The data controller is:

• Evgeniia Efimova, trading as Elanic Gallery
• Tax identification number (NIE): Z4320574Y
• Address: Carrer de Casteras 9, 08028 Barcelona, Spain
• Email: contact@elanic.gallery
• Telephone: +34 661 573 116

We have not appointed a Data Protection Officer, as we are not required to do so. Please direct all data protection enquiries to the email address above.

Data you give us:

• Name and surname
• Email address
• Telephone number
• Postal and delivery address
• Alternative contact details you choose to provide (Instagram, Telegram, WhatsApp)
• Order contents, gift messages and comments
• Correspondence you send us

Payment data. We do not store or have access to your full card details. Payments are processed directly by our payment providers, who act as independent controllers for the payment transaction. We receive only confirmation of payment, the last four digits of the card, and the billing details necessary to issue your invoice.

Data collected automatically:

• IP address, browser type and version, operating system, device identifiers, screen resolution
• Internet service provider, referring and exit pages, date and time stamps, pages viewed
• Approximate location derived from IP address (country level)

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Every marketing email contains an unsubscribe link.

Where we rely on legitimate interests, we have assessed that our interest in operating a secure and functioning business does not override your rights and freedoms. You may object to this processing at any time.

Providing the data marked as required at checkout is necessary to conclude the contract. If you do not provide it, we cannot process your order.

We share your data only where necessary, with:

• Tilda Publishing — website and e-commerce platform
• Stripe Payments Europe, Ltd. and PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing
• Buy-now-pay-later providers (such as Klarna) — where you select that payment method
• Our production and fulfilment workshop in Tbilisi, Georgia — to pack and dispatch your order
• Postal operators and courier companies — to deliver your order and provide tracking
• Customs authorities — where required for import and export declarations
• Our accountant and tax advisers in Spain — for invoicing and statutory reporting
• Email and analytics providers — for communications and site statistics

We do not sell your personal data, and we do not share it for the independent marketing purposes of third parties.

Your delivery details are transferred to Georgia, where our production and fulfilment workshop is located, so that your order can be packed and dispatched.

Georgia is not covered by a European Commission adequacy decision. This transfer is necessary for the performance of the contract between you and us, and is made on the basis of Article 49(1)(b) GDPR. Where a transfer to Georgia falls outside that basis, it is governed by the European Commission's Standard Contractual Clauses.

Some of our service providers may process data in the United States or other countries outside the European Economic Area. Where they do, transfers are covered by an adequacy decision, by Standard Contractual Clauses, or by another lawful transfer mechanism.

You may request a copy of the safeguards in place by writing to contact@elanic.gallery.

• Order and invoicing records: six years from the end of the financial year, as required by Spanish commercial and tax law
• Correspondence: up to three years from the last contact
• Marketing contact details: until you withdraw consent or ask to be removed
• Analytics data: as set out in our cookie information, and in any case no longer than 24 months
• Data needed to establish, exercise or defend legal claims: until the relevant limitation period expires

After these periods, data is deleted or irreversibly anonymised.

We use cookies and similar technologies. Some are strictly necessary for the site and your cart to function; these do not require consent. Others are used for analytics and for advertising measurement, and are placed only if you accept them through our cookie banner.

You may change or withdraw your cookie preferences at any time through the cookie settings link on our site, and you may also block or delete cookies through your browser settings.

Disabling strictly necessary cookies may prevent parts of the site from working.

Under the GDPR you have the right to:

1. Access — obtain confirmation of whether we process your data and receive a copy of it
2. Rectification — have inaccurate data corrected and incomplete data completed
3. Erasure — have your data deleted where one of the grounds in Art. 17 GDPR applies
4. Restriction — have processing limited in the circumstances set out in Art. 18 GDPR
5. Portability — receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller
6. Object — object to processing based on our legitimate interests, and to direct marketing at any time
7. Withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, write to contact@elanic.gallery. We will respond within one month; this may be extended by two further months for complex requests, in which case we will tell you. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

Right to complain. If you believe we have not handled your data properly, you may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the supervisory authority of your country of residence.

If you are a California resident, you may request disclosure of the categories and specific pieces of personal data we have collected about you, request deletion of that data, and opt out of any sale of your personal data. We do not sell personal data. To make a request, write to contact@elanic.gallery.

Our products and website are not directed at children. We do not knowingly collect personal data from children under the age of 14, which is the minimum age of valid consent under Spanish data protection law. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or alteration. Our site uses encrypted connections (HTTPS), and card data is encrypted in transit and handled exclusively by our payment providers. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

We may update this policy to reflect changes in our practices or in the law. The current version is always available on this page, with the date of last update at the top. Where changes are significant, we will notify you by email or by a prominent notice on the site.