Privacy Policy

Last updated: October 26, 2026

Lilla’s Art Studio operates this website and online shop using Shopify. This Privacy Policy explains how personal information is collected, used, stored and shared when you visit this website, place an order, contact me, subscribe to my Studio List, submit a review or otherwise interact with Lilla’s Art Studio.

For the purposes of applicable data protection laws, I am generally the data controller responsible for the personal information described in this Privacy Policy.

1. Personal Information I Collect

Depending on how you use this website and my services, I may collect the following information:

• your name

• email address and telephone number

• billing and shipping address

• payment and transaction information

• details of products you order, return, review or inquire about

• information you provide when requesting a commission or contacting me

• information relating to your Studio List subscription

• reviews, ratings and other content you choose to submit

• device, browser, IP address and website usage information

• information collected through cookies and similar technologies

Payment information may be processed directly by Shopify, payment providers or other payment services and may not be fully accessible to me.

2. How I Use Your Information

I process personal information where necessary for the following purposes:

To process and fulfil orders

This includes processing payments, arranging production and shipping, sending order confirmations, handling returns and providing customer service.

The legal basis for this processing is generally the performance of a contract or taking steps at your request before entering into a contract.

To communicate with you

I may use your contact details to respond to inquiries, discuss commissions, provide customer support or communicate with you regarding an order.

The legal basis may be performance of a contract, steps taken before entering into a contract, or my legitimate interest in responding to customer inquiries.

Studio List and email marketing

If you subscribe to my Studio List, I may use your email address to send updates about my website and shop, new artwork, prints, seasonal collections, commission openings and other studio news.

I send marketing emails on the basis of your consent. You can withdraw your consent at any time by using the unsubscribe link in an email or contacting me.

My Studio List is currently managed using beehiiv.

Reviews and review requests

I may use information relating to your order to invite you to leave a review and to collect, manage, verify and display customer reviews.

Where required by applicable law, review-related communications will only be sent on an appropriate legal basis.

Legal and administrative purposes

I may process and retain information where necessary to comply with tax, accounting, consumer protection or other legal obligations, to prevent fraud, or to establish or defend legal claims.

The legal basis for this processing may be compliance with a legal obligation or my legitimate interests.

3. Shopify

This store is hosted by Shopify.

Shopify processes personal information to provide the online store, checkout, account, security, analytics and other services necessary to operate the website.

Information submitted through the store may therefore be processed by Shopify and its service providers, including in countries outside the European Economic Area.

More information about Shopify’s processing of personal information is available in Shopify’s privacy information.

Shopify notes that merchants generally act as controllers of their customers’ personal data, while Shopify acts as processor in many contexts.

4. Print-on-Demand Fulfilment

Some art prints may be produced and shipped by my print-on-demand fulfilment partner, Prodigi.

Where necessary to fulfil an order, information such as your name, shipping address, order details and contact information may be shared with Prodigi and relevant production or delivery partners.

Prodigi states that, when processing merchant customer data for fulfilment purposes, it acts as a processor on behalf of the merchant.

5. Studio List and beehiiv

I currently use beehiiv to manage my Studio List and send email updates.

If you subscribe, beehiiv may process information such as your email address, name, subscription status and engagement with emails for the purpose of providing the newsletter service.

Where required, your subscription will only become active after you confirm your email address through a double opt-in process.

You may unsubscribe at any time.

6. Customer Reviews and Judge.me

I use Judge.me to collect, manage, verify and display customer reviews on my website and to send review requests following eligible purchases.

For this purpose, Judge.me may process information such as your name, email address, order and product information, review content, rating, review status and certain technical or usage information.

If review request emails are enabled, Judge.me may use information relating to your order to schedule and send a request inviting you to review your purchase. Judge.me may also process information relating to the delivery and interaction with these emails, such as whether an email was delivered, opened or a review link was clicked.

When Judge.me processes customer information provided by or made available through my shop for the purpose of providing its review services, Judge.me generally acts as a data processor on my behalf.

Where you interact directly with Judge.me, for example through certain Judge.me services or accounts, Judge.me may process personal information as an independent data controller.

Judge.me may use subprocessors and service providers where necessary to provide its services, including providers for email delivery, hosting and technical infrastructure.

When submitting a review, you may be asked to provide an email address for verification and review-management purposes.

Further information about how Judge.me processes personal information is available in Judge.me’s Privacy Policy.

7. Payments

Payments may be processed through payment providers available through Shopify, such as Shopify Payments, PayPal or other payment methods displayed at checkout.

These providers may process personal and financial information in accordance with their own privacy policies.

I generally do not receive your complete payment card details.

8. Shipping Providers

For physical orders, personal information necessary for delivery may be shared with postal services, couriers, fulfilment providers and other shipping partners.

This usually includes your name, delivery address and, where necessary, your email address or telephone number.

9. Cookies and Similar Technologies

This website may use cookies and similar technologies necessary for the operation of the store and, depending on your choices, for analytics, personalisation or advertising.

Where required by applicable law, non-essential cookies and tracking technologies will only be used after you provide consent.

You can manage your privacy and cookie preferences through the options provided on the website.

Shopify provides customer privacy settings and cookie-consent tools that merchants can configure by region.

Third-party services used on this website may also use cookies or similar technologies where necessary for their functionality or where you have provided the required consent.

10. International Data Transfers

Some service providers may process or store personal information outside Austria or the European Economic Area.

Where required, international transfers are protected using recognised legal safeguards, such as adequacy decisions or Standard Contractual Clauses.

11. Data Retention

I retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required by law.

For example, certain order, invoice and accounting information may need to be retained for statutory tax and accounting periods.

Newsletter information is generally retained until you unsubscribe or otherwise request deletion, subject to any information that must be retained to document compliance with legal obligations.

Review-related information may be retained for as long as necessary to manage, verify and display reviews and to comply with applicable legal requirements.

12. Your Rights

If the GDPR applies to you, you may have the right to:

• request access to your personal information

• request correction of inaccurate information

• request deletion of your information

• request restriction of processing

• object to certain processing

• receive certain information in a portable format

• withdraw consent at any time where processing is based on consent

Withdrawing consent does not affect processing carried out before the withdrawal.

To exercise your rights, contact me using the details below.

13. Complaints

If you have concerns about how your personal information is handled, please contact me first so that I can try to resolve the issue.

You also have the right to lodge a complaint with the competent data protection authority.

For Austria, this is:

Austrian Data Protection Authority
Österreichische Datenschutzbehörde

14. Children

This shop is not specifically directed at children, and I do not knowingly collect personal information directly from children where parental consent would be legally required.

15. Third-Party Links

This website may contain links to third-party websites or platforms.

I am not responsible for the privacy practices of third-party websites. Please review their privacy policies when visiting them.

16. Changes to This Privacy Policy

I may update this Privacy Policy when my services, providers or legal obligations change.

The latest version will always be published on this website together with the date of the most recent update.

17. Contact

For questions about this Privacy Policy or to exercise your data protection rights, please contact:

Email: lillaalbinart@gmail.com