PRIVACY POLICY

 

 

Last updated: 15 September 2026

 

This Privacy Policy explains how ATLANTA WEISS, trading as Atlanta Weiss and Art Wisdom Education (“we”, “us”, “our”), collects, uses, stores and protects personal information when you interact with our websites, forms, emails, products, services and checkouts.

This includes, where applicable:

• Atlanta Weiss Studio (AW) — fine art, artworks, portrait commissions, Portrait Letter Club and related collector services;
• Art Wisdom Education (AWE) — educational resources, digital products, templates, guides, newsletters and related services;
• forms, landing pages, emails, products and checkout pages hosted through Flodesk.

Data Controller

Correspondence address / Postanschrift:
Atlanta Weiss
Postfach 72 02 02
50757 Cologne
GERMANY

Address for service of legal documents / Ladungsfähige Adresse:
Atlanta Weiss
c/o Postflex PFX-174-085
Emsdettener Str. 10
48268 Greven
GERMANY

 

Email: [email protected]

Websites: https://atlantaweiss.art
https://education.atlantaweiss.art

 

For the purposes of the General Data Protection Regulation (“GDPR”), we are the data controller where we determine why and how your personal data is processed.

 

1. INFORMATION WE MAY COLLECT

 

Depending on how you interact with us, we may collect the following categories of personal information.

Identity and contact information

This may include:

• name;
• email address;
• postal or shipping address;
• city and country;
• telephone number, where provided;
• business or professional information.

Information you provide through forms or enquiries

This may include information you voluntarily provide when:

• making a portrait or artwork enquiry;
• requesting a consultation;
• joining a waitlist;
• subscribing to Studio Notes or AWE communications;
• downloading a resource;
• completing a questionnaire;
• requesting support;
• contacting us about a product or service.

For portrait commissions, for example, this may include information about who the portrait is for, your preferred medium or Portrait Experience, timeframe, location, privacy preferences and the personal context or story you choose to share.

Please avoid sending sensitive personal information unless it is genuinely necessary for your request.

If you provide personal information about another person, you should ensure that you are entitled to provide that information to us.

 

Purchase and transaction information

When you purchase a product or service, we may process:

• name;
• billing and shipping information;
• products or services purchased;
• purchase amount;
• tax or VAT information;
• order and transaction status;
• refund or dispute information;
• related customer-service correspondence.

Payment information is processed through payment providers such as Stripe. Stripe may act as a processor and, for some activities such as fraud prevention and regulatory compliance, as an independent controller.

We do not normally receive or store your complete payment-card details.

 

Subscription and marketing information

This may include:

• email address;
• subscription status;
• the form or source through which you subscribed;
• marketing consent records;
• interests or segments;
• unsubscribe history;
• email engagement information where tracking is enabled and legally permitted.

Technical information

Depending on the platform and service used, information may include:

• IP address;
• browser type;
• device information;
• operating system;
• date and time of interaction;
• referring page;
• technical identifiers;
• information about how forms, pages or emails are used.

2. WHY WE PROCESS YOUR PERSONAL INFORMATION

 

We process personal information only where we have a lawful reason to do so.

To respond to enquiries and take steps before entering into a contract

For example:

• reviewing a portrait commission enquiry;
• discussing an artwork purchase;
• responding to a service request;
• preparing a proposal;
• arranging a consultation.

For individuals in the EEA, the legal basis is generally Article 6(1)(b) GDPR — taking steps at your request before entering into a contract.

To fulfil a contract or purchase

We use personal information to:

• process and fulfil orders;
• deliver digital products;
• provide commissioned artwork or services;
• manage subscriptions;
• arrange delivery or shipping;
• provide customer support;
• administer payments, refunds or contractual communications.

The legal basis is generally Article 6(1)(b) GDPR — performance of a contract.

To comply with legal obligations

We may process and retain information where required for:

• accounting;
• tax;
• invoicing;
• fraud prevention;
• legal record keeping;
• responding to lawful requests from authorities.

The legal basis is generally Article 6(1)(c) GDPR — compliance with a legal obligation.

To send marketing communications

Where required by law, we send newsletters, promotional emails and marketing communications only after you have provided appropriate consent.

The legal basis is generally Article 6(1)(a) GDPR — consent.

You may withdraw your consent at any time by using the unsubscribe link contained in our emails or by contacting us.

