Privacy Policy

This Privacy Policy describes how IQUI ("we", "us", or "our") collects, uses, and protects your personal information when you visit our website iqui.art, make a purchase, subscribe to our newsletter, or otherwise interact with us (collectively, the "Services").

By accessing or using any part of the Services, you agree to the collection and use of information in accordance with this Policy.

If you do not agree with this Privacy Policy, please do not use our website or provide any personal data.

Joana Castro

Email: studio@iqui.art

Website: https://iqui.art

Location: Porto, Portugal

Joana Castro acts as the data controller for the purposes of the General Data Protection Regulation (GDPR).

We collect only the data necessary to operate our website, process orders, and communicate with you. This may include:

Information you provide directly

• Name and contact details (email, address, phone number)
• Payment and billing information (processed securely by Stripe)
• Shipping details for artwork or gift card delivery
• Messages, inquiries, or correspondence sent to us
• Newsletter subscription data (via Behiiv)

Information collected automatically

When you browse our website, certain information is automatically collected:

• IP address (anonymized)
• Browser type and device information
• Pages visited and time spent on site
• Referring websites or campaigns

This information is collected through cookies and analytics tools (see our Cookie Policy for details).

We use your personal information for the following purposes:

We do not use your data for automated decision-making or profiling.

Payments for artworks and gift cards are securely processed by Stripe, a certified PCI-DSS Level 1 provider.

All payment data is encrypted and handled directly by Stripe. We do not store or have access to your full credit card details.

For more information, see Stripe's Privacy Policy.

If you subscribe to our newsletter, your name and email address are collected by Behiiv, our email service provider, to send you updates about new works, exhibitions, and related content.

You can unsubscribe at any time using the link included in every email.

Behiiv processes data in compliance with GDPR and US–EU data protection frameworks.

We use cookies and similar technologies to provide core functionality and analyze website usage.

Services used:

• Google Analytics (with IP anonymization) – to understand website traffic and performance
• Cookiebot – to manage user consent and cookie preferences
• Netlify – for secure website hosting and performance optimization

You can control your cookie preferences at any time via the consent banner or your browser settings. For more information, please see our Cookie Policy.

We only share your personal data with trusted third parties as necessary to operate the Services, including:

• Payment processing: Stripe
• Email and newsletter services: Behiiv
• Hosting and infrastructure: Netlify
• Analytics: Google Analytics

These providers process data under strict contractual agreements and comply with GDPR. Some data may be transferred outside the European Economic Area (EEA), primarily to the United States, under Standard Contractual Clauses (SCCs) approved by the European Commission.

We do not sell or rent your data to any third parties.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Order and payment records: up to 10 years (for accounting/legal compliance)
• Newsletter subscriptions: until you unsubscribe
• Analytics and cookies: up to 14 months

When data is no longer needed, it is securely deleted or anonymized.

Under the GDPR, you have the following rights regarding your personal data:

• Access – Request a copy of your personal data we hold
• Rectification – Request correction of inaccurate or incomplete data
• Erasure ("Right to be forgotten") – Request deletion of your personal data
• Restriction – Request limitation of processing under certain conditions
• Portability – Request transfer of your data to another controller
• Withdraw consent – Withdraw consent at any time (e.g., for newsletter or analytics)
• Lodge a complaint – File a complaint with your local Data Protection Authority (in Portugal, CNPD)

To exercise these rights, please contact studio@iqui.art. We will respond within 30 days as required by law.

We take appropriate technical and organizational measures to protect your data from unauthorized access, loss, or alteration.

These include encryption (SSL), secure hosting, access control, and compliance with GDPR standards. However, no online transmission is completely secure, and we cannot guarantee absolute protection.

Our website and services are not directed to individuals under the age of 16. We do not knowingly collect or store personal data from minors.

If you believe a child has provided us with personal information, please contact us for immediate deletion.