Privacy Policy

1. Controller and Contact

The controller responsible for the processing described in this Privacy Policy is:

Natalia Griva
GRIVAS & JO – Business Automation & Consulting
Vienna, Austria
Email: info@grivasjo.com

If you have questions about this Privacy Policy or the processing of your personal data, or if you wish to exercise your data-protection rights, please contact GRIVAS & JO at the email address above.

2. Overview of Processing Activities, Purposes, Legal Bases and Retention

GRIVAS & JO processes personal data only where there is a lawful basis for doing so. Depending on the activity, the principal purposes and legal bases are:

• Operating and securing the website: technical delivery, security, abuse prevention and troubleshooting, based on the legitimate interests of GRIVAS & JO in providing a secure and reliable website under Article 6(1)(f) GDPR.
• Responding to enquiries: responding to contact-form submissions and email enquiries, based on steps taken at your request before entering into a contract under Article 6(1)(b) GDPR or, for general enquiries, the legitimate interest in responding to communications under Article 6(1)(f) GDPR.
• Providing Consulting, Private Trainings and Workshops: arranging, administering and delivering requested services, based on Article 6(1)(b) GDPR.
• Managing Art Gallery orders and physical artwork sales: processing collection-only Order Requests and online checkout, customer and billing details, payment information, artwork quantities, Pickup or Delivery arrangements, shipping and physical-receipt confirmations, customer communications, cancellations, statutory withdrawals, returns and related records, based on Article 6(1)(b) GDPR and, where applicable, Article 6(1)(c) and Article 6(1)(f) GDPR.
• Billing, accounting and legal compliance: issuing and retaining invoices and credit notes, recording payments and refunds, and maintaining legally required business records, based on Article 6(1)(c) GDPR.
• Establishing, exercising or defending legal claims: preserving relevant contractual, transaction, collection and delivery, withdrawal, return, communication and audit evidence, based on Article 6(1)(f) GDPR.
• Newsletter marketing: sending the GRIVAS & JO Automation Brief and/or the GRIVAS & JO Art List after double opt-in, based on consent under Article 6(1)(a) GDPR.
• Website assistant: answering questions about GRIVAS & JO information and services, based on the legitimate interest in helping visitors find relevant information under Article 6(1)(f) GDPR.

Personal data is retained according to the criteria described in the relevant sections and in Section 14. A stated statutory or minimum retention period is not an automatic deletion date. Section 14 distinguishes the retention periods set by GRIVAS & JO from the technical deletion functions that currently exist.

3. Website Visits, Cookies and Similar Technologies

3.1 Server and security logs

When you access the website, technical information is processed so that the website can be delivered securely and reliably. This may include:

• IP address;
• browser and device information;
• date and time of access;
• requested pages and resources; and
• technical, routing and security log data.

This processing is necessary for website delivery, security, bot protection, abuse prevention and troubleshooting. It is based on the legitimate interests of GRIVAS & JO in operating a secure and functioning website under Article 6(1)(f) GDPR.

To protect forms, order look-ups and the website assistant against abuse, the server also records short-lived request counters. Each counter contains only the type of request, a one-way code derived from the IP address and a server secret, and the time. The IP address itself is not stored. Counters are used only to limit excessive requests. Counters more than 24 hours old are eligible for automatic cleanup during subsequent requests; cleanup is opportunistic rather than a guaranteed deletion at exactly 24 hours.

3.2 Cookie settings and consent records

When you first visit the website, you can choose Accept All, Reject All or Customize for optional technologies. Necessary technologies remain active because the website cannot operate securely without them. Statistics and Marketing are off unless you choose to allow them.

You can change or withdraw your choice at any time through Cookie Settings at the bottom of every page. A change applies to future processing. Your choice is stored in your browser's local storage together with the date and the consent-mechanism version. You are asked again after 12 months or when the consent mechanism changes materially.

To demonstrate consent and withdrawal, GRIVAS & JO also keeps a pseudonymous consent record containing a random consent ID, a one-way hash of a secret held on your device, the categories selected, the consent-mechanism version, the action taken and the time. It does not contain your name, email address or IP address. Each change creates a new record. Consent records are retained for a maximum of 36 months after the latest choice associated with that consent ID and are then automatically deleted, unless a specific legal hold requires continued retention. The legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR. The 36-month period is subject to legal review.

3.3 Strictly necessary technologies

These technologies do not require consent because they are necessary to provide, secure or administer the website:

• `__cf_bm` cookie — Cloudflare security and bot protection; normally expires after 30 minutes.
• `__dpl` cookie — a technical hosting/deployment cookie observed on the website, supporting website delivery and deployment handling. Its exact expiry is still being confirmed with the hosting provider.
• `gj_consent` local-storage entry — stores your consent categories, date, consent-mechanism version and the pseudonymous consent credentials required to record later changes; retained for up to 12 months.
• Administrator sign-in storage — keeps an authorised administrator signed in to the protected administration area; it is not used for ordinary visitors and remains until expiry or sign-out.
• Payment technologies (Stripe and hCaptcha) — loaded only when you open the payment form; see Section 3.8.

Website fonts are self-hosted, and the website does not request fonts from Google Fonts.

3.4 Statistics: Gallery referral source

If you arrive at the Art Gallery through a Gallery Referral QR code or referral link and have allowed Statistics, the website stores the validated Sales Source code and the date of that visit in your browser's local storage as `gj_gallery_ref` for up to 90 days. This allows GRIVAS & JO to understand which display location, event or referral led to an eventual order. A new valid referral replaces the previous entry and restarts the 90-day period.

