Privacy and cookies

Last updated: 19 October 2026

In short

No accounts, no online payment, no advertising.
No advertising cookies, no social media tools, no tracking from one site to another.
The only personal information we receive is what you send us yourself, to get in touch or to buy a work.

Data controller

Beata Wiśniewska-Kowalewska, Atelier BWK, sole trader, 16 rue du Maréchal de Lattre de Tassigny, 85770 Vix, France. Contact: atelierbwk@gmail.com, +33 6 37 41 05 01.

What we process, and why

Your messages

The “Write to the artist” form simply opens your email app: nothing is sent or stored by the site itself. When you write or call, we receive your name, your email address or phone number, your message and the work you are interested in.

Why: to reply, advise you and prepare a proposal.
Legal basis: steps taken at your request before a contract, or our legitimate interest in answering messages (GDPR article 6(1)(b) and (f)).
How long: three years after our last exchange, if no purchase follows.

Buying a work

Name, postal address, email, phone, the work bought, its price and how it was paid. We do not keep any card details.

Why: to conclude and carry out the sale, delivery, certificate of authenticity, invoice and guarantees.
Legal basis: the contract, and our legal obligations, in particular accounting (GDPR article 6(1)(b) and (c)).
How long: for the duration of the relationship, then ten years for accounting records (French Commercial Code, article L.123-22).

The Atelier Circle

If you ask to join the Circle, we keep your name and email address to write to you a few times a year.

Legal basis: your consent (GDPR article 6(1)(a)).
How long: until you unsubscribe; simply reply “stop” to any message.

How the site works technically

Our host, Cloudflare, processes technical data (IP address, browser, page requested) to deliver the site and protect it against abuse and attacks. Legal basis: our legitimate interest in keeping the site secure (GDPR article 6(1)(f)). Cloudflare keeps these logs briefly, under its own policy.

Audience statistics

To know which pages and works people are interested in, and how the site is used, we measure its audience ourselves, with no third-party tool (no Google Analytics), no cookies and nothing stored on your device.

What is measured: the pages viewed and their order during a visit, the time actually spent on each page (tab open and visitor active), how far down the page you scrolled, a few actions on the site (enlarging a work, clicking “Ask about this work”, sending the form, following an outside link, switching language), the site or campaign you came from, the type of device, browser and system, your device’s language and your approximate location (country, region, city), derived from your IP address by our host Cloudflare.
How visits are counted without cookies: to recognise the pages of a single visit, a code is computed from your IP address and your browser, mixed with a secret key that changes every day and is then erased. This code cannot be turned back into your IP address, nor used to recognise you from one day to the next. Your IP address itself is never stored.
What we do with it: overall statistics only, viewed by the artist in the site’s administration. The data is not shared, sold or combined with other information, and is never used to identify or contact you.
Where and for how long: in a Cloudflare database located in the European Union, for at most 25 months, then erased automatically.
Legal basis: our legitimate interest in understanding and improving how the site is used (Article 6(1)(f) GDPR). This measurement meets the conditions under which the French data protection authority (CNIL) exempts audience measurement from consent.

You can refuse it below, without any effect on your browsing. If your browser sends a “Global Privacy Control” or “Do Not Track” signal, your visits are never counted. Robots are not counted either.

Site administration

Only authorised people (the artist and her family) can access the administration. Cloudflare Access checks their email address with a one-time code and sets a login cookie for this, on the administration pages only.

Cookies and browser storage

The site only uses:

lang (cookie, 1 year): remembers the language you chose.
bwk-seen (session storage, until the tab is closed): shows the opening animation only once.
bwk-work (session storage, until the tab is closed): carries the title of the chosen work into the contact form.
bwk-stats-optout (local storage, until you change your mind): remembers that you refused statistics.

Cloudflare may also set a technical security cookie (for example __cf_bm) to tell visitors apart from malicious bots.

These are strictly necessary for the site or remember a choice you made yourself, so they are exempt from consent (French Data Protection Act, article 82). That is why the site shows no cookie banner. Fonts are hosted on the site and links to social networks are plain links: nothing is loaded from Google, Facebook or Instagram.

Recipients

Your data is never sold or rented. Only the artist can access it and, strictly for their task:

Cloudflare, Inc.: hosting, security and statistics for the site (United States).
Google: the atelier’s Gmail inbox (United States).
GitHub (Microsoft): storage of the site’s content (works, texts); no visitor data.
Where relevant: PayPal if you choose to pay that way, our bank, and the carrier delivering your work.

Transfers to the United States are covered by the EU–US Data Privacy Framework, to which Cloudflare, Google and Microsoft belong, or by the European Commission’s standard contractual clauses.

Your rights

You may at any time ask to access, correct or delete your data, restrict or object to its processing, receive it in a portable format, withdraw your consent, and give instructions on what should happen to it after your death. Write to atelierbwk@gmail.com or to the address above; we reply within one month.

If you believe your rights are not respected, you may complain to the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France) or to the data protection authority of your country.

Changes

This page may change, for example if the way the site works changes. The date of the last update is shown at the top.