Natus Atelier
Privacy policy
How personal data is handled when you browse or contact Natus Atelier.
Draft to complete before publication. The agreements and safeguards applicable to Vercel, Supabase and the artist’s mailbox still need verification. The use of Analytics remains undecided. The chosen retention rule must be implemented for stored data and correspondence; retention of technical data and backups still needs verification.
Draft updated on 4 November 2026
Contact listed on this website: info@natusrodriguez.com
Data controller
The data controller is Maria Jesus Rodriguez Tajan, an artist working under the name Natus Rodriguez / Natus Atelier. Her professional address is Via Pisana 98, Florence, Italy. For privacy requests, contact info@natusrodriguez.com.
Data and purposes
Contact and service forms collect your name, email, message and any details you choose to provide about artworks, commissions or lessons. Course and waiting-list requests also include the selected course, participant count, optional message and request status. These details are used to reply, prepare proposals and manage participation requests. Do not submit health information or other special-category data in free-text fields.
Legal bases and required information
Enquiries, quotes and participation requests are handled to take steps at your request before entering into a contract or perform a contract (GDPR Article 6(1)(b)). Applicable legal obligations rely on Article 6(1)(c). Security and abuse prevention pursue the legitimate interest in protecting the service (Article 6(1)(f)), subject to individuals’ rights. Required fields are needed to process your request; without them it cannot be submitted. Other details are optional.
Service providers
External services help make the website available and handle requests: Vercel provides website hosting, Supabase provides artist authentication and file storage where enabled, and Brevo sends service emails. Contact requests are forwarded to the artist by email; registration and waiting-list details are kept to manage course participation. Providers receive the data needed for their functions under the applicable agreements. The Supabase project is configured in Ireland, in the European Union. This location applies to primary project data and does not by itself determine where every provider processing activity takes place. Ireland has been selected for the website’s Vercel functions; its application to the published website still needs verification after a new deployment. Brevo, a company based in France, processes the data needed to send emails on behalf of the controller as a processor, under the Data Processing Agreement (DPA) included in Appendix 3 of its Terms of Service.
Retention
The chosen retention period for enquiries that do not lead to further arrangements and related correspondence is 24 months after the enquiry is closed. For registration and waiting-list data, it is 24 months after the course is closed. Data must then be deleted or anonymised, except where still necessary for legal obligations or the protection of rights in disputes. Documents relating to subsequent contracts or accounting requirements follow the periods applicable to their purpose. Retention of technical security data and backups will be defined separately. The 24-month period is an organisational decision, not an automatic deletion process already in operation. Brevo is configured to delete transactional email logs after one month and not to store message previews. These settings do not delete emails received in the artist’s mailbox, which follow the retention criteria described above.
Cookies and usage statistics
Technical authentication cookies are used for the artist’s restricted area. The website is prepared to use Vercel Web Analytics, a service that, according to its documentation, produces aggregate statistics without cookies. Actual use of the service and applicable consent requirements must be confirmed before publication.
Recipients and international transfers
Data may be accessed by the controller, providers needed to operate the website and handle requests, and parties entitled by law. Brevo’s DPA provides that the service may involve processing outside the European Economic Area by group companies or sub-processors. Section 9 provides for safeguards under applicable law, including standard contractual clauses and supplementary measures, and possible reliance on the EU-US Data Privacy Framework for US transfers while valid and where applicable. Annex 2 of the DPA, available in Brevo’s Terms of Service, lists sub-processors, their locations and safeguards. Any transfers and safeguards for other providers still need verification and specification under the applicable agreements. No automated decision-making with legal effects or profiling to decide on requests is envisaged.
External links and newsletter
Links to News sources and social profiles open external websites governed by their own privacy notices. The newsletter is currently inactive. If it is enabled, specific information about data processing, subscribing and unsubscribing will be provided.
Your rights and complaints
Where applicable under GDPR Articles 15–22, you may request access, correction, deletion, restriction and portability and object to processing based on legitimate interests. You may withdraw any consent without affecting earlier processing. Contact the controller using the address above; requests are normally answered within one month, subject to lawful extensions. You may lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.