Privacy policy
Last updated: November 6, 2026
This Privacy Policy explains how Claudia Wiebe (“I”, “me” or “my”) collects, uses, stores and protects personal data when you visit or interact with my website, contact me, subscribe to my VIP newsletter or purchase artwork or services.
Who is responsible for your personal data?
I take the protection of your personal data seriously and process it in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).
Data Controller
The data controller responsible for processing your personal data is:
Claudia Wiebe
Ziegelstraße 15/1
88214 Ravensburg, Germany
Email: claudia@claudiawiebe.com
Business administration
The day-to-day administration of my website and certain business operations is supported by my authorised business manager, Daryl Wiebe, who may access and process personal data where necessary for administrative purposes, including website management, invoicing and financial record-keeping. Access is limited to what is necessary for these administrative duties. All customer correspondence and communication remain my responsibility.
What personal data do we collect?
The information I collect depends on how you interact with my website and business.
Website visits
When you visit my website, certain technical information is collected automatically by my website platform and its service providers. This may include:
IP address
Browser type and version
Device and operating system information
Date and time of access
Pages visited and referring website
Technical information about your interaction with the website
This information is used to operate, maintain and protect my website, and, where permitted, to understand how visitors use it.
Contact enquiries
If you contact me through the website contact form or by email, I collect the information you provide, which may include:
Your name
Email address
Telephone number
The content of your message
Any attachments or additional information you choose to provide
This information is used to respond to your enquiry and maintain any subsequent communication.
VIP newsletter subscriptions
When you subscribe to my VIP List, I collect your:
First name
Last name
Email address
These details are used to send occasional studio news, inspiration, updates and exclusive invitations.
The newsletter subscription process uses double opt-in confirmation. Submitting the form creates a contact record but does not immediately add you to the mailing list. You must first confirm your subscription by clicking the confirmation link in the email sent to you. Only then are you added to the VIP mailing list.
Three days after confirmation, you receive a welcome email explaining what you can expect from the newsletter.
Artwork purchases and service orders
When you purchase artwork through my website, in person, or arrange a purchase directly with me, I collect information necessary to process and fulfil the transaction, including:
Name
Billing address
Delivery address
Email address
Telephone number
Details of the artwork purchased
Order, invoice and payment information
If you purchase an Art Concierge Service, I may also collect information you provide about your space, including photographs or other materials needed to prepare the agreed visualisation or arrange an in-person artwork trial.
For purchases made through my website or in person, payments are processed through an external payment service provider. For purchases arranged directly with me, I may issue an invoice with my bank account details so that payment can be made by bank transfer.
I receive transaction information necessary to manage and record the purchase, but do not have access to your complete payment card details.
Financial and accounting records
In connection with artwork sales and business administration, I maintain financial and accounting records that may contain personal data, including:
Customer names and contact details
Billing and delivery addresses
Invoice and transaction details
Payment confirmations and related correspondence
I use these records to manage my business, fulfil my accounting obligations and meet applicable tax and legal requirements.
These records may be stored in my payment service provider's systems and/or in my secure business document storage. Where necessary, relevant information may also be shared with my tax adviser or the competent authorities for accounting, tax or other legal purposes.
Providing personal data
Where providing personal data is necessary for a particular enquiry, subscription or transaction, choosing not to provide it may mean that I am unable to respond to your enquiry or provide the requested service.
How and why do I use your personal data?
I process personal data only where there is an appropriate legal basis under applicable data protection law.
Depending on the circumstances, the legal basis may be:
Contractual necessity: to respond to a request concerning a potential purchase, process an order, arrange payment, deliver purchased artwork or provide an agreed service.
Legal obligation: to comply with accounting, tax and other legal requirements.
Consent: where you have voluntarily agreed to receive VIP emails or to the use of non-essential cookies and similar technologies.
