member App

If you are a logged-in Studio member, you can additionally subscribe to the Studio Letter from your account settings (studio.daria.gallery/account/preferences). The data goes into the same Sendy list as a signup via the public form, and this path also follows the double opt-in process (after clicking inside the Studio you will receive a confirmation email from Sendy). Unsubscription is handled exclusively via the unsubscribe link at the bottom of any Letter email (or additionally by emailing studio@daria.gallery); the Studio member app does not carry an unsubscribe path of its own, so that the subscriber status maintained by Sendy stays unambiguous at all times.

Data Collected

  • Email address (required)
  • Name (optional)
  • IP address at the time of signup
  • Timestamp of signup and confirmation

No Email Tracking

Our newsletters contain no tracking pixels and no click tracking. We do not measure open rates or click behaviour within the emails; individual recipients are not profiled.

Legal Basis

The processing of data for sending the newsletter is based on your consent pursuant to Art. 6(1)(a) GDPR.

Revocation and Unsubscription

You may revoke your consent to receiving the newsletter at any time, e.g. via the unsubscribe link at the bottom of each newsletter email or by emailing studio@daria.gallery. The legality of data processing already carried out remains unaffected by the revocation.

Storage Period

Your data is stored for the duration of the newsletter subscription. After unsubscription, your consent records (email address, IP address, signup and confirmation timestamps) are retained for 3 years to demonstrate the legality of prior processing (statutory duty to provide evidence). After that, the data is deleted.

Live-Session Reminders

Independently of the Studio Letter newsletter, we offer a subscription for reminders about our free live painting sessions on the /live page. The reminders are managed as a separate, independent list in Sendy; technically and legally, this is a processing activity distinct from the Studio Letter, with its own consent.

Purpose: For each scheduled live session, you receive exactly one reminder email – typically about 60 minutes before the session starts. You also receive a reminder once a recording has been published, in case you missed the live session. No editorial newsletter or advertising is sent via this list.

Data collected: email address, IP address at the time of signup, timestamps of signup and double opt-in confirmation.

Double opt-in: The signup process is identical to the Studio Letter newsletter. Without clicking the confirmation link, no reminder is sent.

Legal basis: Art. 6(1)(a) GDPR (consent). Consent is given separately from the Studio Letter consent and can be revoked individually.

Revocation: You can use the unsubscribe link at the end of any reminder email at any time, or contact us by emailing studio@daria.gallery. The legality of processing carried out up to the revocation remains unaffected.

Storage period: Same as for the Studio Letter – for the duration of the subscription; after unsubscription, consent records are retained for 3 years and then deleted.

Technical infrastructure: The data is processed through the same Sendy instance on our server and sent via Amazon SES (EU, Ireland); the above notes on Sendy, SES, DPF certification and the processing agreement apply accordingly.

Studio Members and Existing-Customer Mailings

Where, as a Studio member (Pass or Atelier alumnus), you are addressed with mailings about the Provider's own similar offerings, this may — in addition to express consent — also take place on the basis of § 7 (3) UWG in conjunction with Art. 6 (1) f GDPR. The Provider uses this legal basis exclusively for emails about own similar offerings (Pass members about new Pass content; Atelier alumni about new Atelier seasons), not for unrelated advertising. The four prerequisites of § 7 (3) UWG (collection in the course of a business relationship, own similar products, no objection, clear notice of the right to object on collection and in every subsequent email) are cumulatively met.

Data Processing Agreement

We have concluded a Data Processing Addendum (DPA) with Amazon Web Services pursuant to Art. 28 GDPR.

Live Chat

During a live session, you may take part in a real-time chat at /live/watch. The chat runs over our hosting provider Cloudflare (see § 4) as a real-time connection.

Data collected: the display name you choose, your pigment selection, a random browser key (details in section 11), your chat messages, and the IP address required for the connection.

Chat-server profile: While a live session is running, our chat server holds your display name and pigment selection in memory, paired with your browser key. This way your name appears consistently to all participants, even if you change it mid-session. No storage beyond the end of the session takes place on our server.

IP processing: While you only read along, your IP address is held for the duration of the chat connection and discarded when the connection closes. Once you send a chat message, your IP address is stored together with the message internally for the duration of the running live session (storage is capped at the most recent 100 messages). The IP is never shared with other chat participants or shown publicly.

Purpose of IP storage: exclusively for moderation. In case of chat-rule violations (e.g. spam, harassment), the artist may issue a block that disables sending for your IP for the duration of the session – watching the live stream remains unaffected.

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in operating a moderable live platform and maintaining a harassment-free chat for all participants.