Withdrawing consent does not affect processing that occurred lawfully before withdrawal.

To operate, secure and improve our business

We may process limited information where necessary for legitimate business purposes including:

• protecting our systems;
• preventing fraud or misuse;
• maintaining records;
• improving customer service;
• analysing the general performance of products, forms and communications;
• establishing, exercising or defending legal claims.

Where applicable, the legal basis is Article 6(1)(f) GDPR — our legitimate interests, balanced against your rights and interests.

 

3. MARKETING CONSENT IS SEPARATE FROM A PURCHASE OR ENQUIRY

 

Submitting an enquiry, purchasing a product or commissioning artwork does not automatically mean that you have agreed to receive marketing emails.

For example, a person who submits a private portrait enquiry may receive communications necessary to respond to that enquiry without being added automatically to Studio Notes or another marketing list.

Where we invite you to subscribe to marketing communications, this is presented separately.

You can unsubscribe from marketing communications at any time.

Consent under the GDPR must be freely given, specific, informed and unambiguous.

 

4. PRIVATE PORTRAIT AND COLLECTOR ENQUIRIES

 

Information provided through a private portrait, artwork or collector enquiry is used to evaluate and respond to your request and, where relevant, to prepare or fulfil a commission.

We do not treat a private commission enquiry as permission to use your personal story for marketing.

Information, photographs, identifying details or the existence of a private portrait commission are not published by Atlanta Weiss Studio without separate permission where such permission is required.

Some clients choose to allow selected artwork or commission details to be exhibited or published. Others prefer complete confidentiality.

Both are respected.

 

5. EMAIL COMMUNICATIONS AND EMAIL ANALYTICS

 

We use Flodesk to manage forms, subscriber information, email communications, workflows and, where applicable, products and checkout functions.

Flodesk may process subscriber information on our behalf as a data processor. Under Flodesk's current Data Processing Addendum, the Flodesk customer acts as controller and Flodesk acts as processor for personal data processed to provide its services.

Where enabled and legally permitted, email analytics may include information such as:

• whether an email was delivered;
• whether it was opened;
• whether a link was clicked;
• date and time of interaction;
• IP address or approximate location;
• browser or device information.

Flodesk currently uses tracking technologies for email opens and clicks.

Where applicable law requires consent for such tracking, we will rely on the appropriate legal basis and available technical controls.

 

6. PAYMENTS

 

Payments made through Flodesk Checkout are processed using Stripe. Flodesk currently uses Stripe to enable payment transactions through its checkout services.

Stripe may process information including:

• name;
• email address;
• billing information;
• payment-method information;
• transaction details;
• device or IP information;
• information required for fraud prevention and legal compliance.

Stripe's own privacy practices also apply to the information it processes.

 

7. SERVICE PROVIDERS

 

We may use trusted service providers to operate our business.

Depending on the particular product or service, these may include providers for:

• email marketing and forms;
• payment processing;
• website hosting;
• ecommerce;
• cloud storage;
• file delivery;
• print production and fulfilment;
• analytics;
• accounting;
• professional advisory services.

Current providers may include, where relevant:

• Flodesk;
• Stripe;
• Google / Google Workspace;
• Showit;
• Shopify;
• WhiteWall.

These providers receive only the information reasonably necessary for the relevant service and process information subject to their respective contractual and legal obligations.

We do not sell our subscriber, collector or customer lists to data brokers.

 

8. INTERNATIONAL DATA TRANSFERS

 

Some of our service providers are located outside Germany or the European Economic Area, including in the United States.

This means that personal information may be transferred to or processed in countries outside the EEA.

Where required, appropriate safeguards are used for such transfers.

Flodesk states in its current Data Processing Addendum that personal information may be stored or processed outside the European Union and that relevant transfers are protected through mechanisms including the EU Standard Contractual Clauses and, where applicable, recognised Data Privacy Framework mechanisms.

 

9. COOKIES AND SIMILAR TECHNOLOGIES

 

Our websites, embedded forms and service providers may use cookies or similar technologies.

Some technologies are strictly necessary to provide a service requested by you.

Optional analytics, marketing or advertising technologies are used only where permitted by applicable law and, where required, after obtaining consent.

Under German law, storing information on or accessing information from a user's device generally requires consent unless the technology is strictly necessary for transmitting a communication or providing a service expressly requested by the user.