Legitimate interests: where necessary for reasonable business purposes, such as maintaining website security, preventing spam, managing enquiries and protecting the website, provided those interests do not override your rights and freedoms.
Your personal data may therefore be used to:
Operate and maintain my website.
Respond to enquiries and customer communications.
Manage artwork purchases, payments and deliveries.
Provide agreed services, including Art Concierge Services.
Maintain invoices and accounting records.
Send newsletters and other VIP communications where you have subscribed.
Understand website usage where the necessary consent has been obtained.
Protect the website against spam, misuse and fraudulent activity.
Meet legal and regulatory obligations.
I do not sell personal data or use customer contact details for unrelated marketing purposes.
Website hosting and technical operation
My website is built and hosted using Squarespace.
Squarespace provides the website infrastructure, including hosting, website functionality, forms, contact management and online shop features.
In operating the website, Squarespace may process technical information and personal data associated with visitors, enquiries and customers on my behalf, and may process certain information for its own purposes under its privacy policy.
For further information, please consult:
Cookies and website analytics
My website uses cookies and similar technologies to support essential website functions and, where permitted, optional features and analytics.
Cookie preferences
A cookie consent banner is displayed when you first visit the website. It provides the following choices:
Accept All: accept the available optional cookies and technologies.
Reject All: decline optional cookies and technologies.
Cookie Settings: review and adjust your preferences.
Essential cookies are used where necessary for the website to function and to provide services you request.
Your cookie preferences are remembered for 30 days. During this period, you can revisit your choices using the cookie preferences control available on the website. After 30 days, the consent banner is displayed again so that you can review your preferences.
You can also manage cookies through your browser settings. Blocking certain cookies may affect some website functions.
Google Analytics
I use Google Analytics 4 (GA4), integrated through Squarespace, to understand how visitors use my website.
Google Analytics may process information such as page views, website usage, device and browser information, approximate geographic location and technical identifiers.
Non-essential analytics cookies are placed only after you have given your consent through the website's cookie banner. If you decline these cookies, they will not be placed while your choice remains in effect. Your cookie preferences are remembered for 30 days, after which you will be asked to review them again.
Google provides further information about its data processing here:
Embedded third-party content
Google Maps
My Contact page includes an interactive Google Map display. I provide this map to help visitors locate my atelier and make arrangements for an in-person visit.
The map is embedded directly from Google and loads when you visit the Contact page. When the map loads, Google may receive technical information such as your IP address, browser and device information, and information about the page being visited.
Google may also use cookies or similar technologies in connection with the provision of its mapping service. This processing is subject to Google's own privacy practices and applicable data protection arrangements.
If you choose to open the map in Google Maps, you will be redirected to Google's website or app, where Google's own privacy practices apply.
Further information is available in Google's Privacy Policy:
Meta (Instagram)
My website includes embedded content from Instagram, such as posts or feed content. This content is embedded directly from Instagram and loads when you visit the relevant page.
When the embedded content loads, Meta (the provider of Instagram) may receive technical information such as your IP address, browser and device information, and information about the page being visited. Meta may also use cookies or similar technologies in connection with the provision of its services.
This processing is subject to Meta's own privacy practices and applicable data protection arrangements. If you interact with the embedded content or choose to open Instagram, additional data may be processed by Meta.
Further information is available here:
Instagram Privacy Policy - Meta Privacy Center
Contact forms and enquiries
Information submitted through my website contact form or sent to me by email is processed through Squarespace and/or my business email account for the purpose of responding to your enquiry.
Contact information is retained only for as long as necessary to deal with the enquiry and any resulting communication or ongoing business matter.
Where there is no ongoing contact or other reason to retain the information, general enquiry records are normally deleted after approximately one year from the last meaningful contact.
Information relating to purchases, invoices or other matters subject to legal retention requirements may be kept for longer.
VIP newsletter
Visitors can voluntarily subscribe to my VIP List using the newsletter signup form in the website footer or by signing up in person at one of my events.