If Statistics is not allowed, the validated code is kept only in the browser's memory for the current visit and can still be attached to an order submitted during that visit. Nothing is stored on your device for later visits. Withdrawing Statistics consent deletes the stored referral entry. No additional personal information, fingerprinting, advertising or cross-site tracking is used for referral attribution.

The legal basis for persistent referral storage is your consent under Article 6(1)(a) GDPR and § 165(3) TKG 2021.

3.5 Gallery Analytics without cookies or device storage

GRIVAS & JO measures use of the Art Gallery by recording artwork page views and clicks on Order & Pay and Back to Gallery. Submitted-order statistics are calculated separately from stored Gallery order records, rather than from a second visitor-tracking event. This interaction-measurement system does not use cookies or local storage and does not read from or write an identifier to your device.

For approximate daily unique-visitor counts, the server creates a one-way code from the IP address, browser information, a server secret and the current UTC date. The IP address and browser information used to create the code are not stored in the Gallery Analytics record. The resulting code changes daily and is not intended to identify a visitor across days. Because the code is derived from online identifiers, GRIVAS & JO treats the Analytics data as pseudonymised personal data rather than definitively anonymous data.

Each Analytics record contains the interaction type, artwork identifier, daily pseudonymous visitor code and time. Records are retained for a maximum of 24 months and are then automatically deleted. The deletion process is limited to Gallery Analytics records and does not delete Gallery orders, Billing records, Inventory records or other business data.

The legal basis is the legitimate interest of GRIVAS & JO in measuring and improving the Gallery under Article 6(1)(f) GDPR. You may object to this processing under Article 21 GDPR by contacting info@grivasjo.com.

Because the daily code is not linked to a name, email address, order or account, GRIVAS & JO normally cannot determine which Analytics records relate to a particular person (Article 11 GDPR). If you wish to exercise your rights, you may provide additional information, such as the date of your visit and the artwork pages viewed; GRIVAS & JO will then check whether records can be identified. Where records cannot be identified, the rights under Articles 15 to 20 GDPR do not apply to them, but your right to object and to lodge a complaint remains unaffected. Gallery Analytics does not count visits from recognised bots and crawlers.

3.6 Aggregated website statistics provided by the hosting platform

The hosting platform, Lovable, provides GRIVAS & JO with aggregated Project Insights, such as visits, viewed pages, referring sources, device categories, countries and visit duration. These statistics are produced from technical access information as part of the hosting service. GRIVAS & JO does not add a separate Google Analytics script or advertising identifier for Project Insights and sees aggregated reporting rather than visitor profiles.

The legal basis is the legitimate interest of GRIVAS & JO in operating, securing and improving the website under Article 6(1)(f) GDPR.

3.7 Marketing: Meta technologies currently inactive

The consent interface includes a Marketing category so that Meta advertising measurement can be activated later without replacing the consent system. Meta Pixel is currently inactive because no valid Meta Dataset ID has been configured. Meta Conversions API is also disabled. Therefore, the website currently does not load Meta Pixel, set Meta's _fbp or _fbc cookies, or transmit Gallery events to Meta.

If GRIVAS & JO later activates Meta Pixel, it will operate only on Art pages and only after Marketing consent. It may measure Art-page visits, views of individual artworks, clicks on Order & Pay and successfully submitted online Gallery orders. A submitted order would be reported as a Lead only after the order has been successfully created, irrespective of payment status. Payment confirmation would never be reported as a conversion. GRIVAS & JO would not send the customer's name, email address, telephone number, postal address, notes or personalisation text to Meta.

If enabled, Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland ("Meta") would process technical information such as the IP address, browser and device information, the page visited, event information and Meta cookies such as _fbp and _fbc. Meta indicates that these cookies may remain for up to 90 days. GRIVAS & JO and Meta would act as joint controllers for collection and transmission to Meta under Meta's Controller Addendum. Meta's subsequent processing would be governed by Meta's own privacy information. Transfers to Meta Platforms, Inc. in the United States may rely on its certification under the EU-U.S. Data Privacy Framework or another valid Chapter V GDPR safeguard.

If Conversions API is separately activated after technical verification and explicit approval, a successfully created online Gallery order may also be reported from the server using the same event identifier as the browser event so that Meta can deduplicate it. Before transmission, the server would verify that valid Marketing consent was recorded before the order and was not subsequently withdrawn. Missing, invalid, rejected or withdrawn consent would prevent transmission. Meta transmission failures would never prevent or reverse an order.

The legal basis for any enabled Meta processing would be consent under Article 6(1)(a) GDPR and § 165(3) TKG 2021. Consent could be withdrawn at any time through Cookie Settings. Withdrawal would stop future Meta tracking and remove Meta cookies accessible to this website, but would not affect earlier lawful processing or automatically delete information already transmitted to Meta.

3.8 Payment form technologies (Stripe, Stripe Link and hCaptcha)

Stripe's technologies are not loaded while you browse the website or the Art Gallery, regardless of your cookie choice. They are loaded only when you proceed to the online payment form at the end of checkout. At that point, Stripe's embedded payment form is loaded from Stripe's servers and the following technologies are used:

In addition, Stripe and hCaptcha receive technical device, browser and network information (such as IP address, browser characteristics and interaction signals) to detect fraud and automated abuse.