Storage period: Chat messages and associated IPs are deleted when the live session ends or is reset (manually by the artist, or at the next reset at the latest). No storage beyond the session takes place.

Local storage in your browser: your chosen display name, your pigment selection, your acceptance of the chat rules and a random browser key are stored in your browser's localStorage. This lets you re-enter a future live session on the same device under your previous name without setting things up again. Details on purpose, retention and legal basis are in section 11 (Cookies, Local Storage and Similar Technologies).

Pre-session questions

Before an announced live session, you may submit a question to the artist via a form on /live. This feature is only visible while the event is announced or about to start; it disappears once the session goes live.

Data collected: the question you submit, optionally a display name you provide voluntarily, and your IP address.

Purpose of IP storage: exclusively for spam protection. The IP is used to limit the number of questions per hour (rate limit) and to detect abuse. The IP is never shown publicly or shared with other participants.

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in protection against automated abuse and in operating a moderable Q&A function.

Storage period: Questions and the associated IP are stored until the artist deletes them manually (typically following the related live session). At the latest, all related questions are deleted along with the event.

6. Shop: Order Processing and Payment Service Provider

6.1 Order Processing in the Online Shop

When you place an order in the online shop at daria.gallery, we process the personal data necessary to fulfil the contract. Payment data itself (card number, bank details, expiry dates, etc.) is not processed on our server and is passed directly to our payment service provider Stripe (see section 6.2).

Data collected:

  • Name and shipping/billing address
  • Email address
  • Order history (works purchased, quantities, prices)
  • Order and invoice number (format: DG-YYYY-NNNN)
  • Payment status and Stripe reference ID
  • Shipping zone (Germany, EU, worldwide), shipping status, tracking number and carrier if applicable

Purposes of processing:

  • Processing your order (confirmation, delivery, communication)
  • Creation and delivery of the invoice as a PDF document
  • Inventory management and internal order handling
  • Compliance with statutory commercial and tax obligations

Legal bases:

  • Art. 6(1)(b) GDPR — performance of a contract and pre-contractual measures for all data necessary to conclude and perform the sales contract (name, shipping address, email, order items).
  • Art. 6(1)(c) GDPR — compliance with legal obligations, in particular the commercial retention periods for invoices and accounting records under § 257 of the German Commercial Code (HGB) and § 147 of the German Fiscal Code (AO).

Storage location: Order data is stored with our hosting provider Cloudflare (see section 4). Order data is not transmitted to an external database provider.

Invoice PDF: After successful receipt of payment, an invoice PDF is automatically generated, stored on our server and sent to you by email. The invoice contains only the information required by § 14 of the German VAT Act (UStG) read in conjunction with § 19 UStG (small-business scheme — no value-added tax is charged or shown).

Disclosure to shipping service providers: In order to deliver your order, we transmit your name and shipping address to the shipping service provider engaged for the delivery (typically Deutsche Post, DHL, DPD, Hermes or UPS). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). For deliveries outside the European Union, it may be necessary to pass address data to customs authorities and foreign transport providers; in that case the transfer is also based on Art. 6(1)(b) GDPR and, where applicable, Art. 49(1)(b) GDPR (performance of a contract in a third country).

Order confirmation and invoice emails: Order confirmations, shipping confirmations and the invoice itself are sent via Amazon Simple Email Service (SES) in the eu-west-1 (Ireland) region. For further details, see section 5 "Newsletter".

Storage period: Order data that forms part of an invoice, commercial correspondence or accounting record is retained for ten years from the end of the calendar year in which the document was created, in order to comply with statutory retention obligations (§ 257(4) HGB, § 147(3) AO). After this period the data is deleted, unless another ground for storage applies. Order data not subject to retention obligations (e.g. tracking numbers after successful delivery) is deleted as soon as the purpose ceases to apply.

Obligation to provide the data: Providing your personal data (in particular name, shipping address, email) is necessary to conclude and perform the sales contract. Without this data we cannot conclude the contract or execute your order.

6.2 Payment Processing (Stripe)

We use Stripe for payment processing.

European provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland.
Parent company: Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA.

Stripe is certified under the EU-US Data Privacy Framework (DPF). In addition, Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR are in place.

Data Collected

During a payment transaction, the following data is transmitted directly to Stripe (via Stripe.js — payment data does not pass through our server):

  • Name
  • Email address
  • Billing address
  • Payment card data (card number, expiry date, CVV)
  • IP address
  • Transaction data (amount, currency, time)

Legal Basis

Data processing is based on Art. 6(1)(b) GDPR (performance of a contract). Providing the data is necessary to process the purchase transaction.

