Legal
PRIVACY
How we collect, use and protect your data
Last updated: September 2026
Who We Are
This website is operated by Édouard Bonte, a fine art photographer based in Lisbon, Portugal. We offer limited edition fine art prints for sale worldwide.
For the purposes of the General Data Protection Regulation (GDPR) and applicable Portuguese data protection law, Édouard Bonte is the data controller responsible for your personal data.
Contact: ebonteart@gmail.com
Location: Lisbon, Portugal
Data We Collect
We collect personal data only when you actively provide it or when it is generated through your use of this website.
Account & Order Data
When you create an account or place an order, we collect your name, email address, shipping address, and order details.
Communications
When you contact us by email or through a contact form, we retain the content of your message and your contact details.
Newsletter Subscription
If you subscribe to our newsletter, we collect your email address and, where provided, your name.
Usage Data
We may collect anonymised data about how visitors interact with this website, including pages visited, time spent, and referring URLs.
Technical Data
Standard server logs may record your IP address, browser type, and operating system for security and diagnostic purposes.
How We Use Your Data
Your personal data is used exclusively for the following purposes:
- 01Processing and fulfilling your print orders, including shipping and delivery
- 02Communicating with you about your orders, enquiries or requests
- 03Sending our newsletter, where you have subscribed and consented
- 04Improving the website and understanding how visitors use it
- 05Complying with our legal and tax obligations under Portuguese and EU law
- 06Preventing fraud and ensuring the security of our systems
We do not sell, rent or trade your personal data to any third party for marketing purposes.
Legal Basis for Processing
Under the GDPR, we rely on the following legal bases to process your personal data:
Contract
Processing necessary to fulfil your order or respond to a pre-contractual request.
Consent
Where you have given explicit consent, such as subscribing to our newsletter. You may withdraw consent at any time.
Legitimate Interests
For website analytics and security, where our interests do not override your rights.
Legal Obligation
Where processing is required to comply with applicable law, including tax and accounting obligations.
Third-Party Services
We work with a small number of trusted third-party services to operate this website. Each is bound by their own privacy policies and, where applicable, data processing agreements.
We do not transfer your personal data outside the European Economic Area (EEA) except where adequate safeguards are in place.
Your Rights
Under the GDPR, you have the following rights with respect to your personal data:
Access
Request a copy of the personal data we hold about you.
Rectification
Ask us to correct inaccurate or incomplete data.
Erasure
Request deletion of your data where there is no legitimate reason to retain it.
Restriction
Ask us to limit how we use your data in certain circumstances.
Portability
Receive your data in a structured, machine-readable format.
Objection
Object to processing based on legitimate interests or for direct marketing.
To exercise any of these rights, please contact us at ebonteart@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority, CNPD.
Data Retention
We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law.
- Order and transaction records are retained for 10 years in accordance with Portuguese tax law.
- Account data is retained for as long as your account remains active, and for up to 2 years after your last interaction.
- Newsletter subscriber data is retained until you unsubscribe.
- Communication records are retained for up to 3 years.
Security
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure.
All data is transmitted over encrypted connections (HTTPS). Payment processing is handled entirely by Stripe and is subject to PCI DSS compliance standards. We do not store payment card information on our systems.
In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.
Contact & Updates
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page indicates when it was last revised. Continued use of this website after any update constitutes acceptance of the revised policy.