Online sign-up requests your first name, last name and email address. In-person sign-up collects the same information on a paper signup sheet, together with your signature confirming your agreement to receive VIP emails.
The subscription process for online sign-ups is managed through Squarespace.
Online sign-up and double opt-in confirmation
After submitting the signup form, you receive a confirmation email. You must click the confirmation link to verify your subscription.
Your contact record is created when the form is submitted, but you are not added to the VIP mailing list until you have confirmed your email address.
Three days after confirmation, an automated welcome email provides further information about the type of correspondence you can expect.
In-person sign-up
If you subscribe at an in-person event, your signature on the signup sheet serves as confirmation of your consent to receive VIP emails. I manually add your details to the VIP mailing list in Squarespace, and you will receive the same newsletters and communications as online subscribers.
I retain the signup sheets containing subscriber signatures securely with my business records as evidence of consent. I may also retain a record of your original consent and any subsequent withdrawal for as long as necessary to demonstrate compliance with my data protection obligations or to establish, exercise or defend legal claims. Such records are not used to send further newsletters after you have unsubscribed.
Newsletter communications
VIP subscribers receive occasional emails about studio news, artistic inspiration, new work and exclusive invitations. Newsletters are generally sent every two to three months.
Unsubscribing
You can withdraw your consent and unsubscribe at any time by using the unsubscribe link included in the newsletter, regardless of whether you originally subscribed online or in person.
When you unsubscribe, your address is removed from the active mailing list and you will no longer receive VIP emails.
Your underlying contact record may remain in Squarespace Contacts until it is reviewed and deleted as part of periodic contact-list maintenance. Unsubscribing does not automatically delete all information associated with your contact record.
If you wish to subscribe again, you must submit the newsletter signup form and complete the confirmation process again, or sign up in person at an event.
The legal basis for sending VIP newsletters is your consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Payments and artwork purchases
Payments for artwork purchased through my website are processed using Stripe. For in-person purchases, I use the Stripe mobile app to process card payments. Cash payments are handled directly by me, and I provide a receipt.
Depending on the payment options available, online and card payments may include debit and credit cards and other payment methods offered through Stripe.
Stripe processes payment information in accordance with its own privacy policy and applicable terms. Stripe may also transfer personal data to its affiliates and service providers in other countries, including the United States, where necessary to provide its services. Such transfers are governed by Stripe's applicable data protection and international transfer arrangements.
Further information is available here:
Stripe Data Processing Agreement
For some private or individually arranged purchases, I may issue an invoice directly. Payment may then be made by bank transfer to my business bank account.
In these cases, I process the information necessary to issue and manage the invoice and confirm payment for contractual, accounting and legal purposes.
Invoices, accounting and financial records
Invoices, receipts and other financial documents are retained for business administration, accounting and tax purposes.
Payment and transaction records are maintained in Stripe where applicable. Copies of relevant invoices and receipts are also downloaded and stored using Microsoft OneDrive.
The relevant business-record folder is accessible to me and my authorised business manager and is not publicly accessible.
Financial records are retained for the periods required under applicable tax and accounting legislation. These statutory retention obligations may require certain records to be kept even after a customer relationship has ended or a deletion request has been received.
Where necessary to meet tax or accounting obligations, relevant records may be disclosed to my tax adviser or the competent tax authorities.
Email communications and spam prevention
Google Workspace
I use Google Workspace for business email and customer correspondence.
Emails you send to me, as well as correspondence relating to enquiries and purchases, may contain personal data that is processed and stored through Google's email services.
Further information is available here:
Google reCAPTCHA
I use Google reCAPTCHA v3 on my website contact and newsletter signup forms to help protect against spam, automated submissions and other abusive activity.
reCAPTCHA runs in the background when you visit a page containing a protected form. It analyses technical information and interactions with your browser or device to assess whether activity is likely to come from a person or an automated system. This assessment generates a risk score that helps identify potentially automated or abusive activity.