These technologies are used in connection with providing and securing the online payment you have expressly requested and to protect it against fraud, misuse of payment cards and automated abuse. They are set by Stripe and hCaptcha as part of Stripe's payment service; GRIVAS & JO does not use them for analytics, advertising or profiling, and has no access to their contents. Some of them, such as __stripe_mid, m and hmt_id, remain on your device for longer than the payment session so that Stripe can recognise repeated or suspicious payment attempts, which is part of its fraud protection. GRIVAS & JO considers these technologies strictly necessary for providing the payment service you request, within the meaning of § 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021); they are therefore used without separate consent. For this reason they load independently of the optional cookie preferences on this website: once you open the payment form they are used regardless of whether you chose Accept All, Reject All or Customize, and they are not used before you open the payment form. The legal basis for the related processing of personal data is Article 6(1)(b) GDPR (performance of the purchase) and Article 6(1)(f) GDPR (legitimate interest in secure, fraud-free payments). If you do not wish these technologies to be used, you can choose not to open the payment form; Order Requests for collection and the other contact options remain available.

Stripe Link. The payment form offers Stripe Link, Stripe's service for saving and reusing payment details. The email address you entered at checkout is passed to the payment form so that Stripe can check whether you already have a Link account. A new Link account is created only if you actively choose to save your information (this option is not preselected). Stripe acts as an independent controller for Link accounts; see Stripe's Link privacy information.

Apple Pay and Google Pay. Where your device and browser support them, the payment form may offer Apple Pay or Google Pay. If you use them, Apple or Google process your payment details under their own privacy terms.

Durations stated above were observed in a test of the payment form on 16 October 2026 and may be changed by the providers. See Stripe's Cookie Policy, Stripe's Privacy Policy and hCaptcha's Privacy Policy.

4. Contact Forms and Email Enquiries

When you use a GRIVAS & JO contact form or contact GRIVAS & JO by email, the personal data processed may include:

• your name;
• email address;
• organisation and role, where provided;
• selected area of interest;
• project, service or training information;
• your message; and
• any other information you voluntarily provide.

The information is used to review and respond to your enquiry and, where relevant, to prepare or perform requested pre-contractual steps. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to a possible contract. For general communications, the legal basis is the legitimate interest of GRIVAS & JO in responding to enquiries under Article 6(1)(f) GDPR.

The website contact form sends the enquiry by transactional email and does not create a separate contact-form record in the website database. Correspondence may nevertheless remain in business email records for as long as necessary to handle the enquiry, manage an ensuing business relationship, comply with applicable obligations, or establish, exercise or defend legal claims.

Confirmation messages for contact-form enquiries are sent through Resend. The info@grivasjo.com mailbox, in which enquiries and correspondence are received and kept, is provided through GoDaddy. The domain’s mail routing uses Microsoft’s mail-protection infrastructure. Microsoft processes email passing through this infrastructure under its own service terms. Mailbox hosting is separate from Resend’s delivery of website transactional emails.

5. Website Assistant

The main GRIVAS & JO website offers an AI-powered assistant for questions about GRIVAS & JO services, training, corporate training and templates. The assistant is provided through Lovable AI, the AI service of the hosting platform.

When you use the assistant, the messages of the current conversation and a fixed description of GRIVAS & JO website content are sent through the Lovable AI Gateway to the AI model provider selected through the Gateway (the current configuration identifies an OpenAI model) to generate an answer. GRIVAS & JO requests that the provider does not store the conversation for later retrieval; any temporary provider-side retention for operation, security or abuse monitoring is governed by the provider's terms. A conversation may contain at most a limited number of messages, and requests are limited per visitor as described in Section 3.1. Please do not enter personal, confidential or sensitive information into the assistant. Use the contact form or email for enquiries that require personal details.

GRIVAS & JO does not store assistant chat transcripts in its database. The conversation exists only in the current browser tab until the page is reloaded or closed. The assistant does not have access to reservations, customer records, administration data or uploaded training datasets, and it cannot create or change a booking.

The assistant is disabled on Art Gallery pages.

Processing is based on the legitimate interest of GRIVAS & JO in helping visitors locate relevant information under Article 6(1)(f) GDPR.

6. Consulting

For Consulting enquiries and services, GRIVAS & JO may process:

• customer or company name;
• contact-person name;
• email address;
• billing address, postal code, city and country;
• VAT identification number, where applicable;
• service title and description;
• service date or service period;
• customer reference;
• agreed amount and currency;
• payment status;
• communications and internal service notes; and
• information or files voluntarily provided for the Consulting work.

This data is processed to respond to enquiries, prepare and perform Consulting services, communicate with the customer, administer payment and create the necessary Billing and accounting records. The principal legal basis is Article 6(1)(b) GDPR. Accounting and other mandatory records are processed under Article 6(1)(c) GDPR. Relevant records may also be retained under Article 6(1)(f) GDPR where necessary for an ongoing business relationship or the establishment, exercise or defence of legal claims.

Customers should provide only information that is relevant to the requested work and should avoid including personal, confidential or sensitive information that is not necessary.

Consulting client and service records are not subject to automatic deletion when a minimum retention period expires. Their continued retention and any future deletion or anonymisation are assessed manually in light of applicable legal duties, limitation periods, ongoing relationships and possible legal claims.

7. Private Trainings, Dataset Uploads, Microsoft Teams and Certificates

7.1 Training reservations

When you reserve Private Training, GRIVAS & JO may process:

• full name and email address;
• selected course, training format, level and language;
• selected date and time;
• focus areas, goals and specific requirements;
• reservation reference, status and cancellation information;
• payment reference, amount, payment status and refund information;
• Microsoft Teams meeting information; and
• certificate information after eligible completion.

