Privacy Policy
Last updated: 18 August 2026
In this Privacy Policy, “we”, “us”, and “our” refer to the data controller operating under the trade name MaryFox Art, whose details are provided below.
⸻
1. Data Controller
The data controller responsible for the processing of personal data is:
Mariia Porshneva
Sole proprietor operating under the brand MaryFox Art
Email: contact@maryfoxart.com
The data controller determines the purposes and means of processing personal data in accordance with the General Data Protection Regulation.
For any questions related to data processing, you may contact us using the email above.
A Data Protection Officer (DPO) has not been appointed because the circumstances requiring mandatory designation of a DPO under Article 37 GDPR do not apply.
⸻
2. Scope of This Policy
This Privacy Policy applies to all personal data collected through the MaryFox Art website, including:
• browsing the website
• placing orders
• creating or using a customer account
• communication with users
• subscription to newsletters
• use of website technical tools
This policy is provided in accordance with Articles 12–14 GDPR to ensure transparency of data processing.
⸻
3. Categories of Personal Data
We process the following categories of personal data:
3.1 Identification Data
• full name
3.2 Contact Data
• email address
• phone number
3.3 Order Data
• shipping and billing address
• order information
• payment status
3.4 Customer Account Data
• account identifier
• account status
• profile information associated with the customer account
3.5 Payment Data
Payment data, such as card details, is processed directly by payment providers, including Stripe and PayPal. We do not receive or store full payment-card details.
We may receive limited payment-related information, such as payment confirmation, payment status, transaction reference, or information necessary to manage an order, refund, or dispute.
Stripe and PayPal may act as independent data controllers.
3.6 Technical Data
• IP address
• browser type
• device information
• cookies and similar technical technologies
• website interaction and security data
3.7 Communication Data
• messages submitted via forms
• email correspondence
• social media messages
3.8 Children’s Data
We do not knowingly seek to collect personal data from children. Where the processing of personal data is based on consent in connection with the direct offer of information society services to a child, Article 8 GDPR and the applicable national law apply. In Portugal, a child may give such consent from the age of 13. Where the child is under 13, consent must be given or authorised by the child's legal representative.
⸻
4. Methods of Data Collection
Personal data is collected through:
• placing an order
• creating or using a customer account
• filling out website forms
• contacting us
• subscription to newsletters
• automatic collection through strictly necessary cookies and similar technical technologies
⸻
5. Purposes of Processing and Legal Basis
Processing is carried out in accordance with Article 6 GDPR:
5.1 Performance of a Contract (Article 6(1)(b))
• order processing
• delivery of goods
• customer support
• creating and managing customer accounts where necessary to provide account functionality requested by the user
Providing the personal data required to place and fulfil an order is necessary for the conclusion and performance of the relevant contract.
Failure to provide such data may result in the inability to process an order.
5.2 Legal Obligation (Article 6(1)(c))
• compliance with tax and accounting laws
• retention of financial records for 10 years (DL 28/2019, Portugal)
• recording and demonstrating cookie-consent choices and withdrawals where necessary to comply with applicable legal obligations.
5.3 Legitimate Interest (Article 6(1)(f))
• communication with customers
• maintaining service quality
• maintaining reliable website operation
• ensuring security
• fraud prevention (e.g. detecting suspicious transactions or abuse of services)
Our legitimate interest consists in maintaining a proper level of service, ensuring business continuity, and protecting both the business and its users.
We ensure that such interests do not override the fundamental rights and freedoms of users.
Where required, we document and maintain Legitimate Interest Assessments (LIA).
Users may withdraw consent at any time, including by unsubscribing from marketing communications, free of charge. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal (Article 7 GDPR).
5.4 Consent (Article 6(1)(a))
• sending marketing communications
Users may unsubscribe from marketing communications at any time, free of charge (Article 7 GDPR).
⸻
6. Data Sharing with Third Parties
We do not sell personal data.