Where third-party marketing tools such as advertising pixels are enabled, additional information and choices should be provided through the relevant consent mechanism.

 

10. HOW WE SHARE PERSONAL INFORMATION

 

We may disclose personal information only where reasonably necessary, including:

• to service providers acting on our behalf;
• to payment and financial-service providers;
• to professional advisers such as accountants, lawyers or tax advisers;
• to shipping, fulfilment or production partners where necessary to complete an order;
• where required by law or a lawful authority;
• where necessary to establish, exercise or defend legal claims;
• where you have specifically authorised the disclosure.

We do not disclose private portrait or collector information publicly merely because you have submitted an enquiry or purchased a service.

 

11. DATA RETENTION

 

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for any applicable legal obligations.

In general:

 

Marketing subscribers
Information is retained while you remain subscribed or until it is no longer reasonably necessary. We may retain minimal suppression information after unsubscribing so that we can respect your request not to receive further marketing.

 

Enquiries
Unsuccessful or inactive enquiries may generally be retained for up to approximately 24 months, unless there is a continuing relationship, a legal reason to retain the information, or you request earlier deletion where applicable.

 

Customers and purchases
Contractual, invoicing and transaction information may be retained for the applicable statutory commercial and tax retention periods.

 

Collectors and artworks
Limited records may be retained for longer where reasonably necessary to document artwork authenticity, edition history, provenance, contractual rights or the history of a commission.

When information is no longer required, it is deleted, anonymised or otherwise securely disposed of where reasonably practicable.

 

12. YOUR DATA PROTECTION RIGHTS

 

Depending on applicable law, you may have rights including:

• the right to be informed about how your information is used;
• the right to access your personal information;
• the right to correct inaccurate information;
• the right to request deletion;
• the right to request restriction of processing;
• the right to data portability where applicable;
• the right to object to certain processing;
• the right to object to direct marketing at any time;
• the right to withdraw consent at any time where processing is based on consent.

These are core rights available under the GDPR, subject to the conditions and exceptions provided by law.

To exercise your rights, contact: [email protected]

We may need to verify your identity before fulfilling certain requests.

 

13. RIGHT TO LODGE A COMPLAINT

 

If you are located in the European Economic Area, you also have the right to lodge a complaint with a competent data-protection supervisory authority.

You may generally contact the authority in:

• the country or region where you live;
• the place where you work; or
• the place where the alleged infringement occurred.

If our principal establishment is in North Rhine-Westphalia, Germany, the relevant German supervisory authority is generally the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

 

14. AUTOMATED PROCESSING AND SEGMENTATION

 

We may organise contacts into segments according to factors such as:

• the form through which you subscribed;
• interests you expressed;
• purchases;
• interactions with our products or communications.

This helps us provide more relevant information.

We do not use solely automated decision-making that produces legal or similarly significant effects on individuals.

 

15. INFORMATION CONCERNING CHILDREN

 

Our marketing lists and educational products are intended for adults.

Portrait commissions may include children or family members. Where personal information about a child is provided in connection with a commission, it should be provided by a parent, guardian or other person who is appropriately authorised to do so.

 

16. SECURITY

 

We take reasonable technical and organisational measures designed to protect personal information against accidental or unlawful:

• loss;
• destruction;
• alteration;
• unauthorised access;
• disclosure.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

 

17. LINKS TO OTHER WEBSITES

 

Our websites, emails, forms or products may contain links to third-party websites.

Once you leave our services, the privacy practices of the relevant third party apply.

We encourage you to review the privacy information provided by those services.

 

18. CHANGES TO THIS PRIVACY POLICY

 

We may update this Privacy Policy from time to time to reflect changes in our services, technologies, providers or legal requirements.

The current version will display its most recent update date.

Material changes will be communicated where required by applicable law.

 

19. CONTACT

 

For privacy-related questions or requests, contact: Atlanta Weiss
Trading as Atlanta Weiss Studio and Art Wisdom Education

 

Correspondence address / Postanschrift:
Atlanta Weiss
Postfach 72 02 02
50757 Cologne
GERMANY

Address for service of legal documents / Ladungsfähige Adresse:
Atlanta Weiss
c/o Postflex PFX-174-085
Emsdettener Str. 10
48268 Greven
GERMANY
 

Email: [email protected]

Websites: https://atlantaweiss.art
https://education.atlantaweiss.art