PRIVACY POLICY
Last updated: October 2026
The protection of your personal data is important to me. This Privacy Policy explains what personal data is processed when you visit my website and use my online shop, for what purposes this data is processed, and what rights you have under the General Data Protection Regulation (GDPR).
1. Controller
The controller responsible for the processing of personal data on this website is:
Sabrina Winnecke
Marie-Curie-Str. 20
30974 Wennigsen
Germany
Email: sabrina.winnecke@gmx.de
2. General Information on Data Processing
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, your name, address, email address, telephone number, payment information or IP address.
I process personal data only where this is necessary to provide my website, process and fulfil orders, communicate with you, ship products, comply with legal obligations, or where you have given your consent.
The processing of personal data is based, where applicable, on Article 6(1)(a), (b), (c) and (f) GDPR.
3. Hosting and Operation of the Website
My website and online shop are operated using Squarespace.
When you visit my website, Squarespace may process certain technical information necessary for the secure and proper operation of the website. This may include your IP address, date and time of access, pages visited, browser type and version, operating system and technical information about the device you use.
This processing serves in particular to provide, maintain and secure my website.
Squarespace may process personal data outside the European Economic Area (EEA). Squarespace states that, where applicable, it uses mechanisms such as the EU-U.S. Data Privacy Framework and, where required, Standard Contractual Clauses pursuant to Article 46 GDPR for international data transfers.
Further information can be found in Squarespace's privacy policy and data protection documentation.
4. Cookies
My website uses cookies and similar technologies. Cookies are small text files that may be stored on your device.
Some cookies used by Squarespace are technically necessary to ensure that the website and, in particular, the online shop, shopping cart and checkout function properly.
Where technically non-essential cookies or similar technologies are used on my website, they will only be used in accordance with applicable legal requirements and, where required, on the basis of your consent.
You can control the use of cookies through your browser settings. However, disabling necessary cookies may result in certain functions of the online shop not working properly or being available only to a limited extent.
5. Visiting the Website
Whenever you access my website, technical connection data may be processed that your browser automatically transmits to the server.
This may include:
IP address
date and time of access
pages and content accessed
referring URL
browser type and version
operating system
technical information about your device
This processing is carried out where necessary to provide the website securely and reliably and to detect and prevent misuse or attacks.
The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of my website.
6. Orders and Online Shop
When you purchase an artwork or another product through my online shop, I process the information necessary to process and fulfil your order.
This may include:
first and last name
billing and shipping address
email address
telephone number, where provided
products ordered
order and invoice details
payment information or information concerning the payment status
The processing is necessary for the performance of the purchase contract pursuant to Article 6(1)(b) GDPR.
Order data is also processed where necessary to comply with legal obligations, in particular tax and commercial record-keeping requirements. The legal basis for this processing is Article 6(1)(c) GDPR.
Squarespace processes the data required for order processing as the provider of my online shop platform.
7. Payment Processing with Squarespace Payments
I use Squarespace Payments to process payments.
Depending on the payment method you select, payment and transaction information may be processed. Squarespace Payments uses Stripe, among others, to process payments. Sift is also used for fraud prevention and the detection of suspicious transactions.
Squarespace states that Stripe and Sift may also receive personal data and process it in accordance with their respective privacy policies.
The processing is necessary for the performance of the purchase contract pursuant to Article 6(1)(b) GDPR and, where applicable, for compliance with legal obligations pursuant to Article 6(1)(c) GDPR.
8. Shipping and Delivery
To fulfil your order, I provide the personal data necessary for delivery to the shipping provider used for your order.
Depending on the destination and shipping method, these may include:
DHL
Hermes
FedEx
GLS
DPD
The information provided may include your name and delivery address and, where necessary for delivery, your email address or telephone number.
The processing is necessary for the performance of the purchase contract pursuant to Article 6(1)(b) GDPR.
The respective shipping providers process the information in accordance with their own privacy policies.
9. Contact Form and Communication
If you contact me using the contact form or by email, I process the information you provide, in particular your name, email address and the content of your message.
This processing is carried out to process and respond to your enquiry.
If your enquiry relates to the initiation or performance of a contract, the legal basis is Article 6(1)(b) GDPR. In other cases, processing is based on Article 6(1)(f) GDPR, with my legitimate interest being to respond to your enquiry. Where consent is required, processing is based on Article 6(1)(a) GDPR.
The information you provide will be deleted once your enquiry has been conclusively dealt with, unless statutory retention obligations or other legitimate reasons require further storage.
10. Newsletter and Email Marketing
If you subscribe to my newsletter, I use your email address to send you information about my art, new works, offers and other information relating to my business.
I use Squarespace Email Marketing to send my newsletter.
You will only receive the newsletter if you have previously given your consent. The legal basis is Article 6(1)(a) GDPR.
You can withdraw your consent at any time with effect for the future by using the unsubscribe link contained in each newsletter.
After unsubscribing, your email address will no longer be used to send marketing emails unless there is another legal basis for further processing.
11. Instagram
My website may include content or functions provided by Instagram.
When you visit a page containing such an integration, Instagram or Meta may receive information about your visit. Depending on the type of integration, this may include your IP address, technical information and information about the content accessed.
Instagram/Meta processes such information in accordance with its own privacy policies.
Where consent is required for the relevant integration, processing will only take place after the required consent has been obtained.
I have no complete control over the data processed by Instagram or Meta in connection with such integrations.
12. International Data Transfers
Because I use Squarespace and other service providers for payment processing, shipping and, where applicable, third-party integrations, personal data may in certain circumstances be processed outside the European Economic Area.
Where such transfers take place, they are carried out in accordance with the requirements of Articles 44 et seq. GDPR.
Squarespace states that it uses mechanisms including the EU-U.S. Data Privacy Framework and, where required, Standard Contractual Clauses for certain international transfers.
13. Data Retention
I retain personal data only for as long as necessary for the respective purpose.
In addition, statutory retention obligations may apply. In particular, certain commercial and tax records must be retained for several years.
Once the applicable retention period has expired, the data will be deleted unless another legal basis or legitimate interest requires continued storage.
14. Data Security
I take appropriate technical and organisational measures to protect your personal data against loss, destruction, manipulation, unauthorised access and other forms of unauthorised processing.
Where technically supported, personal data transmitted through my website is protected using encrypted SSL/TLS connections.
15. Your Rights
Subject to the applicable legal requirements, you have the following rights:
Right of access
You have the right to request information about whether personal data concerning you is being processed and, if so, which data.
Right to rectification
You have the right to request the correction of inaccurate personal data or completion of incomplete personal data.
Right to erasure
You may request the deletion of your personal data under the conditions set out by law.
Right to restriction of processing
Under certain circumstances, you may request that the processing of your personal data be restricted.
Right to data portability
Where the legal requirements are met, you have the right to receive personal data that you have provided to me in a structured, commonly used and machine-readable format.
Right to object
You may object to the processing of your personal data where the legal requirements for doing so are met.
Right to withdraw consent
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
To exercise any of these rights, you can contact me at:
Sabrina Winnecke
Marie-Curie-Str. 20
30974 Wennigsen
Germany
Email: sabrina.winnecke@gmx.de
16. Right to Lodge a Complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.
The supervisory authority generally responsible for me is:
The State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen – LfD Niedersachsen)
You may also contact another competent supervisory authority, in particular the authority in the country or region where you normally live or work, where permitted by law.
17. Changes to this Privacy Policy
I reserve the right to amend this Privacy Policy if my website, the services I use or applicable legal requirements change.
The current version published on this website shall apply.
Last updated: October 2026