Data is shared only when necessary with the following partners:
• Wix — hosting, website infrastructure, online-store functions, forms, member functions, consent-management tools, and technical security
• Usercentrics for Wix — management of cookie preferences and storage of consent preferences
• Stripe / PayPal — payment processing
• CTT Correios de Portugal — delivery services
• technical and accounting service providers
Depending on the particular service and processing activity, these providers may act as data processors under Article 28 GDPR or as independent data controllers. Where a provider acts as a data processor, it processes personal data on our instructions and subject to applicable data-protection obligations. Where a provider acts as an independent data controller, its own privacy information applies to the relevant processing.
⸻
7. International Data Transfers
Some service providers may process or transfer personal data outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, such transfers are carried out in accordance with applicable data-protection law using, where relevant:
• Standard Contractual Clauses (SCCs)
• adequacy decisions of the European Commission
• the EU–US Data Privacy Framework, where applicable
• other legally recognised transfer mechanisms
In particular:
• Wix may process personal data in Israel, which is recognised by the European Commission as providing an adequate level of data protection
• Stripe and PayPal may transfer personal data outside the EEA where necessary, using appropriate safeguards such as Standard Contractual Clauses (SCCs), the EU–US Data Privacy Framework where applicable, or other legally recognised transfer mechanisms
Users may request a copy of, or additional information about, the safeguards applicable to international data transfers.
⸻
8. Data Retention
We comply with the storage-limitation principle:
• accounting and fiscally relevant records — 10 years, or longer where required by applicable law
• order data — for as long as necessary to fulfil contractual obligations, comply with legal requirements, resolve disputes, and enforce agreements
• customer account data — for as long as the account remains active and, after closure, only for as long as necessary to comply with applicable legal obligations, resolve outstanding disputes, or establish, exercise, or defend legal claims
• customer inquiries — up to 12 months
• marketing data — until consent is withdrawn
• cookies and similar technologies — for the retention periods specified in the Cookie Policy
After this period, data is deleted or anonymised.
Upon request, personal data will be erased without undue delay, except where continued processing or retention is permitted or required by applicable law, including where necessary for the establishment, exercise, or defence of legal claims.
⸻
9. Data Security
We implement appropriate technical and organisational measures:
• HTTPS
• restricted access
• encryption and data-protection measures
• trusted service providers
• access control
• backups and monitoring
• regular review of security measures
No system is completely secure.
⸻
10. Data Breach Notification
In case of a personal data breach, we will notify the competent supervisory authority, including CNPD, within 72 hours where required.
Where there is a high risk, affected users will be informed without undue delay.
⸻
11. Data Subject Rights
You have the right to:
• access
• rectification
• erasure
• restriction
• portability
• objection
• withdraw consent
• lodge a complaint
The right to data portability applies where processing is based on consent or contract and is carried out by automated means, subject to the conditions of Article 20 GDPR.
Requests:
We respond without undue delay and, in principle, within one month. Where permitted by Article 12(3) GDPR, this period may be extended by up to two further months, in which case you will be informed of the extension and the reasons for it within the first month.
⸻
12. Complaints
You may lodge a complaint with:
CNPD
Av. D. Carlos I, 134 – 1.º
1200-651 Lisboa
⸻
13. Cookies
We use cookies in accordance with ePrivacy legislation.
The website uses strictly necessary cookies and similar technical technologies required for the secure and proper operation of the website, including online-store functions, shopping cart, checkout, login functions, cookie-consent management, and protection against fraud or malicious activity.
We use Usercentrics for Wix as our Consent Management Platform (CMP). User choices are recorded through this CMP.
A separate Cookie Policy and the cookie-management interface provide additional details about the specific cookies and technologies used.
⸻
14. Automated Decision-Making
We do not carry out decision-making based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
⸻
15. Third-Party Links
We may link to external platforms, including Instagram, Facebook, Pinterest, and other third-party websites.
We are not responsible for their data-processing practices. When you follow a link to a third-party website, that provider’s own privacy policy will apply.
⸻
16. Updates to This Policy
We may update this policy.
The latest version is always available on the website.
⸻
17. Severability
If any provision is invalid, the rest remains in force.