Introduction

Louis Andrada ("I," "me," or "my") is committed to protecting your privacy. This policy explains what personal information I collect when you visit andrada.one (or any of its louis., han. and odi. addresses), subscribe to my mailing list, or submit an inquiry — why I collect it, how it's used, who it's shared with, and the rights available to you under the privacy laws that apply to you, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Anti-Spam Legislation (CASL), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

By using this site, you agree to the practices described in this policy. If you do not agree, please discontinue use. I may update this policy periodically. Material changes will be noted by updating the date above.

Who Is Responsible for Your Information

I am the data controller for personal information collected through this site, and I'm based in Toronto, Ontario, Canada. You can reach me at any time through the Inquiry page or using the contact details in the Contact section below.

Information I Collect

Mailing List

When you subscribe to the mailing list, I collect your email address. It is used solely to:

• Notify you when new artwork is posted
• Enter you into the monthly print draw and the annual original artwork draw
• Send personal invitations to private viewings and events

Your email address is never sold, rented, or shared with any third party for their own purposes. Sign-ups are stored in my own Google account (Google Sheets, via Google Apps Script) and are only used to send you the newsletter.

Artwork Inquiries and Commission Requests

When you submit a purchase inquiry or commission request through the Inquiry page, I collect your name, email address, phone number, city, and country. This information is used only to respond to your inquiry and to facilitate the purchase or commission process. It is stored in my own Google account (Google Sheets, via Google Apps Script) and is not shared beyond what is necessary to fulfil your request.

Website Analytics and Server Logs

This site uses Google Analytics to collect anonymized data about how visitors use the site — such as general location, browser type, and pages visited — in a way that does not identify you personally. My hosting provider, Netlify, may also temporarily log visitor IP addresses for security and performance purposes. This data is used only to understand how the site performs and to improve the experience.

Security and Spam Prevention

This site uses Google reCAPTCHA v3 to protect forms from automated abuse. reCAPTCHA may collect hardware and software information, including device and application data, and send it to Google. Its use is subject to Google's Privacy Policy and Terms of Service.

Legal Basis for Processing

If the GDPR or UK GDPR applies to you — for example, if you're located in the European Economic Area or United Kingdom — I rely on the following legal bases: your consent for mailing list sign-ups and marketing communications, which you can withdraw at any time; the necessity of processing to respond to your inquiry or fulfil a purchase or commission (contractual necessity); and my legitimate interest in securing, maintaining, and improving this site through analytics and spam prevention, balanced against your rights and freedoms.

How I Use Your Information

I use personal information only for the specific purposes described above. I do not engage in advertising, behavioral tracking, or profiling. I do not sell or share your data with any third party for marketing purposes.

Third-Party Service Providers

I use the following service providers to operate this site. Each processes personal information only on my behalf and only for the purposes described in this policy:

• Google (Apps Script and Sheets) — stores mailing list sign-ups, purchase inquiries, and commission/contact form submissions
• Google Analytics — provides anonymized visitor analytics
• Google reCAPTCHA — protects forms from automated abuse
• Netlify — hosts this website and may temporarily log visitor IP addresses for security and performance

None of these providers is permitted to use your information for their own purposes.

International Data Transfers

Some of the providers above are based in, or process data in, the United States. If you're located in Canada, the EEA, the UK, or elsewhere, your information may be transferred to and processed in a country with different data protection laws than your own. Where required, I rely on the safeguards those providers maintain — such as standard contractual clauses or equivalent certification frameworks — to protect your information during this transfer.

Cookies and Tracking Technologies

This site uses cookies set by Google Analytics (to understand site usage) and Google reCAPTCHA (to prevent spam; it is loaded on pages with forms). The site itself also stores a few small preferences in your browser — your light/dark mode choice and whether you've already seen the intro animation this session. There are no advertising or cross-site tracking cookies. You may disable or manage cookies through your browser settings, though doing so may affect some site functionality, such as form submission.

This site does not currently respond to browser "Do Not Track" signals, as there is no common industry standard for how such signals should be interpreted.

Email Marketing and Anti-Spam Compliance

I only send commercial electronic messages to mailing list subscribers with your prior consent, as required under Canada's Anti-Spam Legislation (CASL) and comparable laws elsewhere. Every marketing email identifies me as the sender, provides a way to contact me, and includes a functioning unsubscribe mechanism. Unsubscribe requests are honoured promptly, and in any event within 10 business days.

Data Retention

Mailing list email addresses are retained for as long as you remain subscribed, and are deleted promptly once you unsubscribe. Inquiry and commission information is retained only as long as reasonably necessary to address and, where applicable, complete your request, after which it's deleted or anonymized. Analytics data is retained only in aggregated, anonymized form.

Data Security

I take reasonable technical and organizational measures to protect your information, including relying on service providers with industry-standard security practices and encrypting data in transit (HTTPS/TLS). No method of transmission or storage is completely secure, and I can't guarantee absolute security.

Data Breach Notification

If a breach of security safeguards creates a real risk of significant harm to you, I will notify you and, where required, the relevant regulator — such as the Office of the Privacy Commissioner of Canada — without unreasonable delay, in accordance with applicable law.

Automated Decision-Making

I do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

Your Privacy Rights

If You Are in Canada

Under PIPEDA, you have the right to access the personal information I hold about you, request correction of inaccurate information, withdraw consent at any time (subject to legal or contractual restrictions), and lodge a complaint with the Office of the Privacy Commissioner of Canada.

If You Are in the European Economic Area or United Kingdom

Under the GDPR/UK GDPR, you additionally have the right to erasure, restriction of processing, data portability, objection to processing, and the right to lodge a complaint with your local supervisory authority.

If You Are a California Resident

Under the CCPA/CPRA, you have the right to know what personal information I collect about you, request its deletion or correction, and opt out of the sale or sharing of personal information. I do not sell or share personal information, and I do not discriminate against anyone who exercises these rights.

Other U.S. States and Jurisdictions

If you reside in a state with a comparable consumer privacy law (such as Virginia, Colorado, Connecticut, Texas, or others), or elsewhere, you likely have similar rights to access, correct, delete, and opt out of the sale or sharing of your personal information. To exercise any of the rights described in this section, please contact me through the Inquiry page.

Children's Privacy

This site is not directed to children, and I do not knowingly collect personal information from anyone under 13 (or the relevant age of digital consent in your jurisdiction, where higher). The mailing list, inquiry forms, and commission process are intended for adult use only.

If I learn that a child under 13 has submitted personal information without a parent or guardian's verifiable consent, I will delete that information promptly. Parents or guardians who believe their child has provided personal information through this site may contact me through the Inquiry page to request its review or deletion.

Changes to This Policy

Any updates to this policy will be posted on this page with a revised date. Continued use of the site after changes are posted constitutes acceptance of the updated policy.

Governing Law

This policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, without prejudice to any mandatory consumer or data protection rights you may have under the laws of your own country or state of residence.

Contact

If you have any questions about this policy, or would like to exercise any of the rights described above, please reach out through the Inquiry page, or by mail at: 124 Edward St, Office 355, Toronto, ON M5G 1G6, Canada..