PRIVACY POLICY

I. Controller and scope

The controller of fannysanimalportrait.com is Fine Art 23 s. r. o.; registered office: Nová Vieska 243, 943 41 Nová Vieska, Slovakia; company ID (IČO): 55 229 883; EU VAT number: SK2121930393; email: fannysanimalportrait@gmail.com (the “Controller”).

Processing is governed by Regulation (EU) 2016/679 (GDPR), Slovak Act No. 18/2018 on Personal Data Protection and other applicable EU and Slovak law. This notice covers browsing, enquiries, orders, image uploads and newsletter subscriptions.

Effective: 5 September 2026 | Version: 1.1.

II. Data, purposes, legal bases and retention

Web server and security logs

The website and hosting environment may log the requested URL, IP address, access time, browser and device details, errors and security events. The purposes are secure and reliable operation, troubleshooting and abuse prevention. The legal basis is legitimate interest under Article 6(1)(f) GDPR. Logs are retained only for the period necessary for operation and security under the DotRoll contract and actual server configuration.

Cookies and consent settings

Strictly necessary technical storage may be used without consent. Analytics and external-media cookies or identifiers are activated only after the visitor gives prior, category-specific consent. Choices can be changed at any time with the “Cookie settings” button in the footer.

fap_cookie_consent – necessary; stores cookie choices for 6 months.
WordPress technical cookies – only when required for a session, security or administrator login; typically until the end of the session and, depending on login choice, no longer than 1 year.
_ga and _ga_<identifier> – Google Analytics 4 measurement cookies, up to 2 years; only after analytics consent.
Google Maps – technical identifiers and possible cookies controlled by Google; only after external media is allowed and the map is loaded.

Enquiries, orders and image uploads

The contact form processes name, email address and message. Order and voucher forms may additionally process phone number, recipient name, selected technique and size, number of pets, notes, calculated price and up to five uploaded reference photographs. Purposes are answering enquiries, providing a quotation, preparing and performing a contract, communication, invoicing and handling legal claims.

The legal basis is pre-contractual steps or contract performance under Article 6(1)(b) GDPR, or legitimate interest in responding to a general enquiry under Article 6(1)(f). Form submissions and uploaded images are automatically deleted after 6 months unless an active contract, legal claim or law requires longer retention. Accounting records covered by Section 35(3) of Slovak Accounting Act No. 431/2002 are retained for 10 years.

Only photographs the uploader is entitled to use may be uploaded. If an identifiable person appears, the uploader is responsible for obtaining any required permission.

Subscription is voluntary and based on consent under Article 6(1)(a) GDPR. The email address is stored in the WordPress database and becomes active only after double opt-in confirmation; an unconfirmed subscription is automatically deleted after 30 days. Confirmed data is retained until unsubscribe or withdrawal. The confirmation and every future newsletter must offer an unsubscribe option; unsubscribe may also be requested by email. This notice and the processor list must be updated before any bulk-email provider is introduced.

III. Processors and external services

DotRoll Kft. (1148 Budapest, Fogarasi út 3–5.; company register 01-09-882068; tax no. 13962982-2-42; support@dotroll.com) – domain, DNS, hosting, database, backup and related technical services. DotRoll acts as processor for hosted services.
Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) – Gmail mailbox and, subject to separate consent, Google Analytics 4 and Google Maps.

Google Analytics 4

Google Analytics runs only when the Controller has entered a GA4 measurement ID and the visitor has allowed analytics. It may process page views, session events, approximate location, browser and device details and a cookie-based client ID to measure use and improve the site. The legal basis is consent. The implementation disables Google Signals and ad personalisation. Event-level retention must be set to 14 months in the live GA4 property; measurement cookies may last up to 2 years. The site does not activate Google Ads or marketing tracking.

Google Maps and social media

The Google Maps iframe receives its source URL only after “external media” is allowed, so it does not contact Google beforehand. Once loaded, Google may process technical data, IP address and its own cookies or identifiers. Social icons are plain outbound links; TikTok, Instagram or Facebook opens only after a click and no tracking code from them is embedded on the site.

IV. Transfers and security

Data is not sold. Disclosure may occur to the extent required by a lawful authority or court request. DotRoll is a service provider established in Hungary within the EEA. Where a Google group company processes data outside the EEA, applicable adequacy decisions, Standard Contractual Clauses and other Chapter V GDPR safeguards used by Google apply.

The Controller protects data with access controls, HTTPS, updated WordPress components, backups, a protected upload directory and automatic deletion rules. Administrator accounts must use strong unique passwords and, where available, two-factor authentication.

V. Your rights and remedies

You may request information and access, rectification, erasure or restriction, exercise data portability, object to legitimate-interest processing and withdraw consent at any time. Send requests to fannysanimalportrait@gmail.com or the Controller’s registered office. A response is normally provided within one month.

A complaint may be lodged with the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Center II, Galvaniho 7/B, 821 04 Bratislava; email: statny.dozor@pdp.gov.sk. A person in Hungary may also contact the Hungarian National Authority for Data Protection and Freedom of Information, 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, P.O. Box 9; email: ugyfelszolgalat@naih.hu; phone: +36 1 391 1400. Judicial remedies are also available.

VI. Changes to this notice

This notice is updated when website functions, service providers or the legal environment change. A new analytics, advertising, bulk-email or other external service may be enabled only after the consent mechanism and this notice have been updated. The effective date of the published version appears at the beginning.