This data is used to manage availability and reservations, communicate with participants, administer payment, deliver the training, handle cancellations and refunds, and prepare completion certificates. The legal basis is Article 6(1)(b) GDPR. Billing and accounting data is processed under Article 6(1)(c) GDPR. Relevant evidence may also be retained under Article 6(1)(f) GDPR for the establishment, exercise or defence of legal claims.

7.2 Optional training datasets

You may optionally upload an .xlsx or .csv sample dataset, with a maximum size of 10 MB, so that the training can be prepared around a practical example from your work. A training reservation can be completed without uploading a file.

GRIVAS & JO does not request or require personal, confidential or sensitive information in training datasets. Please upload anonymised sample data only, and confirm before uploading that the file contains no confidential, personal or sensitive information. If a file nevertheless contains information relating to another person, you are responsible for ensuring that you are legally permitted to provide it.

Uploaded datasets are stored in private storage under a system-generated file name. They are not publicly accessible and may be accessed only by authorised GRIVAS & JO administrators through short-lived internal access links. The files are used only to prepare and deliver the booked training. They are not used to train AI models.

Files are checked by the system to confirm that they are genuine spreadsheet or CSV files. Unsupported, disguised or macro-enabled files are rejected.

Optional customer training datasets are automatically and permanently deleted 30 days after the training date. This is the only automatic deletion rule for customer-provided business files. You may also request earlier deletion of the dataset, provided it is no longer required to provide the training or meet an applicable legal obligation.

7.3 Microsoft Teams

Private Training sessions may be delivered through Microsoft Teams. GRIVAS & JO stores the session platform and meeting link and sends the link to the participant by transactional email. When you open or use a Microsoft Teams link, Microsoft may process technical, account, connection and session data in accordance with Microsoft’s own privacy information and the settings used for the session.

7.4 Certificates

For eligible completed and paid training sessions, GRIVAS & JO may prepare and store a certificate record and certificate PDF containing the participant’s name, training title, completion date, duration, training type and certificate identifier. The certificate may be delivered to the participant by email.

Training reservations, payment information, communications, cancellation and refund records, certificates and related business records are not automatically deleted when a minimum retention period expires. Any future deletion or anonymisation will be reviewed manually under the criteria in Section 14.

8. Workshops, Registrations, Access Links and Certificates

When you register for a Workshop, GRIVAS & JO may process:

• first and last name;
• email address;
• Workshop and registration details;
• registration reference and private access token;
• billing name and company;
• billing address, city, postal code and country;
• VAT identification number, where applicable;
• participation fee, payment reference and payment status;
• Workshop date, time and duration;
• access-link communications;
• completion and email-delivery information; and
• certificate information after eligible completion.

This information is processed to register participants, administer attendance and payment, send payment instructions and Workshop communications, provide access information, deliver Workshop materials and prepare completion certificates. The legal basis is Article 6(1)(b) GDPR. Billing and accounting records are processed under Article 6(1)(c) GDPR. Relevant records may also be retained under Article 6(1)(f) GDPR for the establishment, exercise or defence of legal claims.

Workshop access information, including a Microsoft Teams link where used, is communicated only to the relevant participants. Workshop certificates may contain the participant’s name, Workshop title, completion date, duration, Workshop type and certificate identifier. A final Workshop workbook may be sent with the completion package.

Workshop registrations, payment records, communications, access records and certificates are not automatically deleted when a minimum retention period expires. Any future deletion or anonymisation will be reviewed manually under Section 14.

9. Newsletter

If you subscribe to the GRIVAS & JO Automation Brief (Business & Training) or the GRIVAS & JO Art List (Art Collection), GRIVAS & JO processes:

• your email address;
• your first name, where provided;
• your recorded email-marketing permission;
• newsletter subscription and confirmation status;
• unsubscribe or compliance status; and
• the newsletter interest(s) you selected (Business & Training and/or Art Collection) and the website form used.

The newsletter provides practical automation information and updates about Workshops, Training and templates. The Art List provides news about new artworks, collections and releases from the GRIVAS & JO Art Collection. Processing is based on your consent under Article 6(1)(a) GDPR.

Newsletter signup uses a double opt-in process. After submitting the form, you must confirm the subscription through the confirmation process before marketing emails are sent. A service enquiry, reservation, order or other customer interaction does not subscribe you to the newsletter.

You may withdraw your consent at any time by using the unsubscribe link in a newsletter. Withdrawal does not affect processing carried out before consent was withdrawn. Unsubscribed, cleaned or otherwise compliance-restricted contacts are not silently reactivated. A new subscription requires the applicable fresh consent and confirmation process.

Mailchimp is the system in which newsletter subscriptions, marketing permissions and unsubscribe preferences are managed. Newsletter data is retained while a subscription is active. After an unsubscribe or other restriction, a minimal suppression or compliance record may be retained where necessary to respect the preference, demonstrate compliance and prevent further marketing from being sent.

10. Art Gallery Order Requests, Online Checkout and Fulfilment

10.1 Separate ordering processes

GRIVAS & JO operates two distinct Art Gallery processes:

• Order Request: the separate collection-only request process. Its collection-only acknowledgement applies to that process and is not a statement that all Gallery purchases exclude shipping.
• Online checkout: the e-shop process, which supports Pickup or Delivery, artwork quantities and shipping arrangements, with online payment through Stripe as described in Section 12.2.

