Privacy policy

Last updated: October 12, 2026

This Privacy Policy describes how Svetlana Malakhova, trading as Lana Tafanel ("we", "us", or "our"), collects, uses, and discloses your personal information when you visit, use, make a purchase from, or communicate with us through this online store (the "Services").

For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD), the Data Controller responsible for your personal information is:

Data Controller: Svetlana Malakhova (Artistic name: Lana Tafanel)
Tax Identification Number (NIF): Y-827-4354-A
Location: Platja d'Aro, Girona, Spain
Contact Email: lanatafanel@gmail.com

1. Personal Information We Collect

We collect personal information that identifies or can reasonably be linked to you. Depending on how you interact with our store, we may collect:

Contact Details: Name, billing address, shipping address, and email address.
Financial & Transaction Details: Payment confirmation, transaction history, order details, and items purchased (original oil paintings, linocuts, or fine art prints). Payment processing is securely handled by our third-party payment providers (Shopify Payments, Stripe, PayPal); we do not store your full payment card details.
Customer Communications: Information included in customer support inquiries, withdrawal notifications, or custom commission requests.
Device & Usage Information: IP address, browser type, network connection, and interaction details collected automatically via essential and analytical cookies.

2. Legal Bases for Processing (GDPR Article 6)

We process your personal data strictly under the following legal bases:

Contractual Necessity (Art. 6.1.b GDPR): To process orders, accept payments, arrange artwork delivery, handle returns, and provide customer support in accordance with our Terms of Service and Return Policy.
Legal Obligation (Art. 6.1.c GDPR): To comply with Spanish commercial and tax laws (issuing tax invoices and maintaining accounting records under the Ley General Tributaria).
Legitimate Interest (Art. 6.1.f GDPR): To secure our website, prevent fraud, protect our intellectual property, and manage business operations.
Consent (Art. 6.1.a GDPR): For marketing emails or non-essential analytical cookies, where you have given express consent.

3. How We Disclose Personal Information

We do not sell your personal information. We disclose data only to trusted service providers strictly necessary to run our store:

Platform Provider: Shopify, which hosts our online store and infrastructure.
Payment Gateways & Logistics: Payment processors and shipping/courier services required to deliver your artwork safely.
Legal & Tax Authorities: When required to fulfill Spanish tax declarations (Agencia Tributaria) or respond to valid legal requests.

4. International Transfers

Your data is processed in Spain and hosted via Shopify. When personal data is transferred outside the European Economic Area (EEA), recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) are relied upon to guarantee protection.

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as mandated by law:

Accounting, Tax & Billing Data: Retained for a mandatory statutory period of 4 to 6 years in compliance with Spanish tax and commercial law (Ley General Tributaria and Código de Comercio).
General Customer Inquiries: Retained for as long as necessary to resolve your request or until you request its deletion.

6. Your Rights (GDPR & LOPDGDD)

If you reside in the European Economic Area or UK, you hold the following rights:

Access, Rectification & Erasure: Request a copy of your data, correct inaccuracies, or request deletion (subject to tax retention laws).
Restriction & Objection: Object to or restrict specific data processing activities.
Data Portability: Request transfer of your data in a structured format.
Withdrawal of Consent: Withdraw consent for promotional emails or cookies at any time.

To exercise any of these rights, please contact us at lanatafanel@gmail.com.

7. Complaints

If you have concerns regarding our data handling, please contact us first at lanatafanel@gmail.com. If you are not satisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Authority: