Privacy Statement for Tina McEvoy/ www.tinamcevoyart.com

Effective Date:  21 July 2025

This Privacy Statement explains how Tina McEvoy/ www.tinamcevoyart.com ("I", "me", "my", or "this website"), an artist based in Portugal, collects, uses, and protects any personal data you provide when you visit and interact with my website, www.tinamcevoy.com

I am committed to protecting your privacy and ensuring that any personal data I collect is handled in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable data protection laws in Portugal and the European Union.

1. Who I Am (Data Controller)

Tina McEvoy, Moncarapacho,Portugal, tinamcevoy16@gmail.com

2. Personal Data I Collect and Why I Collect It (Purposes and Legal Basis)

I collect and process personal data for the following purposes and under the following legal bases:

  • Newsletter Subscription:

    • Data Collected: Email address, first name.

    • Purpose: To send you occasional newsletters about my new artwork, exhibitions, and artistic updates.

    • Legal Basis: Your explicit consent (Art. 6(1)(a) GDPR). You freely provide this data by signing up for the newsletter. You can withdraw your consent at any time by unsubscribing (instructions provided in every newsletter) or by contacting me directly.

  • Responding to Your Inquiries:

    • Data Collected: Your email address, name (if provided), and any information you include in your message.

    • Purpose: To respond to your direct inquiries about my paintings, potential commissions, or other art-related questions you send via email or social media direct messages.

    • Legal Basis: My legitimate interest (Art. 6(1)(f) GDPR) in communicating with interested individuals about my artistic practice and potential art sales. Where an inquiry leads to steps towards a potential contract (e.g., discussing a purchase), the legal basis may also be steps taken prior to entering into a contract (Art. 6(1)(b) GDPR).

  • Website Analytics and Improvement:

    • Data Collected: Anonymous or pseudonymized data related to your Browse behavior on my website, such as IP address (truncated or anonymized by Squarespace), browser type, operating system, referring pages, pages visited, and time spent on pages. This data is collected through Squarespace Analytics.

    • Purpose: To understand how visitors interact with my website, identify popular content, improve website functionality, and enhance the overall user experience.

    • Legal Basis: My legitimate interest (Art. 6(1)(f) GDPR) in operating and improving my website. For non-essential cookies used for analytics, your consent via the cookie banner is also required (see Section 4 for more on cookies).

  • Manychat Automation and Statistics:

    • Data Collected: Information related to your interaction with my Manychat automations, which may include contact details, usage data, email performance data, and other content you provide through Manychat.

    • Purpose: To manage and automate communications, gather statistics on engagement with my automated messages, and improve my outreach efforts.

    • Legal Basis: For direct marketing through Manychat, it is typically consent (Art. 6(1)(a) GDPR). For statistical analysis, it is my legitimate interest (Art. 6(1)(f) GDPR) in understanding and improving my communication strategies.

  • Meta Advertising (Facebook/Instagram):

    • Data Collected: When I run paid advertising campaigns on Meta platforms, Meta may collect data related to your interaction with these ads (e.g., impressions, clicks, engagement). This is governed by Meta's own privacy policies. If I use tools like custom audiences based on my newsletter subscriber list, this is based on your consent provided for the newsletter and for this specific type of marketing.

    • Purpose: To promote my artwork, grow my audience, and acquire new newsletter subscribers through targeted advertising.

    • Legal Basis: Your consent (Art. 6(1)(a) GDPR) for direct marketing activities and my legitimate interest (Art. 6(1)(f) GDPR) in promoting my artistic business, balanced against your privacy rights.

3. How I Share Your Personal Data

I use third-party service providers to help operate my website and services. These providers act as "data processors" on my behalf and are contractually obligated to protect your data in accordance with GDPR. I only share the minimum data necessary for them to perform their services.