Stripe Cookies

When the checkout page is loaded, Stripe.js sets its own first-party cookies on Stripe domains (including m.stripe.com): on the one hand for session management of the Payment Element (essential for the payment function), on the other hand for fraud prevention (Stripe Radar). These cookies are set and read directly by Stripe; we ourselves do not set any Stripe-related cookies. Stripe.js is loaded exclusively on the checkout page — that is, only once the customer has actively initiated the payment flow. Both session management and fraud prevention are therefore covered by the service "online payment" expressly requested by the user (§ 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR; cf. EDPB Guidelines 2/2023 on Art. 5(3) ePrivacy Directive regarding payment-essential cookies).

Fraud Prevention

Stripe may also process your data for fraud prevention purposes (Stripe Radar) as an independent controller.

For more information, see Stripe's privacy policy: https://stripe.com/privacy

7. Contact Form and Email Inquiries

Contact Form

If you send us an inquiry via the contact form, we process your details in order to respond and handle any follow-up questions. Your message is forwarded to studio@daria.gallery; we also send you a brief automatic acknowledgement.

Data collected: name, email address, message text, and — depending on the inquiry type (artwork, commission, press, workshop, hello) — additional details such as country, the artwork of interest, desired format, organisation or preferred date.

Storage: Your message itself is not stored in any database; it remains exclusively in your and the studio's email inboxes. To prevent spam, we briefly check whether too many messages are being sent from the same connection in quick succession. For this check we use a non-reversible placeholder together with a timestamp, which is overwritten after 60 seconds. Your IP address itself is not stored.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures), if the inquiry relates to a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in answering incoming inquiries and in protecting against abuse).

Storage period: The message remains in the email inboxes until you request deletion, revoke your consent, or the purpose no longer applies (e.g. after your inquiry has been resolved). Statutory retention periods remain unaffected.

Service providers: For receiving the form, we use our hosting provider Cloudflare (see section 4); for the email delivery, Amazon Web Services (SES, Ireland region). Data processing agreements are in place with both providers; processing takes place within the EU or under the supplementary safeguards of the EU-US Data Privacy Framework.

Email Inquiries

If you contact us directly by email, your inquiry and the personal data it contains (e.g. your name) are stored and processed in order to handle your request. The same legal bases and storage periods as for the contact form apply.

8. Applications for Programmes and Workshops

In some places on our website you can apply for programmes, workshops or classes (currently: the Atelier Foundations). Further programmes will follow; this section applies to all application forms on daria.gallery.

Data collected: contact details (name, email address, optional country), your free-text responses about yourself and your application (e.g. experience, motivation, goals), and – where the specific form provides for it – an uploaded work sample (image file). The exact fields a particular form asks for are shown to you when filling it out.

Atelier applications (Studio): The application form in the Studio asks for three free-text responses – where you currently are with watercolour (including links to your own work), what feels stuck, and what you would like to take away from the class – together with a work sample as image upload(s) or a PDF. Uploaded work samples are stored in our object storage (Cloudflare R2, see section 4) and become read-only once a decision has been made on the application. As a logged-in member, you can review your responses and the associated file references at any time via your data export (section 3).

Purpose: evaluating your application, selecting participants, and contacting you for further coordination.

Storage: Your application and any work sample are stored with our hosting provider Cloudflare (see section 4). To prevent spam, we briefly check whether too many applications are being submitted from the same connection in quick succession; we use a non-reversible placeholder together with a timestamp for this. Your IP address itself is not stored.

Notification: Daria receives a notification email for each incoming application. The sending is handled via Amazon Web Services (SES, Ireland region; see section 5).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures relating to a possible workshop or programme contract) and Art. 6(1)(f) GDPR (legitimate interest in protection against abuse).

Storage period: Rejected or withdrawn applications are deleted no later than 6 months after the end of the respective application period. If your application is accepted, your information is retained for the duration of the contract; statutory retention periods remain unaffected.

Requirement: Providing the information marked as mandatory in the respective form is necessary for us to process your application. Without this information, no application can be made.

9. External Links

Our website contains hyperlinks to external third-party websites (including Instagram, YouTube, Pinterest). By clicking an external link, you leave our website. We have no influence over the content or privacy practices of the linked sites; the respective provider's privacy policy applies.

The mere presence of a link on our website does not cause any data to be transmitted to third parties. No external content is embedded (no embeds, no plugins, no iFrames). Data is only transmitted when you actively click the link.

10. Social Media

We maintain public profiles on the following social networks. When you visit one of these profiles, the respective provider processes your data (including IP address, browser data, interactions) in accordance with its own privacy policy. We receive anonymised statistics about the use of our profiles from the provider.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in public relations and communication).

Instagram

Profile: @daria.botanicals
Provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland.
We have entered into a joint controller agreement pursuant to Art. 26 GDPR with Meta (Page Controller Addendum):
https://www.facebook.com/legal/terms/page_controller_addendum
Privacy policy: https://privacycenter.instagram.com/policy
Opt-out: https://www.instagram.com/accounts/privacy_and_security/

YouTube

Channel: @Daria.Botanicals
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google is certified under the EU-US Data Privacy Framework (DPF).
Privacy policy: https://policies.google.com/privacy
Opt-out: https://adssettings.google.com/authenticated

Pinterest

Profile: Dariabotanicals
Provider: Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland.
Pinterest Inc. (USA) is certified under the EU-US Data Privacy Framework (DPF).
Privacy policy: https://policy.pinterest.com/en/privacy-policy
Opt-out: https://www.pinterest.com/settings/privacy

11. Cookies, Local Storage and Similar Technologies

On the public Gallery (daria.gallery) we do not set any cookies of our own; no analytics, advertising or tracking cookies are used. Our hosting and CDN provider Cloudflare may set strictly necessary cookies for security and bot mitigation; on the shop's checkout page, Stripe loads its own first-party cookies on its own domains. In the signed-in area of the Studio (studio.daria.gallery) we additionally set a strictly necessary session cookie and a technical consistency cookie (d1b). Details on all cookies are listed below.

Cloudflare security cookies (cf_clearance, __cf_bm)

Cloudflare is our hosting and CDN provider (see section 4) and protects our website against automated attacks such as DDoS attempts and malicious bot traffic. In this context, Cloudflare may place two cookies in your browser:

  • cf_clearance — set once you have successfully completed a security check (e.g. a JavaScript challenge or CAPTCHA), so that the check does not have to be repeated on every subsequent page view. Retention: typically up to 30 minutes; can be longer depending on Cloudflare's configuration.
  • __cf_bm — a bot-management cookie used by Cloudflare to distinguish automated traffic from real visitors. It contains no personal data and is not used for tracking or advertising. Retention: 30 minutes from the last page view.

Purpose: strictly technical security — protection against abuse, attacks and bot traffic. These cookies are not used for analytics, profiling or advertising; no data is shared with third parties.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the secure provision of the telemedia service you have expressly requested) and Art. 6(1)(f) GDPR (legitimate interest in the security and availability of our website). No cookie consent banner is required for this.

These cookies are set and read exclusively by Cloudflare; we ourselves have no access to their contents. For more information see Cloudflare's privacy policy and the Cloudflare cookie reference.

Studio session cookie (studio_session)

As soon as you sign in to the Studio (studio.daria.gallery) we set a single technical cookie named studio_session. It carries a random session token (stored as a hash on our server, see section 14.1) and lets us keep you signed in across page views.

Attributes: first-party cookie, HttpOnly (cannot be read by scripts), Secure (HTTPS only), SameSite=Lax. Retention: up to 90 days, sliding; on manual logout the cookie is deleted immediately.

Purpose: recognising your signed-in session across multiple page views. No tracking, no profiling, no sharing with third parties takes place.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the telemedia service "Studio member area" expressly requested by you) and Art. 6(1)(b) GDPR (contract performance). No cookie consent banner is required for this.

For non-signed-in visitors of the Studio (in particular guests on the public watch page) no session cookie is set.

Studio consistency cookie (d1b)

In the Studio we set a further strictly necessary cookie named d1b. It contains only an opaque version marker of our database (a so-called "bookmark") and ensures that, immediately after a change (e.g. a post you have written), you are shown the current version of your own data even when it is read from a regional database replica (see section 4). The cookie contains no personal data, no identifier of you and no tracking purpose.

Attributes: first-party cookie, HttpOnly (cannot be read by scripts), Secure (HTTPS only), SameSite=Lax. Retention: 1 hour.

Purpose: technical read consistency across geographically distributed database replicas. No tracking, no profiling, no sharing with third parties takes place.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the member-area function you have requested) and Art. 6(1)(b)/(f) GDPR. No consent is required.

Local Storage (Shopping Cart and Checkout Flow)

The online shop uses the local storage of your browser to store the contents of your shopping cart and the intermediate state of an ongoing payment (Stripe reference ID) locally in your browser. This information never leaves your device, is not transmitted to our server and does not contain personal data such as name, address or payment details.

Legal basis: § 25(2) no. 2 TDDDG — this storage is strictly necessary in order to provide the service you have expressly requested (shopping cart, checkout). No cookie consent banner is required for this.

You can clear local storage at any time in your browser settings. In that case your shopping cart will be empty on your next visit.

Local Storage (Live Chat)

When you take part in the live chat, your browser remembers a few details locally so you don't have to set them up again on every visit:

  • your chosen display name
  • your pigment selection (your colour avatar in the chat)
  • your one-time acceptance of the chat rules
  • a random browser key so that brief connection drops (e.g. switching Wi-Fi, refreshing the tab) don't make you appear as a new participant each time

These details only leave your device when you actively send a message or join a live session. The browser key is then transmitted to our chat server and used there exclusively to recognise you when reconnecting. It is not combined with cookies, third parties, advertising profiles or analytics – there is no tracking of any kind.

Legal basis: § 25(2) no. 2 TDDDG — this storage is strictly necessary so that we can reliably provide the live chat as a service you have expressly requested.

You can clear local storage at any time in your browser settings. The next time you visit the live chat, you will then appear as a new participant again.

Stripe Cookies during Checkout

When you load the checkout page, Stripe.js is loaded into your browser. Stripe then sets its own first-party cookies on Stripe domains (including m.stripe.com) for fraud prevention and session management of the Payment Element. Details on categories and retention periods can be found in section 6.2 "Payment Processing (Stripe)" and in Stripe's privacy policy.

Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for the payment service expressly requested by the user) and Art. 6(1)(b) GDPR (performance of a contract). Stripe cookies are only loaded on the checkout page, not on other pages of our website.

12. Website Analytics (cookieless, self-operated)

To measure reach and improve our website, we operate a cookieless analytics system. We do not use analytics cookies, tracking pixels or browser fingerprinting. Services like Google Analytics, Matomo or Plausible are not integrated; data is not shared with third parties.

Data collected per page view

  • Page visited (e.g. /biography)
  • Time of the visit
  • Device category (mobile, tablet or desktop)
  • Screen and window size (e.g. 1440×900)
  • Preferred browser language (e.g. en)
  • Where you came from (direct, an internal page, or an external domain — without a specific path)
  • Campaign identifiers from the URL (utm_source, utm_medium, utm_campaign), if present

In addition we record anonymous interactions (e.g. form submission, click on an external link, opening the AR view, 404 hit) and approximate time-on-page (up to 30 minutes).

What we do not collect

We do not store your IP address, no full browser identification string, no cookies, and no identifiers that could link individual visits to a person.

Legal basis and consent

Processing is based on our legitimate interest in a data-minimising reach measurement (Art. 6(1)(f) GDPR). Because the measurement works without cookies and without accessing information stored on your device, no consent banner is required under § 25 TDDDG.

Storage period

Individual page views and events are deleted after 12 months at the latest. Purely aggregated, non-identifiable metrics (e.g. monthly visitor totals) may be kept longer.

Your right to object

Our tracking script honours your browser's Do Not Track header: if enabled, nothing is collected. In addition, you can email us an objection to legal@daria.gallery at any time. Common ad/tracker blockers will also prevent the collection.

Recipients

Data is processed exclusively within our hosting infrastructure (see section 4). No external analytics providers receive this data.

Downloads

When you download a token-protected file, we log the access in order to gauge the reach and popularity of the materials we provide.

Data collected: the token used, file name, timestamp, device category, screen, preferred browser language, and classified referrer (e.g. "direct" or an external domain). Neither the IP address nor the full browser identification string is stored.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring reach and detecting any abuse of token links). Storage period: identical to the rest of the analytics data (max. 12 months).

13. SSL/TLS Encryption

This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator. You can recognise an encrypted connection by the browser address bar changing from "http://" to "https://" and by the lock icon in your browser bar.

14. Studio Member App (Authentication, Profile, Community, DMs)

This section concerns all areas under studio.daria.gallery that are accessible only after sign-in.

14.1 Sign-in and Session (Magic Link + OTP)

The Studio uses passwordless sign-in via magic link (clicking the link in the email) and/or a 6-digit OTP code (entered on the login page).

Data collected: your email address, and at sign-in additionally the request IP and the browser fingerprint (for brute-force detection), the generated login code (stored hashed, with expiry).

Legal basis: Art. 6(1)(b) GDPR (contract performance / provision of the member service) and Art. 6(1)(f) GDPR (security against brute-force attacks, rate-limiting).

Delivery: Magic link and OTP are delivered via Amazon SES (region eu-west-1, Ireland).

Storage period: login codes are deleted at the latest 24 hours after issuance; marked as consumed immediately upon successful use. Active sessions are automatically invalidated 90 days after last use; manual logout invalidates immediately.

Session cookie: upon successful sign-in we set a strictly necessary session cookie (studio_session) in your browser. Details on attributes, retention and legal basis are set out in section 11.

14.2 Member Profile

When you create your account we store your email address and a freely chosen display name. Optionally you may add: an avatar (pigment selection or an uploaded photo), a short bio, your time zone. We additionally store derivatives of your membership status (e.g. whether you currently hold an active Pass or an Atelier membership).

Legal basis: Art. 6(1)(b) GDPR.

Storage location: with our hosting provider Cloudflare (see section 4).

Storage period: account lifetime. Upon account deletion your profile data is anonymised (email is replaced by a non-deliverable placeholder address, display name → "Deleted member", avatar/bio/time zone → empty).

14.3 Drawing Rooms, Replies, Reactions, Direct Messages

Within the Studio you may post in Drawing Rooms, reply, leave reactions and exchange direct messages with other members.

Data collected: contents of posts and messages (Markdown text + attachments: images, videos, PDFs), timestamps, author ID, read timestamps for DMs, reactions.

Storage location: text, uploaded media and video attachments are held with our hosting provider Cloudflare (see section 4); video attachments are delivered via Cloudflare Stream.

Visibility: posts in a Drawing Room are visible to the members with access to the respective room (tier-dependent: free / Pass / Atelier class). Direct messages are visible only between the two members involved.

Legal basis: Art. 6(1)(b) GDPR (platform provision as agreed service).

Storage period: account lifetime. Upon account deletion, author references are anonymised; in shared Drawing Rooms the posts remain for discussion integrity (see Terms § 17.4). Upon request, shared posts are also removed within what is reasonable.

Moderation: in case of violations of community rules (see Terms § 18) the Provider may remove posts or restrict individual functions. The author receives a reasoned notice (notice-and-action mechanism pursuant to Art. 16 ff. Digital Services Act).

14.4 Atelier Submissions and Feedback

Within an Atelier Season you may upload exercise submissions. The Provider gives personal feedback on them, optionally with attachments (e.g. sketches).

Data collected: title, description text, image/video/PDF attachments, visibility flag (only you + Provider, or visible to the Atelier class of this season).

Access restriction: Your submissions, as well as recordings of critique sessions that show participants' work, remain technically restricted to the Atelier class of this season (its members and alumni). They are not made available to other members (such as Pass holders) or to the public, and are not publicly indexed.

Legal basis: Art. 6(1)(b) GDPR (central component of the Atelier service).

Storage location: with our hosting provider Cloudflare (see section 4).

Visibility: feedback never leaves the Atelier class area; no mirroring into publicly indexed areas. Confidentiality continues to apply after the season ends for alumni archive access.

Storage period: account lifetime; upon account deletion, the author ID is anonymised; upon request, the content is deleted to the extent reasonable.

14.5 Engagement Status (Read State, Material Views, Library Progress)

Within the Studio we mark which teaching materials you have read or viewed, which items you have flagged as "packed", whether you have marked yourself ready for a session, which library chapters you have completed.

Data collected: member ID, material/session/chapter ID, timestamp.

Legal basis: Art. 6(1)(b) GDPR (core of the learning experience).

Accessibility: this data is your own and is included in your data export (see section 3 and Art. 15 + 20 GDPR).

Storage period: account lifetime.

Profiling notice (Art. 4(4) GDPR). This recording constitutes a form of profiling within the meaning of Art. 4(4) GDPR — it evaluates your learning behaviour exclusively for the internal display of your own progress and for the operation of the Atelier functions. Automated decision-making within the meaning of Art. 22 GDPR does not take place. You may object to the profiling at any time pursuant to Art. 21 GDPR; in that case only the markings strictly necessary for contract performance are continued.

14.6 Notifications + Saves

We generate in-app notifications (new replies, mentions, Atelier session reminders, direct messages) and may send transactional reminder emails (session start, event reminder, feedback availability).

You may adjust the extent of optional email notifications at any time in your account settings (studio.daria.gallery/account/preferences). The in-app notice (the bell icon and /notifications) is part of the member app and is unaffected. Mandatory notifications — such as the legally required announcement of a Pass change under §§ 327f, 327r BGB (see section 14.11) — cannot be switched off.

Data collected: notification content (title, body, target URL), recipient ID, timestamp, read status.