Depending on the process and the information needed for the purchase, GRIVAS & JO may process:

• customer name, email address and telephone number;
• company name and VAT identification number, where applicable;
• billing address, country, postal code and city;
• delivery recipient name, shipping address, country, postal code and city, including a recipient different from the purchaser where provided;
• artwork design identifier, title, type, size, quantity and availability or preparation information;
• fulfilment method (Pickup or Delivery), requested and confirmed collection location and relevant arrangement notes;
• artwork price, shipping fee, promotion code, discount, currency and total payable amount;
• optional notes, personalisation requests and approved custom-artwork information where applicable;
• checkout/session and order references, order number, order and payment status, relevant timestamps and processing history;
• payment references and outcomes, as described in Section 12;
• customer and administrator communications and email-delivery history; and
• acceptance of the applicable Terms of Sale and acknowledgement of the Withdrawal & Returns information, including document versions and acceptance date and time.

Not every field is required or used in every process. An initiated checkout can retain a checkout record and the supplied information even if payment fails, expires or the purchase is not completed. An initiated checkout is not necessarily a completed order.

This information is used to receive and assess requests, prepare and perform purchases, verify prices and shipping, communicate with customers, arrange payment and fulfilment, and document the transaction. The principal legal basis is Article 6(1)(b) GDPR. Article 6(1)(c) GDPR applies to required consumer, accounting and legal records; Article 6(1)(f) GDPR applies where necessary to preserve reliable evidence and establish, exercise or defend legal claims.

If a Gallery referral source is present, its validated Sales Source code can be recorded with the order. Persistent referral storage requires Statistics consent as described in Section 3.4; an in-memory source from the current visit may be used without persistent device storage.

10.2 Legal acknowledgement records

For new Gallery orders, GRIVAS & JO records evidence that the applicable Terms of Sale were accepted and the applicable Withdrawal & Returns information was acknowledged. This includes legal-document versions and the date and time of acceptance.

These records support contractual and consumer-information obligations under Article 6(1)(b) and Article 6(1)(c) GDPR and preservation of evidence under Article 6(1)(f) GDPR. A privacy notice or legal-information acknowledgement is not consent to marketing and is not a waiver of statutory consumer rights.

10.3 Pickup, delivery and physical-receipt confirmation

Online artwork delivery is offered to Austria and Greece, subject to the shipping options shown for the particular order. Shipments are sent with Austrian Post (Österreichische Post AG), which may use partner postal operators in the destination country. The collection-only Order Request process remains separate.

For Pickup, GRIVAS & JO may process requested and confirmed collection location, expected readiness information, physical collection date, confirmation timestamp and whether confirmation was recorded by the customer or an administrator.

For Delivery, GRIVAS & JO may process recipient name, shipping address and contact telephone number, shipping destination and fee, the courier or delivery organisation, dispatch date, shipping reference or tracking number, tracking URL, delivery/receipt date and confirmation timestamp. Necessary recipient, address and contact information may be shared with the delivery organisation for carriage, delivery and related communications. A selected carrier may also process technical information when its tracking page is opened. Austrian Post processes this information as an independent controller for the carriage and delivery of the shipment; see Austrian Post's privacy information.

A secure, order-specific token link or QR code may open the relevant collection or delivery confirmation page. The QR code encodes the private confirmation link, not the customer’s address or card details. Public confirmation pages display only the limited order and fulfilment information needed for the confirmation. Private tracking and action links should not be shared. A confirmation token is not necessarily a time-expiring link; its permitted use is restricted by order state and confirmation safeguards.

Confirmation can be customer-recorded or administrator-recorded. GRIVAS & JO retains the distinction, relevant dates and event history. Preparing or printing a Delivery QR code does not itself record dispatch, receipt or payment. Customer receipt confirmation remains unavailable before dispatch.

Collection or delivery confirmation records physical handover or receipt only. It does not confirm that the artwork is free of defects, waive statutory consumer rights or remove warranty, withdrawal or other legal remedies.

Processing is based on Article 6(1)(b) GDPR for fulfilment, Article 6(1)(c) GDPR for applicable legal records and Article 6(1)(f) GDPR for reliable handover evidence and legal claims. Information about providers and international transfers appears in Section 13.

10.4 Track Your Order

Track Your Order uses either a private order-specific link or the combination of an order number and matching email address. It may display artwork and quantity, order and payment status, relevant price and fulfilment information, expected dates, confirmed collection details or shipping/tracking information, physical-receipt status, and relevant cancellation or withdrawal information.

Secure tracking and action tokens restrict access to the relevant record. Treat these links and QR codes as private access credentials and do not forward them to unrelated persons.

10.5 Cancellation, statutory withdrawal and returns

GRIVAS & JO processes cancellation requests, statutory withdrawal notices and returns for relevant Pickup and Delivery purchases under the applicable Terms of Sale, Withdrawal & Returns Policy and mandatory law. The separate Order Request cancellation process continues to apply to that workflow. This Privacy Policy describes data handling; it does not introduce new withdrawal exclusions or restrictions.

A designation such as Made to Order is not, by itself, an automatic exemption from the statutory right of withdrawal. Any legally valid personalised/custom-made exception must meet the applicable legal conditions and be explained in the sales information; acknowledgement of legal information does not itself create an exemption.

Processing may include the order identifier and private access information, submission type, submission timestamp, optional feedback, applicable deadline and its relevant collection or delivery/receipt dates, a snapshot of order and payment status when submitted, administrator handling, return-awaited status, actual return date, return/inspection evidence and related customer or administrator communications.

