Privacy Policy

1. Data Controller

In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), the details of the Data Controller are provided below:

2. Personal Data Collected and Purposes of Processing

We only process the personal data strictly necessary that users voluntarily provide through our contact form or via direct email communication:

• Management of editorial inquiries, quotes, and commissions: Responding to inquiries, children's book or editorial illustration proposals, project quotes, or Articlips product support submitted via the contact form (name, email address, project type, and message) or email.
• Pre-contractual or contractual execution: Preparing professional quotes, administrative management, invoicing, and follow-up of artistic commissions requested by clients or publishers.
• Newsletter / Updates (if applicable): Sending updates on new collections or creative resources only if the user explicitly subscribes to a newsletter.
• Technical security and website maintenance: Ensuring site availability, preventing automated spam submissions, and protecting infrastructure against unauthorized access.

No automated profiling or automated decision-making with legal effects is carried out on users.

3. Legal Basis for Processing

The processing of your personal data is based on the following legal grounds under Article 6.1 of the GDPR:

• Explicit consent of the data subject (Art. 6.1.a GDPR): Granted by actively checking the Privacy Policy acceptance box prior to submitting the contact form, or by accepting optional cookies. You may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Pre-contractual measures or performance of a contract (Art. 6.1.b GDPR): When requesting an editorial quote, illustration commission, or order support.
• Legitimate interest of the Controller (Art. 6.1.f GDPR): Ensuring network security and preventing fraud or automated abuse (spam).

4. Recipients, Data Processors, and International Transfers

Your personal data will never be sold, rented, or disclosed to third parties for commercial purposes. Access is restricted to essential infrastructure and communication providers acting as Data Processors under Article 28 GDPR agreements, certified under the EU-U.S. Data Privacy Framework (DPF) and/or European Commission Standard Contractual Clauses (SCCs):

• Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA): Web hosting, static content delivery network, and—only when authorized by the user in the cookie preferences panel—cookieless aggregate audience measurement via Vercel Web Analytics (daily ephemeral identifier without cookies, local storage, or cross-site tracking).
• Cloudflare Inc. (101 Townsend St, San Francisco, CA 94107, USA): DNS management, network security, bot mitigation, and email routing (Cloudflare Email Routing).
• Google Ireland Limited / Google LLC (Gordon House, Barrow Street, Dublin 4, Ireland): Professional email inbox hosting and management.
• Formspree Inc. (USA): Technical processing and delivery of messages submitted via the web contact form.

When purchasing products through external marketplaces linked from /articlips (Ko-fi, Creative Market, or Etsy), buyers provide their payment and billing details directly to those platforms, which act as independent data controllers under their respective privacy policies.

5. Data Retention Period

Personal data provided through the contact form or email will be retained only for the time strictly necessary to answer your inquiry or manage the requested quote. If a professional commission or contractual relationship arises, tax and commercial records will be retained for the legally required periods under Spanish tax and commercial regulations (generally 4 to 6 years).

6. Your Data Protection Rights (ARSOPOL Rights)

Under Articles 15 to 22 of the GDPR, you have the right to exercise the following rights free of charge:

• Access: Obtain confirmation and details of what personal data concerning you is being processed.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure (Right to be forgotten): Request deletion of your data when it is no longer needed for the purposes for which it was collected.
• Objection: Object to the processing of your personal data under specific circumstances.
• Portability: Receive the personal data you provided in a structured, commonly used, machine-readable format.
• Restriction of processing: Request temporary suspension of data processing in legally established cases.

7. Security Measures & Privacy by Design

This website implements Privacy by Design principles: web fonts are self-hosted locally on our server to prevent automatic third-party IP transfers during page loads, all communications are encrypted via HTTPS/TLS, and contact forms include front-end sanitization and explicit consent verification.