Privacy notice
Controller and contact
The data controller is Hasret Sun, Italy. Contact hasretsunn@outlook.com for information or to exercise your rights. This notice applies to hasretsun.com.
Personal data
The form collects your name, email, enquiry type and message. Delivery country, dimensions and budget are optional. Your chosen language is also sent. The site and technical providers may process IP address, browser information, timestamps and request data to operate and secure the service. Please do not include health data or other sensitive information.
Purposes and legal bases
Data is used to answer enquiries, provide quotations and discuss commissions: steps taken at your request before entering a contract (GDPR Article 6(1)(b)). Other correspondence and website security rely on legitimate interests in managing contacts and preventing abuse (Article 6(1)(f)); legal obligations rely on Article 6(1)(c). Sending you a copy is part of handling your enquiry. Your data is not used for newsletters or advertising.
Providing your data
Using the form is optional. Name, email and message are necessary to handle and send the enquiry. You may contact Hasret directly by email instead. The message is forwarded to the controller’s Outlook mailbox and a copy is sent to your entered address. Enquiries are stored privately in the Studio to manage contacts, quotations and commissions. The website temporarily keeps a copy to complete the transfer to the Studio; after transfer, the message and contact details are removed from this copy. There is no profiling or automated decision-making.
Recipients and providers
The controller and providers needed to operate the service may access data: OpenAI/ChatGPT Sites for hosting, Cloudflare for delivery and security, Resend (Plus Five Five, Inc.) for email delivery, and Microsoft/Outlook for the mailbox. Authorised persons or authorities may access data when legally required. Data is not made public. Providers act under the roles and terms of their respective services.
International transfers
Providers’ infrastructure may involve processing outside the European Economic Area, including in the United States. Safeguards are governed by providers’ terms and GDPR Chapter V, including standard contractual clauses or adequacy decisions where applicable. Resend includes standard contractual clauses in its data processing agreement. A European sending region does not mean that all processing takes place only in Europe. Contact the controller for information on safeguards.
Retention
Enquiries that do not become orders are kept in the private Studio and the controller’s mailbox for 12 months after the last contact, then deleted by the controller. For orders, data is kept as needed for the relationship, legal obligations and protection of legal rights. Resend states that email and log data is retained for 30 days on Free, Pro and Scale plans. Other technical logs follow providers’ retention periods and security requirements.
Your rights
Where the GDPR applies, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. Contact hasretsunn@outlook.com. You may complain to the Italian data protection authority (garanteprivacy.it) or your competent local supervisory authority.
External services and changes
Instagram is an external link, with no embedded content. Its own notice applies when you open it. This notice will be updated if the website’s features or processing change.