Privacy Policy

Last updated: August 2026

1. Who We Are

This website is operated by Vitalina Lahman, an independent artist based in Israel. She is the controller of the personal data described in this policy, under both the Israeli Privacy Protection Law, 5741-1981 and — where applicable — the EU General Data Protection Regulation (GDPR). For any privacy-related questions, please reach out via the contact page.

2. What Data We Collect

When you use the contact form on this website, we collect the personal data that you provide: your name, email address, subject, and message. Providing this data is voluntary — there is no legal duty to provide it — but without it we cannot receive or respond to your inquiry. If you arrive at the contact form from a specific artwork page, a link to that artwork (artwork_url) is automatically included; this is not personal data and is only used to help us respond. Your submission is generated into an email delivered to the artist and is kept as ordinary business correspondence for as long as needed to handle your inquiry and any resulting sale. We do not collect any other personal data from visitors browsing the site.

3. Why We Collect It

We use the information you provide solely to respond to your inquiries, answer questions about artworks, and arrange purchase or commission requests. For visitors covered by the GDPR, the legal basis for this processing is our legitimate interest (GDPR Article 6(1)(f)) in communicating with potential customers, and — where an inquiry leads to a purchase — the taking of pre-contractual steps at your request (GDPR Article 6(1)(b)).

4. Israeli Privacy Law Notice

This notice is provided under section 11 of the Israeli Privacy Protection Law, 5741-1981 (as amended): providing your personal data is voluntary; the consequence of not providing it is only that we cannot respond to you; the data is collected for the purposes described in section 3; and it is transferred to the service providers listed in sections 5 and 6 for those purposes only. You have the right to access personal data held about you and to request correction or deletion of inaccurate data, under sections 13–14 of that law. To exercise these rights, contact us via the contact page.

5. Third-Party Data Processor

Contact form submissions are transmitted directly to Web3Forms, a third-party form-handling service that forwards each submission to the artist's email. Web3Forms is operated from India and hosted on Amazon Web Services; it retains submission data for up to three years unless deleted earlier, and uses spam-prevention providers (CleanTalk, Akismet) that may receive the submitter's IP address and email address. You can review their privacy policy and data processing agreement. We do not share your personal data with any other third parties, except where required by law.

6. Hosting

This website is hosted by Amazon Web Services (AWS). When you visit the site, technically necessary server data — such as your IP address, the time of the request, the requested page, and browser information — is processed to deliver the website and keep it secure. We do not evaluate this data, and it is retained only as long as necessary for these purposes.

7. Data Transfers Abroad

This website is operated from Israel but hosted on servers of Amazon Web Services outside Israel, and contact form data is processed by Web3Forms on servers in the United States and India, under the data processing agreement linked in section 5. For visitors from the EU: transfers of personal data outside the EEA are covered by appropriate safeguards such as the Standard Contractual Clauses maintained by these providers, and the European Commission's adequacy decision recognizing Israel's level of data protection remains in force for data handled by the artist.

8. Data Security

All traffic to this website is encrypted using HTTPS. Contact form submissions are not stored on our own servers — they are transmitted directly to Web3Forms, which is responsible for their storage and security and encrypts stored data at rest. You can review Web3Forms' security practices in their privacy policy.

9. Cookies and Tracking

The public pages of this website set no cookies at all and use no analytics, tracking, or advertising technology — no Google Analytics, no advertising pixels, no third-party embeds. This is why the site shows no cookie banner: there is nothing to consent to. The only exception is the content management area (/admin) used by the artist herself, which is not part of the public site.

10. Your Rights

Under the Israeli Privacy Protection Law you have the right to access and correct personal data held about you (see section 4). If you are covered by the GDPR you additionally have the right to: access the personal data we hold about you, request correction of inaccurate data, request erasure ("right to be forgotten"), obtain a copy of your data (data portability), and object to processing. Because contact form submissions are delivered to our email, we hold that correspondence directly: on request we will provide access to, correct, or delete our copies, and instruct Web3Forms to delete theirs. To exercise any of these rights, please contact us via the contact page. We will respond within 30 days.

11. Children's Privacy

This site is not directed at children under the age of 13, and we do not knowingly collect personal data from minors. If you believe a child has submitted personal data through this site, please contact us via the contact page and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in how we handle data or legal requirements. The "Last updated" date above reflects the most recent revision. Material changes will be announced on the site.

13. Contact

For any privacy questions or to exercise your rights, please reach out via the contact page.