Privacy policy

Last updated: 1 October 2026

Data controller

Hugues du Plessis
Chemin des Tines 22
1260 Nyon
Switzerland
Email: nivlakart@gmail.com

This policy explains which personal data I process, why, and for how long. It is based on the Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) and, where it applies, on the EU General Data Protection Regulation (GDPR).

In short

  • This website uses no cookies and no advertising trackers. It counts visits anonymously, without cookies, using a tool hosted in Switzerland (Matomo).
  • There are no customer accounts, no online shop, no newsletter and no comments.
  • The contact form forwards your enquiry by email to my inbox. The website’s server does not store it.
  • I only process the data you send me, in order to prepare and carry out your order.
  • I do not sell or rent out your data.

Visiting the website

This is a static website. The fonts are hosted together with the website: no connection is made to Google Fonts. The website does not embed any third-party content (videos, maps, social media buttons).

When you visit the website, the hosting provider automatically records technical data in log files: IP address, date and time of the visit, page requested, and browser and operating system information (user agent). This data is used to deliver the website, keep it secure and detect misuse. I do not use it to identify you or to build profiles.

Hosting provider: Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. The site and its logs are hosted in Switzerland. The provider keeps these logs for a limited period that it sets under its own privacy policy.

Visitor statistics

To know which pages are read and where visitors come from (for example Instagram, TikTok or a search), I use Matomo, free software installed on my own hosting at Infomaniak in Switzerland, at stats.nivlak.art. No data is passed to third parties or used for advertising.

Matomo runs here without cookies: it stores nothing on your device and does not recognise you from one visit to the next. Your IP address is shortened before it is stored. If your browser sends a Do Not Track signal, your visit is not counted. The data is kept for 25 months at most.

Enquiries and contact form

You can contact me by email or through the website’s form. When you send the form, your enquiry passes through the website’s server, hosted in Switzerland by Infomaniak, which immediately forwards it to me by email. The server does not keep the content of your enquiry. To limit abuse, it keeps a cryptographic fingerprint of your IP address for one hour at most; the address cannot be recovered from it. If automatic sending fails, the form offers to send the enquiry from your own mail app.

I process the information you choose to give me, for example: your name, email address, town, the occasion, the preferred date and a description of the person to be portrayed in objects, as well as our correspondence. I use it to reply to your enquiry, define the project and prepare a quote.

My email account is a Gmail account. Emails are therefore stored by Google, which may process data in other countries, in particular the United States. If you contact me via Instagram, Meta’s terms and privacy policy also apply.

Information about the person receiving the painting

A “portrait in objects” often relies on information about another person: their tastes, passions and memories. Please only send me what is useful for the painting, and avoid sensitive data (for example about health or religious or political views).

By sending this information, you confirm that you are entitled to do so. I use it only to create the painting. Without consent, I do not publish this person’s name or any information that identifies them.

Orders, quotes, invoices and delivery

If you place an order, I also process the data needed to perform the contract: quote, confirmation, payment of the deposit and balance, invoices and the delivery address. For postal delivery, your name and address are passed to the postal or courier service. Payments go through the bank or payment service named in the quote or invoice.

Photographs of the works

I photograph finished paintings and may publish them on this website and on Instagram, as set out in the terms and conditions of sale. You may object in writing before delivery. The photographs show the work, not you or the person receiving it. I do not attach any name to them without consent.

Links to Instagram and Google

The website contains simple links to Instagram (Meta) and to my Google Business profile (Google Maps, reviews). No data is sent to these services unless you click. Once you click, their terms and privacy policies apply. A Google review is public: I can read it and reply to it.

Recipients and transfers abroad

I only share your data with the service providers that are needed: the hosting provider, the email provider (Google), the bank or payment service, and the postal or courier service. Authorities receive data where the law requires it.

Some of these providers may process data outside Switzerland and the European Union, in particular in the United States. Such transfers then rely on appropriate safeguards: a country recognised as providing adequate protection (for the United States, for example, a company certified under the Data Privacy Framework) or recognised standard contractual clauses.

Retention

  • Correspondence: for the whole duration of the project, then as long as necessary (order follow-up, questions or complaints). An enquiry that does not lead to an order is deleted once it is no longer needed.
  • Quotes, invoices and accounting records: 10 years, in accordance with Art. 958f of the Swiss Code of Obligations (CO).
  • Server logs: a limited period set by the hosting provider.
  • Visit statistics (Matomo): 25 months at most.
  • IP address fingerprint (form protection): one hour at most.

Legal bases (GDPR)

Where the GDPR applies to you, processing is based on:

  • the performance of a contract or of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR): enquiries, quote, order, delivery;
  • a legal obligation and my legitimate interest in complying with Swiss law (Art. 6(1)(c) and (f) GDPR): keeping accounting records;
  • my legitimate interest (Art. 6(1)(f) GDPR): security and operation of the website, anonymous visit statistics, creating the painting from the information about the person receiving it, and presenting my work.

You are not obliged to give me any data, but without it I cannot prepare a quote. I do not make automated decisions and I do not carry out profiling.

Your rights

Under the FADP (Art. 25 ff.) and, where applicable, the GDPR (Arts 15–22), you may in particular:

  • ask whether I process data about you and receive a copy (right of access);
  • have inaccurate data corrected;
  • ask for your data to be deleted or its processing restricted, unless the law requires me to keep it;
  • object to processing based on a legitimate interest, for example the publication of photographs of a work;
  • receive the data you gave me in a common format (data portability);
  • withdraw any consent you have given, with effect for the future.

To exercise these rights, write to nivlakart@gmail.com. I may ask you to prove your identity.

You may also contact a supervisory authority. In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch. In the European Union: the data protection authority of the country where you live or work, or where the alleged infringement took place.

Security

I take reasonable measures to protect your data against loss and unauthorised access. However, ordinary email is not end-to-end encrypted. Please do not send particularly sensitive information by email.

Changes

I may update this policy if the website or my practices change. The version published on this page applies.

Last updated: 1 October 2026