Privacy notice

Who is responsible

The controller for this website is Fisemarco OÜ, based in Estonia. For privacy questions or requests about your personal data, email hello@fisemarco.com.

Business address: Energia tn 13a-19, Kristiine linnaosa, Tallinn, Harju maakond, 13415, Estonia

Information you provide

The enquiry form asks for your name, email, country, enquiry type and message. Telephone, artistic interests, approximate budget and timing are optional. Please share only what is needed for an introduction and avoid health information, other sensitive personal data, or private details about other people.

Your form entries remain in the current page’s memory until you leave or reload it. The application does not save enquiry drafts in cookies or browser storage. Submitting sends the entries to our server for validation.

How enquiries are used

We use your information to respond to your enquiry, discuss a potential commission or artistic relationship, and arrange requested follow-up. Validated enquiries are stored in our private Supabase database for the authorised atelier team to review. No automatic email notification is currently sent.

For an individual’s request concerning a potential commission, the lawful basis is taking steps at your request before entering a contract (GDPR Article 6(1)(b)). General enquiries and professional introductions are handled on legitimate interests in responding to requested correspondence (Article 6(1)(f)), subject to assessing those interests against your rights. The privacy checkbox acknowledges this notice; it is not consent to advertising or cookies.

We do not enrol you in a mailing list, use enquiry details for advertising, publish your story, or make automated decisions or profile you through this application. Any later publication of a patron story or artist portfolio requires a separate agreement.

Connection details and security

Your browser sends connection details, such as IP address and request headers, to the website host. The enquiry endpoint derives a pseudonymised identifier from the apparent client IP to limit spam. This identifier is personal data, not an assurance of anonymity. It is held in a separate Supabase rate-limit table for ten minutes and removed by a cleanup scheduled every minute. It is not used for marketing or visitor analytics.

Security processing is based on the legitimate interest in protecting the website and preventing abuse. The application does not log enquiry narratives. The hosting provider may maintain separate connection and security logs.

Host log retention: Persistent Cloudflare Worker observability logs are disabled. Supabase and Cloudflare may maintain operational and security records under their service terms and account retention settings; these are separate from the enquiry records. 6174 does not export request logs or log enquiry narratives.

Who receives information

When live operation is enabled, Cloudflare processes website and enquiry requests and Supabase stores the validated enquiry in the project’s European database region. Only people authorised by Fisemarco OÜ can review enquiries through the private Supabase dashboard. No enquiry is sent to artists automatically.

Confirmed providers and their processing roles: Cloudflare, Inc. provides website hosting, request processing and authoritative DNS through its global network. Supabase, Inc. provides the private enquiry database in eu-west-3 (Paris, France). Authorised Fisemarco OÜ personnel review enquiries through the Supabase dashboard. No automatic enquiry emails are sent.

International transfers

Cloudflare processes requests on its global network. Supabase database storage is in Paris; support and subprocessors may process data in other countries. Supplier data-processing addenda describe applicable international transfer safeguards, including EU Standard Contractual Clauses. Contact hello@fisemarco.com for information about the applicable safeguards and supplier arrangements.

Supplier information: Cloudflare data-processing addendum and Supabase data-processing addendum.

How long information is kept

For live enquiries that do not lead to a commission or other ongoing relationship, retain correspondence for no longer than 12 months after the last meaningful contact, then delete it from the private enquiry database and any working copies. Delete sooner when it is no longer needed or a valid erasure request applies. Any record that must be kept for a specific legal obligation or documented legal claim is restricted to that purpose and its applicable retention period. Expired non-commissioned database records are deleted by a daily job, within 24 hours of becoming due. Any authorised exports must follow the same deletion rule. Provider backups and operational logs are governed by their separate published service terms.

Enquiry records are automatically checked for deletion daily, so removal can take up to 24 hours after the 12-month limit. The team updates the last-contact date when a meaningful conversation continues. A later commission may require separate contract, accounting or legal records; commissioned records are excluded from the enquiry cleanup and their retention must be explained when that relationship begins. Browser privacy preferences have their own 180-day duration, described in the cookie policy.

Your rights

Subject to the applicable conditions, you may request access, correction, erasure, restriction and portability of your personal data. You may object to processing based on legitimate interests. Where a future activity relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Contact hello@fisemarco.com to exercise your rights. We may need proportionate information to verify your identity. GDPR requests generally require a response within one month; where a permitted extension is needed, you must be informed of the reason. Cookie settings are available separately in the footer.

You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the competent supervisory authority where you live, work or believe an infringement occurred.

Cookies, links and changes

There are no analytics or marketing trackers. See our cookie policy for the preference record you may ask us to save. Ordinary links to external art institutions take you to independently operated websites with their own privacy policies.

We will update this notice when the processing changes. New optional tracking would require a new, specific choice before it loads. The policy date above identifies this version.