Privacy Notice

1. Controller

The Picture Burrow VZW

Bruulstraat 22, 3071 Erps-Kwerps

1005.088.462 (BCE/KBO) – BE 1005.088.462

Email: scheurweghs_julie@hotmail.com

Website: www.thepictureburrow.com

2. Categories of Personal Data

- Identification and contact data (name, address, email, phone)

- Order and transaction data (purchases of artworks/books, payment confirmations)

- Delivery data (delivery address, courier tracking information)

- Newsletter data (email address, optional name, subscription preferences, interaction statistics)

- Website usage and analytics data (via Squarespace Analytics)

- Server logs (IP address, browser type, access times, pages visited)

3. Purposes and Legal Bases

- Sales and order fulfilment: performance of a contract (Art. 6(1)(b) GDPR)

- Invoicing and accounting: compliance with legal obligations (Art. 6(1)(c) GDPR)

- Newsletter and marketing communications: consent (Art. 6(1)(a) GDPR)

- Website analytics and improvement: legitimate interest in understanding and improving our services (Art. 6(1)(f) GDPR)

- IT security, fraud prevention and access logs: legitimate interest (Art. 6(1)(f) GDPR)

4. Recipients and Processors

Personal data may be shared with:

- Squarespace (website hosting and analytics)

- Squarespace Payments / Stripe (payment processing)

- Mailchimp (newsletter management)

- OneTrust (cookie consent management)

- Logistics providers (for delivery of artworks/books)

These entities act as controllers, processors or sub-processors and when they are processors or sub-processors, process data on our documented instructions.

5. International Transfers

Some processors (such as Stripe and Mailchimp) are located outside the European Economic Area, in particular in the United States.

Where this is the case, we rely on appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission, and additional technical and organizational measures where deemed necessary after having considered the legal framework for the protection of personal data in the countries of the exporters.

6. Retention Periods

- Transaction and invoicing data: kept for the duration required by Belgian accounting and tax law (normally 7–10 years)

- Newsletter data: kept until you unsubscribe or withdraw consent

- Website analytics and logs: kept for limited periods according to technical needs and the configuration of Squarespace

7. Your Rights

You have the right to request access to your personal data, rectification, erasure, restriction of processing, data portability and to object to processing in certain cases.

When processing is based on your consent, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Requests may be sent to: scheurweghs_julie@hotmail.com. We will honour those requests as soon as practically possible.

8. Complaints

You have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit) if you believe that your rights have been infringed or if you are dissatisfied by the way we process your personal data.