Original notices and timestamps are preserved separately from later handling entries. Withdrawal records are distinct from warranty or defect complaints. Submitting a withdrawal does not itself initiate or establish completion of a refund, credit note, physical return or restocking.

These records are used to handle requests and statutory rights, coordinate returns and financial follow-up, document compliance and preserve an audit trail under Article 6(1)(b), Article 6(1)(c) and Article 6(1)(f) GDPR, as applicable.

10.6 Transactional communications and email history

Transactional messages are separate from newsletters and do not subscribe a customer to marketing. Resend delivers website-generated transactional emails.

The implemented online-checkout process includes an order confirmation and a separate company notification after a verified paid checkout has created an order. Readiness and dispatch notifications follow authorised administrator actions; they are not triggered merely by opening checkout or preparing a QR code. Collection, delivery and withdrawal confirmation messages follow the relevant successfully recorded event, including a customer confirmation or, where supported, an administrator recording it on the customer’s behalf.

The separate Order Request workflow also supports request/order handling, acceptance, payment, readiness, collection and withdrawal communications, as applicable. Inventory Direct Sales have their own receipt, payment/invoice and shipping communications. The existence of an email template does not mean every message is automatically sent in every circumstance. Only implemented, applicable triggers or authorised sends are used; a rejected fulfilment transition does not send a successful readiness or dispatch notification.

Messages intended for a real customer are addressed using the stored order/customer details; company notifications go to info@grivasjo.com separately. Email history can include the relevant order or sale, message category, intended/actual recipient where recorded, sending actor or automatic event, timestamp, provider reference, sending/delivery status and limited failure information. Delivery status does not necessarily demonstrate that the recipient read a message. Duplicate protection and failed-send records support operational reliability; a failed message does not automatically reverse the underlying order or confirmation.

Legal bases are Article 6(1)(b) GDPR for contractual communications, Article 6(1)(c) GDPR for required legal/accounting communications and Article 6(1)(f) GDPR for delivery troubleshooting, audit evidence and legal claims. Retention is described in Section 14.

11. Inventory Direct Sales, Buyer Details and Gallery-to-Inventory Links

Inventory Direct Sales are distinct from Gallery purchases. For a physical artwork sold through the Inventory and Receipt process, GRIVAS & JO may process:

• the artwork’s unique ART ID, title, type and size;
• sale identifier and date, price, currency, payment reference and payment status;
• buyer name, email address, company and VAT identification number where applicable;
• billing or buyer address, country, postal code and city;
• fulfilment arrangement (Pickup, Delivery or Custom), collection location and arrangement notes;
• delivery recipient and shipping address, contact details where required and provided, shipping fee and necessary courier/shipping information;
• dispatch date, courier or delivery organisation, shipping/tracking reference and tracking URL;
• customer- or administrator-recorded receipt information, dates, timestamps and relevant history;
• buyer-detail submission time and receipt or private confirmation token; and
• receipt, invoice, return/refund and associated communications or accounting references.

Internal costs, including actual shipping cost, may also be recorded for business administration where applicable; they are distinct from the customer’s artwork price and charged shipping fee.

A private receipt link permits buyer details to be supplied for sale administration and Billing. Later permitted updates do not rewrite immutable issued invoices. The sale and its handover/delivery records are used to identify the buyer, perform and document the sale, organise shipping or collection, communicate with the buyer and comply with accounting and tax obligations. Physical-receipt confirmation has the same limited meaning described in Section 10.3 and does not waive consumer rights.

For Gallery purchases, authorised administrators link each physical quantity unit to an assigned Inventory artwork/ART ID. Assignment and assignment-event records can include the Gallery order reference, unit, artwork identifier, administrator, date/time, status and operational notes. These links provide allocation, fulfilment and return/inspection traceability and prevent duplicate stock allocation. An internal Gallery-to-Inventory assignment is not a second purchase or payment and does not create an Inventory Direct Sale for the customer.

Processing is based on Article 6(1)(b) GDPR for the sale and fulfilment, Article 6(1)(c) GDPR for legal/accounting requirements and Article 6(1)(f) GDPR for stock integrity, transaction evidence and legal claims. Provider disclosures are in Section 13; retention is in Section 14.

12. Payments, Stripe Checkout, Billing and Financial Records

12.1 Manual bank transfer and payment QR codes

For Private Trainings, Workshops, Consulting, Art Gallery Order Requests and Inventory Direct Sales, payment can be made by manual bank transfer to the GRIVAS & JO bank account, using the bank details and payment reference provided. Payment QR codes may encode the GRIVAS & JO bank details, amount and payment reference. They do not contain card information and do not themselves initiate or confirm a payment. GRIVAS & JO checks incoming payments and records them manually. In this process, GRIVAS & JO receives the information shown on its bank statement (such as the payer's name, IBAN, amount, date and payment reference).

Manual bank transfer is separate from the online payment form. The online payment form does not currently offer bank transfer. Should a Stripe bank-transfer option be introduced in future, this Privacy Policy will be updated before it is offered.

12.2 Online payment through Stripe

The Art e-shop's online checkout uses Stripe's embedded payment form. The payment methods offered are debit and credit cards, Apple Pay, Google Pay and Stripe Link, depending on your device and browser.

When you proceed to payment, GRIVAS & JO sends Stripe your email address, the artwork description (design, type, size and quantity), amount and currency, any shipping line, and reference data linking the payment to the checkout (such as checkout and design identifiers, fulfilment method, promotion code, shipping amount and total). Your billing or delivery address, telephone number and personalisation text are not sent to Stripe by GRIVAS & JO. Stripe may collect further information directly in its payment form, depending on the payment method and its requirements.

