Privacy policy

This policy explains what personal data this website collects, why it is collected, and who it is shared with. It covers asyaaseeva.com and any order placed through it.

What is collected

If you place an order, you give your name, shipping address and email address. They are needed to take payment, send you your work, and keep the records Spanish tax law requires.

If you write to me, I keep our correspondence so I can answer you.

Nothing else is collected. There are no accounts on this site, no passwords, no profiles, no comments and no newsletter.

Payments

Payments are handled by Stripe. Your card details are entered on Stripe’s own payment page — they are never sent to this website, never seen by me, and never stored here. Stripe is certified to the PCI-DSS standard, managed by the PCI Security Standards Council.

After a payment, Stripe tells this site that the order went through, and I receive your name, address, email and what you bought, so that I can pack and send it.

Cookies

This site sets no cookies and does not follow you across other websites.

Your shopping bag is kept by your own browser, on your own device, so that it survives if you close the tab. It is sent nowhere until you choose to pay. Emptying the bag, or clearing your browser’s data, removes it.

Visitor statistics

Visits are counted with Cloudflare Web Analytics. It records which pages were opened, which site the visitor came from, and the country, browser and device type — all in aggregate. It uses no cookies, no fingerprinting and no cross-site identifiers, and builds no profile of you.

Why your data is processed

  • Contract performance — to take payment and deliver your order
  • Legal obligation — tax and accounting records, kept for 5 years as required by Spanish law
  • Legitimate interest — to answer correspondence and to know how many people visit the site

How long it is kept

Order and invoice records are kept for five years, as the law requires. Correspondence is kept for as long as it remains useful, and deleted on request. Visitor statistics are aggregated and are not tied to you.

Who else sees your data

  • Stripe (payment processing) — Stripe Payments Europe, Ltd., Ireland
  • Resend (sending your order confirmation email) — servers in Ireland
  • Google Workspace (my email, where your messages arrive)
  • Netlify (website hosting) — Netlify, Inc., United States
  • Cloudflare (domain name service and visitor statistics)
  • Correos and courier services (delivery — they receive your name and address)

Your data is not sold, and is not shared with anyone for advertising. Where a provider is outside the European Economic Area, the transfer is covered by the European Commission’s standard contractual clauses.

GDPR Rights

If you are located in the European Economic Area (EEA), you have the following rights under Regulation (EU) 2016/679 (GDPR):

  • Right to access your personal data
  • Right to rectify inaccurate data
  • Right to erasure (“right to be forgotten”)
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing
  • Right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es)

To use any of them, write to hello@asyaaseeva.com. Note that records I am legally required to keep for tax purposes cannot be deleted before their five years are up.

Changes to this policy

If the way this site works changes, this page is updated to match. The date below says when it last was.

Data controller

Anna Aseeva (artistic name: Asya Aseeva), autónoma based in Tarragona, Spain.

Contact: hello@asyaaseeva.com

Last updated: 5 August 2026