  • Squarespace: My website is hosted by Squarespace, and their platform also provides the newsletter service. Squarespace processes data on my behalf for website hosting, analytics, and newsletter management. You can review Squarespace's Privacy Policy [insert link to Squarespace's Privacy Policy, e.g., https://www.squarespace.com/privacy].

  • Manychat: I use Manychat for automation and statistics. Manychat processes data related to interactions with my automated messages and provides analytical insights. You can review Manychat's Privacy Policy [insert link to Manychat's Privacy Policy, e.g., https://manychat.com/legal/privacy].

  • Meta Platforms (Facebook/Instagram): When I engage in paid advertising, Meta Platforms acts as a co-controller or independent controller for certain data processing activities related to the advertising services. Your interactions with my social media links are also subject to their respective privacy policies. Please refer to Meta's Privacy Policy for more information on how they process your data [insert link to Meta's Privacy Policy, e.g., https://www.facebook.com/privacy/explanation].

I do not sell, rent, or otherwise disclose your personal data to third parties for their independent marketing purposes.

4. Cookies

My website, built on Squarespace, uses cookies. Cookies are small text files placed on your device to help the site provide a better user experience. They are generally used to retain user preferences, store information for things like shopping carts, and provide anonymized tracking data to third-party applications like analytics.

  • Necessary Cookies: These cookies are essential for the website to function correctly (e.g., for security or site navigation). They do not require your consent.

  • Analytics and Performance Cookies: Squarespace uses these to collect information about how visitors use my site, helping me understand and improve its performance. These cookies require your consent.

When you visit my website, you will be presented with a cookie banner allowing you to manage your cookie preferences. By continuing to use the website after seeing the banner, or by accepting cookies, you consent to the use of non-essential cookies. You can usually modify your browser settings to decline cookies if you prefer, though this may prevent you from taking full advantage of the website.

5. Data Retention

I will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

  • Newsletter Data: Retained until you unsubscribe or request deletion.

  • Inquiry Data: Retained for a reasonable period to address your inquiry and any follow-up, or as long as necessary for record-keeping if a relationship is established.

  • Analytics Data: Retained according to Squarespace and Manychat's retention policies, and in a format that does not directly identify you.

6. Your Data Protection Rights (GDPR)

As a data subject under GDPR, you have the following rights concerning your personal data:

  • The Right to Be Informed: You have the right to know how your personal data is collected and used. This Privacy Statement serves to fulfill this right.

  • The Right of Access: You have the right to request a copy of the personal data I hold about you.

  • The Right to Rectification: You have the right to request that I correct any inaccurate or incomplete personal data I hold about you.

  • The Right to Erasure ("Right to Be Forgotten"): You have the right to request the deletion of your personal data under certain circumstances.

  • The Right to Restrict Processing: You have the right to request that I limit the way I use your personal data under certain circumstances.

  • The Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where technically feasible.

  • The Right to Object: You have the right to object to the processing of your personal data where I am relying on legitimate interests as the legal basis, or for direct marketing purposes.

  • Rights in Relation to Automated Decision Making and Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. (Note: I do not engage in such activities).

To exercise any of these rights, please contact me at:

[Your Email Address - e.g., info@yourwebsite.com]

I will respond to your request within one month, in accordance with GDPR requirements. I may need to verify your identity before fulfilling your request to ensure the security of your data.

7. Complaints

If you have concerns about how I handle your personal data, please contact me directly in the first instance. If you are not satisfied with my response, you have the right to lodge a complaint with the supervisory authority in Portugal, which is the:

Comissão Nacional de Proteção de Dados (CNPD) Rua de São Bento, n.º 148-3º 1200-821 Lisboa Portugal Email: geral@cnpd.pt Website: [insert link to CNPD website if available, e.g., www.cnpd.pt]

8. Changes to This Privacy Statement

I may update this Privacy Statement from time to time to reflect changes in my practices or for other operational, legal, or regulatory reasons. Any updates will be posted on this page with a revised "Effective Date." I encourage you to review this Privacy Statement periodically.