Card details are entered directly into Stripe's payment form. GRIVAS & JO does not receive or store card numbers, expiry dates or security codes.

GRIVAS & JO stores the checkout and payment references, amount and currency, payment status and outcome reported by Stripe, payment time, test or live environment, and payment-event identifiers needed to reconcile transactions and prevent duplicate processing. An order is created only after Stripe has confirmed payment; an unpaid, failed or expired checkout does not create an order. Refund outcomes reported by Stripe can also be recorded. Stripe payment outcomes are recorded separately from the payment status maintained by the administrator in order administration and Billing.

Requests from GRIVAS & JO to Stripe pass through a payment connector service operated by Lovable, which therefore handles the related request data as a service provider. Card entry does not pass through this connector.

Stripe processes data to provide payment services, authenticate and secure transactions, prevent fraud and meet its regulatory duties. GRIVAS & JO's legal bases are Article 6(1)(b) GDPR for the purchase and payment, Article 6(1)(c) GDPR for legally required records and Article 6(1)(f) GDPR for reconciliation, fraud prevention and legal claims. Stripe acts as a processor for some services and as an independent controller for others (for example fraud prevention, regulatory compliance and Stripe Link). Stripe may process data outside the EEA on the basis of appropriate safeguards under Chapter V GDPR. See Stripe's Privacy Policy, Stripe's Data Processing Agreement and Sections 3.8 and 13.

12.3 Billing, invoices, credit notes and refunds

For payment, Billing and accounting purposes, GRIVAS & JO may process:

• customer name and email address, company, billing address and VAT identification number where applicable;
• service, Training, Workshop, Gallery order or artwork-sale descriptions and source/transaction references;
• artwork quantities, price, charged shipping, discounts, amount and currency;
• payment reference, date, status and relevant Stripe identifiers/outcomes where used;
• invoice number/date and immutable invoice details, including customer and line-item snapshots;
• credit-note number/date/reason and immutable credit-note details;
• refund amount, date, reason, method/reference and status;
• related transactional emails and audit records; and
• accounting and expense documents that may contain supplier, document or contact information.

The data is used to identify and reconcile payments, issue and preserve immutable invoices/credit notes, administer refunds and maintain legally required financial records. Issued document snapshots are preserved; later customer/order updates do not silently overwrite them. A correction can require a legally appropriate separate record or document rather than alteration of the original.

Processing is based on Article 6(1)(b) GDPR where necessary to perform the relevant contract, Article 6(1)(c) GDPR for tax/accounting and record-keeping duties and Article 6(1)(f) GDPR where necessary for legal claims.

Under applicable Austrian accounting and tax law, accounting books, records and supporting documents, including relevant invoices and credit notes, must generally be retained for at least seven years, ordinarily calculated from the end of the relevant calendar year. Longer statutory periods and pending proceedings can apply. The statutory period is not a universal retention rule for every non-accounting field and is not an automatic deletion date. Actual retention practices and review criteria are set out in Section 14.

13. Service Providers, Their Roles and International Transfers

GRIVAS & JO uses the following services where relevant to the particular website or business process:

• Lovable, Lovable Cloud and Cloudflare: website platform/hosting, content delivery, routing and security, database, administrator authentication, private storage and aggregated hosting statistics. Lovable’s payment connector is also an intermediary for merchant Stripe requests. These services ordinarily act as processors/service providers for instructed processing; any separate controller purposes and subprocessor arrangements depend on the applicable terms.
• GoDaddy and applicable Microsoft mailbox services: hosting/administration of the info@grivasjo.com mailbox and business correspondence. Mail routing currently uses Microsoft infrastructure. GoDaddy provides the mailbox service and its administration, and Microsoft supplies underlying email processing infrastructure.
• Resend: delivery of website transactional email, including applicable enquiries, bookings, Workshop communications, Gallery/Inventory order and fulfilment communications, withdrawal/return correspondence, Billing documents and certificates. It acts as a processor for instructed delivery under applicable arrangements, with subprocessors and possible separate operational/compliance processing. Mailbox hosting is not provided by Resend. Use of EU delivery infrastructure does not guarantee that all account, support, logging or subprocessor processing stays within the EU.
• Stripe (with hCaptcha for bot protection) and relevant payment participants: online payment form, Stripe Link, authentication, fraud prevention, reconciliation and outcome information. Apple and Google process data when Apple Pay or Google Pay are used. Stripe’s processor and independent-controller roles depend on the purpose and applicable agreement, as described in Section 12. Payment/banking partners may have their own legal responsibilities.
• Austrian Post (Österreichische Post AG) and its partner postal operators: necessary recipient, address, contact and shipment/tracking information for Delivery orders. Austrian Post acts as an independent controller for carriage and delivery.
• Intuit Mailchimp: subscription/interest management, double opt-in, newsletter delivery and unsubscribe/suppression handling. It acts as processor for instructed audience/marketing processing under applicable terms, with any independent-controller operational/compliance purposes governed by its own privacy information.
• Microsoft Teams: online Training/Workshop delivery and meeting access. Roles and processing depend on the applicable Microsoft agreement, meeting/account configuration and any processing Microsoft undertakes for its own purposes.
• Lovable AI Gateway and the configured AI model provider: generating assistant responses. The current configuration identifies an OpenAI model. Gateway/model-provider processing, temporary operational retention, roles and transfers are governed by the applicable service arrangements; the assistant limitations in Section 5 remain applicable.
• Meta Platforms Ireland Ltd.: not a currently activated tracking recipient. If separately approved and activated, the limited joint-controller collection/transmission arrangement and subsequent Meta processing described in Section 3.7 would apply, with prior Marketing consent. This amendment does not activate Meta or introduce extra tracking.