Legal basis: Art. 6(1)(b) GDPR.

Storage location: with our hosting provider Cloudflare (see section 4).

Delivery backend for email notifications: Amazon SES (see section 5).

Storage period: 90 days after being read.

Saves: if you add content (posts, materials, letters) to your saves, we store your member ID and a reference to the content for retrieval. Lifecycle analogous to engagement data.

14.7 Member Consents

At signup (or upon version changes) we record which version of the Terms and Privacy Policy applies at the time of your consent, and where applicable a subscription consent for the newsletter.

Data collected: member ID, consent type (Terms, Privacy, marketing emails, as well as the consent to the early lapse of the right of withdrawal for the Studio Pass under Terms § 16.2 or for the Atelier season under Terms § 16.2a), policy version, a salted SHA-256 hash of your IP address and user agent at the time of granting, timestamp of granting and, where applicable, withdrawal. The salt is unique per member, held exclusively on our server and is not part of your data export. The hash serves solely as audit-proof evidence pursuant to Art. 7(1) GDPR and is not processed for any other purpose.

You give the lapse-of-withdrawal consents (Pass or Atelier season) during checkout via a non-pre-ticked confirmation box. As evidence, we additionally store a reference to the corresponding Stripe transaction (e.g. the subscription or payment ID). Because this consent is captured as part of payment processing, no IP/user-agent hash is produced; the evidence relies on the timestamp, member ID and the transaction reference.

If you sign up for the Studio Letter as a logged-in member from your account settings (see section 5), a consent row of kind marketing_email is additionally stored in our database alongside the entry in the Sendy list (with policy version, timestamp and the salted hash of IP address and user agent described above). This row serves solely as a second evidence trail (Art. 7(1) GDPR) in case the Sendy records become inaccessible; the subscriber status itself continues to be maintained by Sendy.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7 GDPR (proof of consent).

Storage period: even after account deletion, consent logs are retained for 3 years to be able to prove lawfulness (analogous to newsletter, section 5).

14.8 Export Your Data and Delete Your Account

You may at any time:

  • download your full data export (JSON) via studio.daria.gallery/account/legal (the “Download my data” button);
  • delete your account yourself via studio.daria.gallery/account/leave.

Account deletion cancels all Pass subscriptions, revokes active sessions and anonymises your profile data. Content in shared Drawing Rooms is retained (see Terms § 17.4). Invoice data is processed in a restricted manner for the statutory retention period (10 years). While a Studio Pass or an Atelier membership is still active, account deletion is not possible; the member must first initiate the Pass cancellation, complete an Atelier season, or arrange matters with the provider (Art. 17(3)(b)/(e) GDPR).

Deletion at processors. Upon account deletion or after expiry of the respective storage period, the data concerned is also deleted at our processors (see section 4) or such deletion is procured. In particular, after the end of a processing operation, no personal data remains at a processor without a legal basis.

14.9 Minimum Age

The Studio is aimed exclusively at adults (see Terms § 3(6)). We knowingly do not process data of persons under 18 years. If we become aware that an account was created by a minor, we delete it and the associated data.

14.10 Content Reports and Statements of Reasons (DSA)

When you report another member's content, we process your member ID, the reference to the reported content, the chosen category and your explanatory text in order to handle the report (Art. 16 DSA). We keep you informed of the acknowledgement of receipt and of the decision.

If you are affected by a measure taken by the Provider (e.g. removal of a post or a suspension), you receive a statement of reasons pursuant to Art. 17 DSA and may appeal within fourteen days (see Terms § 18.4).

Measures range from the removal of individual content through a temporary restriction of posting rights (posting restriction; read and Pass access remain unaffected) to the suspension of the account. A temporary posting restriction is logged in our moderation register together with the reason and the start and end times; these details are included in the DSAR data export.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 14–17 DSA (legal obligation).

Storage location: with our hosting provider Cloudflare (see section 4).

Storage period: reports and measures are deleted six months after conclusion; upon account deletion the member references are pseudonymised, while the audit trail of the measure is retained as proof of its lawfulness.

14.11 Lifecycle Notifications (§§ 327f, 327r BGB)

When we make material updates to the Studio Library or changes to your Studio Pass, we notify you by email and via an in-app notice. We process your member ID, your email address and the reference to the changed material or the announced Pass change. When the Provider announces a Pass change, we also display a notice banner through which you may end your Pass at the end of the billing period if you wish; whether you have dismissed this notice is stored as a yes/no marker so the banner does not reappear.

Legal basis: Art. 6(1)(c) GDPR in conjunction with §§ 327f, 327r BGB (the Provider's legal obligation towards consumers in respect of digital products).

