Access
Find out whether personal data is being processed and receive a copy.
ONYROS - PERSONAL DATA
Privacy Policy.
How the personal data of visitors and people who contact Onyros is collected, used and protected.
Who processes your data.
- Data Controller
- EOS Digital di SB
- VAT Number
- 03986720542
- info@onyrosart.it
The Data Controller determines the purposes and means of processing the personal data collected through the website.
What information may be processed.
Data provided directly
- first name, last name and contact details;
- email address and, when necessary, telephone number;
- shipping and billing address;
- tax information required for purchase documentation;
- content of messages sent through forms or email;
- preferences and information relating to requests, orders or customizations.
Purchase-related data
Data relating to the selected artwork, amount, order status, shipping, documentation and communications connected with the purchase may be processed.
Technical browsing data
IT systems may collect IP address, date and time of the request, browser, device, pages visited and other technical data necessary for the operation, security and management of the website.
The website is not intended to intentionally collect special categories of personal data. Users are asked not to include such information in messages unless strictly necessary.
Why your data is used.
| Purpose | Legal basis | Main data |
|---|---|---|
| Responding to requests and messages. | Pre-contractual measures requested by the data subject or legitimate interest in managing communications. | Identity, contact details, message content. |
| Managing orders, payments, documentation and support. | Performance of the contract and pre-contractual measures. | Personal, tax, order, delivery and communication data. |
| Complying with tax, accounting and legal obligations. | Legal obligation. | Purchase, billing and payment data. |
| Preventing abuse, fraud and security issues. | Legitimate interest of the Data Controller and security obligations. | Technical data, logs and order information. |
| Sending newsletters or promotional communications. | Consent, where required. | Name, email and preferences. |
| Analyzing website usage with non-essential tools. | Consent, where required by applicable law. | Cookies, identifiers and browsing data. |
Providing the data necessary to respond to a request or process an order is essential to providing the service. Failure to provide such data may make it impossible to proceed.
Any consent required for newsletters, marketing or non-essential tracking tools is optional and may be withdrawn at any time.
How your data is handled.
Data is processed using electronic tools and, where necessary, paper records, in accordance with the principles of lawfulness, fairness, transparency, data minimization and storage limitation.
Access is limited to those who need it to perform activities related to the website, orders, accounting, support or security.
No decisions are made based solely on automated processing that produces legal effects or similarly significant effects on the data subject, unless otherwise specifically stated.
Who may receive your data.
Data may be shared, to the extent necessary, with parties that provide services related to the operation of the website and the fulfillment of orders.
- hosting and technical support: Aruba;
- payments: Stripe;
- shipping: SendCloud;
- newsletter: Nessuno;
- traffic analytics: Nessuno;
- tax, administrative, legal or IT consultants;
- authorities and public bodies where required by law.
Providers process data as data processors, independent controllers or authorized parties, depending on their actual role and the applicable agreements.
Personal data is not made publicly available, except at the request of the data subject or where required by law.
Data outside the European Economic Area.
Some technical providers may process data in countries outside the European Economic Area. In such cases, the transfer must take place on the basis of an adequacy decision, standard contractual clauses or another safeguard provided for by applicable law.
Before publication, the actual location of the providers used must be verified and the applicable safeguards specified.
How long your data is kept.
- requests and communications: for as long as necessary to respond and manage any subsequent developments in the conversation;
- orders and contractual data: for as long as necessary to perform the contract and subsequently for the periods required by tax, accounting and legal obligations and for the protection of rights;
- billing data: for the period required by applicable law;
- newsletters: until consent is withdrawn or the subscription is cancelled, except where minimal retention is necessary to document the request;
- technical and security logs: for a period proportionate to the technical and security purposes of the website;
- cookies: according to the retention periods specified in the Cookie Policy and in the consent management panel.
Once the applicable retention periods have expired, data is deleted, anonymized or retained only where necessary for ongoing legal obligations or disputes.
Control over your data.
Where provided for by applicable law, data subjects may exercise their rights concerning their personal data.
Rectification
Correct inaccurate data or complete incomplete information.
Erasure
Request deletion where the legal requirements are met.
Restriction
Request restriction of processing in the cases provided for by law.
Data portability
Receive certain data in a structured, commonly used and machine-readable format.
Objection
Object to processing based on legitimate interests or to direct marketing.
Withdrawal of consent
Withdraw consent without affecting the lawfulness of processing carried out before withdrawal.
Complaint
Lodge a complaint with the competent supervisory authority.
Requests may be sent to info@onyrosart.it. Before responding, it may be necessary to verify the identity of the person making the request.
In Italy, you may contact the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Browsing and preferences.
The website may use technical cookies necessary for its operation and, where present and permitted, analytics, preference or profiling tools.
Non-essential cookies must only be activated according to the choices expressed by the user through the consent management system.
For information about categories, purposes, providers and retention periods, please see the Cookie Policy.
Protecting your information.
Appropriate technical and organizational measures are implemented to protect personal data from unauthorized access, loss, alteration, disclosure or accidental destruction.
No system can guarantee absolute security. In the event of a personal data breach, the Data Controller will assess the obligations required by applicable law.
Services intended for an adult audience.
The website and purchasing functions are not specifically intended for children. Anyone who does not have the legal capacity to enter into a contract must act through a parent or legal guardian or other applicable representative.
Privacy Policy version.
This Privacy Policy may be updated to reflect regulatory or technical changes or changes relating to the services actually used.
Last updated: August 1, 2026.
HAVE A QUESTION?
Your data deserves clear answers.
To exercise a right or request information about the processing of your personal data, you can contact me directly.
Talk to me