Privacy Policy

This Privacy Policy describes how IQUI ("we", "us", or "our") collects, uses, and protects your personal information when you visit our website iqui.art, make a purchase, subscribe to our newsletter, or otherwise interact with us (collectively, the "Services").

By accessing or using any part of the Services, you agree to the collection and use of information in accordance with this Policy. This Policy should be read in conjunction with our Terms of Service.

If you do not agree with this Privacy Policy, please do not use our website or provide any personal data.

Algoritmo Espacial, Unipessoal Lda.

Company Registration Number (NIPC): 518.369.099

Registered Office: Leça da Palmeira, Portugal

Email: studio@iqui.art

Website: https://iqui.art

Algoritmo Espacial, Unipessoal Lda. acts as the data controller for the purposes of the General Data Protection Regulation (GDPR).

We collect only the personal data necessary to operate our website, process transactions, and communicate with you.

We collect only the data necessary to operate our website, process orders, and communicate with you. This may include:

Information you provide directly

• Name and contact details (such as email address, billing and shipping address, and telephone number where provided)
• Payment and billing information required to complete a transaction (processed via Stripe or, where expressly agreed in writing, through alternative payment arrangements)
• •Shipping details for artwork or gift card delivery
• Messages, inquiries, or correspondence sent to us
• Newsletter subscription data (via Resend)

Information related to digital certificates

• Where applicable, artworks may be associated with a blockchain-based certificate of authenticity. The certificate records a technical identifier linked to the artwork.
• No personal data of collectors is stored on the blockchain. Ownership information is managed privately and off-chain.

Information collected automatically

When you browse our website, certain information is automatically collected:

• IP address (anonymized where possible)
• Browser type and device information
• Pages visited and time spent on site
• Referring websites or campaigns

This information is collected through cookies and analytics tools. Please refer to our Cookie Policy for further details.

We use your personal information for the following purposes:

We do not use your data for automated decision making or profiling.

Payments for artworks and gift cards are processed securely through Stripe, a PCI-DSS compliant payment service provider.

All payment data is transmitted directly to Stripe and encrypted in accordance with industry standards. We do not store or have access to full credit card details.

Stripe acts as an independent data controller for payment processing activities. For further information regarding how Stripe processes personal data, please consult Stripe’s Privacy Policy.

If you subscribe to our newsletter, your name and email address are processed for the purpose of sending updates about new works, exhibitions, and related content.

Newsletter communications are sent through Resend, our email service provider, which acts as a data processor under a Data Processing Agreement.

The legal basis for this processing is your consent.

You may withdraw your consent at any time by clicking the unsubscribe link included in every email or by contacting us directly. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Where personal data is transferred outside the European Economic Area (EEA), such transfers are made in accordance with applicable data protection law, including the use of appropriate safeguards.

We use cookies and similar technologies to provide core website functionality and, where consent is given, to analyze website usage and improve performance.

Essential cookies :

• Certain cookies are necessary for the operation and security of the website and do not require prior consent under applicable law.

Analytics cookies:

• Google Analytics (with IP anonymization enabled)
• Cookiebot, used to manage user consent and cookie preferences

You may accept, reject, or modify your cookie preferences at any time through the consent banner or by adjusting your browser settings.

For detailed information about the types of cookies used and their duration, please refer to our Cookie Policy.

We share personal data only where necessary to operate the Services and fulfill our contractual and legal obligations.

Personal data may be shared with trusted service providers acting as data processors, including:

• Payment processing: Stripe
• Email and newsletter services: Resend
• Hosting and cloud infrastructure: Railway (or equivalent providers)
• Analytics: Google Analytics

These providers process personal data under Data Processing Agreements (DPAs) and are contractually bound to implement appropriate technical and organizational security measures in accordance with the GDPR.

Personal data may also be disclosed where required by law, including to tax authorities, courts, or other competent public bodies.

Where personal data is transferred outside the European Economic Area (EEA), such transfers are made in accordance with applicable data protection law, including the use of Standard Contractual Clauses (SCCs) or other legally recognized safeguards.

We do not sell, rent, or commercially trade personal data to third parties.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Order and payment records: up to 10 years, in accordance with applicable accounting and tax obligations under Portuguese law
• Customer communications related to transactions: for the duration necessary to manage the contractual relationship and any potential legal claims
• Newsletter subscriptions: until you withdraw your consent or unsubscribe
• Analytics and cookie-related data: up to 14 months, subject to your consent preferences

In certain circumstances, personal data may be retained for longer where required to establish, exercise, or defend legal claims.

When personal data is no longer necessary, it is securely deleted, anonymized, or restricted in accordance with applicable data protection laws.

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access – To request confirmation as to whether we process your data and obtain a copy of it
• Right to rectification – To request correction of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) – To request deletion of your personal data, subject to legal limitations
• Right to restriction of processing – To request limitation of processing under certain conditions
• Right to data portability – To request transfer of your data to another controller where technically feasible
• Right to object – To object to processing based on legitimate interests
• Right to withdraw consent – To withdraw consent at any time where processing is based on consent (e.g., newsletter or analytics)
• Right to lodge a complaint – To file a complaint with your supervisory authority. In Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD)

To exercise any of these rights, please contact us at studio@iqui.art.

We will respond without undue delay and in any event within one month of receiving your request, in accordance with applicable data protection law. Where permitted by law, this period may be extended if necessary.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration.

These measures include encryption in transit (TLS/SSL), secure hosting infrastructure, restricted access controls, and contractual safeguards with service providers.

While we take reasonable steps to protect personal data, no method of transmission over the internet or electronic storage is entirely secure, and absolute security cannot be guaranteed.

Our website and services are not directed to individuals under the age of 16.

We do not knowingly collect personal data from minors. If you are a parent or legal guardian and believe that a minor has provided personal data, please contact us so that appropriate steps can be taken.

By using our Services, you acknowledge that personal data may be processed in countries other than your country of residence, including countries outside the European Economic Area (EEA).

Where such transfers occur, they are carried out in accordance with applicable EU data protection law and supported by appropriate safeguards, such as Standard Contractual Clauses (SCCs) or other legally recognized mechanisms.

We may update this Privacy Policy to reflect changes in our operational practices, legal requirements, or regulatory obligations.

Any revised version will be published on this page with an updated “Last updated” date.

Where required by applicable law, material changes will be communicated through the website or by other appropriate means.