Storage location: with our hosting provider Cloudflare (see section 4).

Storage period: the associated notification entry is deleted, like all notifications, 90 days after it is read (see section 14.6); the banner marker for the lifetime of the account. The Provider's audit entry contains no personal recipient data (only a recipient count) and is retained to meet the record-keeping obligation.

15. Studio Live Sessions and Atelier Recordings

15.1 Live Sessions in the Studio

Pass members may participate in Studio Hours (live format with the Provider). Atelier classes meet in regular live sessions. In both cases, video and audio streams are transmitted via Cloudflare Stream or Cloudflare Realtime (see section 4).

Data collected when joining live: IP address for the real-time connection, your Studio display name and avatar.

Chat processing in Studio live sessions: during live sessions, members may communicate via text chat. This runs on the same chat infrastructure as described in section 5; the deviation is that authentication is tied to your Studio account.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

15.2 Recording of Live Sessions

Atelier live sessions are recorded by the Provider and made permanently available to the respective Atelier class or alumni. Studio Hours are recorded according to the respective season or format description.

Only the Provider's stream is recorded (image and audio). Image and audio data of participants are not part of the recording; participants' contributions during the session take place exclusively via text chat and are not recorded with the session. Since no participant likeness within the meaning of § 22 KunstUrhG is captured, no separate likeness consent of the participants is required.

Legal basis for the recording: Art. 6(1)(b) GDPR (performance of the Atelier Season contract; provision of the recording to class and alumni is part of the season service).

Recording prohibition for participants: independent recordings, copies or transfers by participants are prohibited (Terms § 19.2).

Storage location: Cloudflare Stream (routing in Western Europe).

Storage period: indefinite, until actively deleted by the Provider. The Provider periodically reviews whether older recordings are still serving their purpose.

15.3 Confidentiality of Class Recordings

Recordings of an Atelier Season are by default made available only to the members of the respective Atelier class and their alumni. Because the recording contains exclusively the Provider's own image and audio (participants interact only via the text chat, see above), the Provider may, at its own discretion, make individual recordings of regular sessions available more broadly — for example to Pass members via the reduced access to an archived season (materials and Q&A areas) or publicly as sample material. Excluded from this are recordings of critique sessions (which show participants' work) as well as submissions, feedback and Drawing Room contents: these remain at all times exclusively reserved for the respective Atelier class and their alumni and are never made available beyond the class — not to Pass members or publicly.

16. Storage Periods at a Glance

For an overview, a summary table. In case of conflict, the specific provisions in the sections above prevail.

Data categoryStorage periodLegal basis
Invoice data, accounting records10 years (§ 257 HGB, § 147 AO)Art. 6(1)(c)
Newsletter consent records after unsubscription3 yearsArt. 6(1)(c) (duty of proof)
Member consents after account deletion3 yearsArt. 6(1)(c)
Applications (rejected / withdrawn)6 months after application deadlineArt. 6(1)(b)/(f)
Auth codes (magic link / OTP)15 min TTL, max. 24 hoursArt. 6(1)(f)
Auth sessionssliding 90 days after last useArt. 6(1)(f)
In-app notifications90 days after being readArt. 6(1)(b)
Worker error logsmax. 7 daysArt. 6(1)(f)
Reach-measurement single eventsmax. 12 monthsArt. 6(1)(f)
Member profiles + community contentaccount lifetime; thereafter anonymisationArt. 6(1)(b)
Atelier recordings (Provider stream)indefinite, periodically reviewedArt. 6(1)(b)
Live-chat IPs (Gallery)until end of session, max. last 100 messagesArt. 6(1)(f)

17. Changes to This Privacy Policy

(1) This Privacy Policy is adapted by the Provider when this becomes necessary due to changed processing operations, new service providers, changed legal conditions or supreme court case law. The current version is available at daria.gallery/datenschutz.

(2) Information updates without consent relevance (e.g. new sub-processor with DPF/SCC, changed storage period, editorial clarification) are proactively shown to members registered in the Studio by email and as a banner at the next login. Renewed confirmation is not required; continued use remains possible at any time.

(3) Consent-relevant updates (in particular new consent-based processing, new sub-processors in third countries without DPF/SCC, expansion of processing purposes beyond the agreed scope) require renewed active confirmation of members before the affected processing continues to cover them. Existing memberships remain active in the parts not affected by the change.

(4) Editorial or clarifying changes without effect on processing take effect without separate notification; the version date above is updated accordingly.

Version: 1 June 2026