A processor acts under instructions under an Article 28 GDPR arrangement where required. An independent controller decides its own purposes and means for the relevant processing. Joint controllership applies only to the specific shared processing covered by the applicable arrangement; not every provider is a joint controller or a processor for all purposes.

Some providers, affiliates or subprocessors may process, route or access data outside the EEA through globally distributed infrastructure. A transfer requires a valid Chapter V GDPR mechanism, such as a European Commission adequacy decision (including the EU–US Data Privacy Framework only for a currently certified recipient and covered processing) or applicable Standard Contractual Clauses and necessary supplementary measures. The appropriate safeguards depend on the actual recipient and contract, not merely the provider’s brand or the use of an EU server.

GRIVAS & JO does not claim that all processing occurs exclusively within the EU. You may contact info@grivasjo.com for information about applicable recipients and transfer safeguards, including how to obtain relevant safeguard information, subject to legitimate confidentiality protections.

Provider privacy information includes GoDaddy, Microsoft, Resend, Stripe, hCaptcha, Austrian Post, Mailchimp, Cloudflare, Lovable and OpenAI. Applicable agreements, subprocessor lists, certifications and transfer mechanisms are those of the respective provider and are reviewed periodically.

14. Data Retention

GRIVAS & JO retains personal data only while reasonably necessary for its purpose and while a lawful basis for continued processing exists. Relevant criteria include:

• performing and documenting a contract or requested service;
• Austrian accounting, tax, commercial, consumer-protection and other legal obligations;
• applicable limitation periods and relevant pending proceedings;
• an ongoing customer or business relationship;
• complaints, cancellations, statutory withdrawals, Pickup/Delivery returns, warranty matters, payments and refunds;
• security, audit and compliance requirements; and
• establishing, exercising or defending legal claims.

A statutory minimum is a minimum legal requirement where it applies; its expiry is not an automatic deletion date or a justification to keep unrelated data indefinitely.

Retention periods set by GRIVAS & JO:

Other records are kept according to the criteria above:

• Gallery orders: customer and billing/shipping information, quantities, prices, legal acknowledgements, fulfilment status and history, as necessary for order administration, legal obligations and claims.
• Stripe/payment references: session and payment identifiers, amounts, statuses, event references and reconciliation records, where needed for financial obligations, fraud prevention and claims. Stripe's own retention is governed by its obligations and terms.
• Collection/delivery and Inventory records: ART ID/order links, buyer details, recipient/shipping data, dispatch/tracking, receipt dates, confirmation evidence, allocation events, returns and inspection history, as necessary for fulfilment, traceability, warranty/legal matters and financial records.
• Cancellations, withdrawals, returns and refunds: original submissions, handling events, communications and related financial documents, for statutory compliance and legal claims, not merely until the withdrawal period ends.
• Training, Workshop and Consulting records: reservation/service, payment, cancellation, communications and certificate records, subject to the criteria above.
• Newsletter data: while subscribed; necessary suppression/compliance evidence may remain after unsubscribe.
• Business correspondence: as necessary for customer support, communication evidence and applicable legal duties.

Technical deletion functions currently in place: optional customer training datasets are deleted by an automatic daily process 30 days after the training date. Gallery Analytics records and consent records (excluding legal holds) are covered by an automatic daily deletion process applying the periods above. Abuse-protection counters older than 24 hours are removed automatically during subsequent requests. For all other categories, including abandoned checkouts and email delivery logs, the retention periods above are applied by GRIVAS & JO through manual review rather than automatic deletion. A statutory minimum period is not an automatic deletion date.

15. Your GDPR Rights

Subject to the conditions and limitations of applicable law, you have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• receive personal data in a portable format where the right to data portability applies;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent, with effect for the future; and
• lodge a complaint with a competent data-protection supervisory authority.

To exercise your rights, contact info@grivasjo.com. GRIVAS & JO may need to request appropriate information to verify your identity before responding.

A request for erasure does not require GRIVAS & JO to delete information that must or may lawfully be retained. This may include information retained because of statutory accounting or tax obligations, an ongoing contractual or legal duty, or the establishment, exercise or defence of legal claims. Where full deletion is not legally available, processing may be restricted where the legal requirements for restriction are met.

You have the right to lodge a complaint with:

Austrian Data Protection Authority
Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna, Austria
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at

You may also contact another competent supervisory authority where applicable.

16. Links to External Websites

The website may contain links to external websites and services, including Gumroad and social-media platforms such as LinkedIn, Instagram and Facebook.

A link does not itself transmit form information entered on the GRIVAS & JO website to the external provider. When you choose to open an external link, you leave the GRIVAS & JO website, and the external provider’s own privacy policy and data-processing practices apply. GRIVAS & JO does not control those external websites.

Links to Microsoft Teams, secure provider-hosted newsletter processes or other services described in this Privacy Policy are also subject to the relevant provider’s privacy information when opened or used.

17. Changes to this Privacy Policy

GRIVAS & JO may update this Privacy Policy when website functionality, business processes, service providers or legal requirements change. The version and date shown on this page identify the current published version.

Version 1.3 — 16 October 2026. Previous version: 1.2 — 12 October 2026.