This processing may involve information such as your IP address, browser and device information, and technical signals relating to your interaction with the website.
Google provides the reCAPTCHA service and, under its current reCAPTCHA data-processing arrangements, acts as a data processor for the information collected through the service. The processing is governed by the applicable Google Cloud terms and data processing arrangements.
Further information about Google's data processing arrangements is available in the Google Cloud Data Processing Addendum.
Shipping and delivery
When you purchase artwork that needs to be delivered, I may share the personal data necessary to arrange and complete delivery with the relevant shipping or courier company.
This may include your name, delivery address, email address and telephone number where required by the carrier.
Depending on the delivery arrangement, providers may include DHL, Deutsche Post, UPS, FedEx, GLS or another suitable courier service.
This information is shared only to the extent necessary to arrange and complete delivery.
Sharing personal data
I do not sell, rent or trade customer contact information.
Personal data may be shared with or processed by service providers where necessary to operate my website and business. These may include:
Squarespace — website hosting, forms, contact management and online shop functionality.
Stripe — payment processing and transaction records.
Google — Google Analytics, Google Workspace, Google Maps and reCAPTCHA.
Meta (Instagram) — providing embedded Instagram content on my website.
Microsoft — OneDrive storage of financial and business records.
Shipping and courier providers — arranging and completing delivery of purchased artwork.
These providers process personal data in accordance with their respective privacy policies, applicable contractual arrangements and data protection obligations. Depending on the service provided, they may process personal data on my behalf or for their own purposes.
Personal data may also be disclosed where required by law or where necessary to comply with legal, tax or accounting obligations.
International data transfers
Some of the service providers I use in connection with my website and business may process or transfer personal data outside the European Economic Area (EEA), including in the United States and other countries where they or their service partners operate.
This may involve information processed through my website hosting, analytics, email, payment processing, cloud storage and other business services.
When I arrange international delivery of purchased artwork, I may also share the personal data necessary to complete the shipment with shipping and courier providers and their delivery partners in the destination country. This may include your name, delivery address and, where required, your email address or telephone number.
Where personal data is transferred outside the EEA, the transfer must comply with applicable data protection law. Depending on the provider, destination and circumstances, recognised safeguards may include:
An adequacy decision by the European Commission, recognising that a country provides an adequate level of data protection.
The EU-US Data Privacy Framework, where the relevant US organisation and processing are covered by its certification.
Standard Contractual Clauses approved by the European Commission.
Other legally recognised transfer mechanisms or safeguards, where applicable.
Further information about how individual providers handle personal data and international transfers is available in their respective privacy policies and data protection documentation.
How long do I retain your personal data?
I retain personal data only for as long as necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.
My general retention practices are:
General enquiries and inactive contacts: normally deleted after one year from the last meaningful contact where there is no ongoing relationship or other reason to retain the information.
Ongoing customer matters: retained for as long as necessary to manage the enquiry, transaction or business relationship. Where a transaction results in invoices or other financial records, the applicable statutory retention periods also apply.
VIP newsletter subscribers: contact details are retained while you remain subscribed. After unsubscribing, your email address is removed from the active mailing list. The underlying contact record may remain in Squarespace Contacts until periodic review and deletion. I may also retain records of your consent and subsequent withdrawal for as long as necessary to demonstrate compliance with my data protection obligations or to establish, exercise or defend legal claims.
Invoices and relevant accounting records: retained for eight years, in accordance with the applicable statutory tax and accounting requirements.
If you request deletion of your personal data, I will consider the request in accordance with applicable data protection law. Some information may need to be retained to meet legal obligations or establish, exercise or defend legal claims.
Your data protection rights
Under the GDPR, you have certain rights concerning your personal data, subject to the conditions and exceptions set out in the law.
These include:
Right of access: to request confirmation of whether I process your personal data and obtain a copy.
Right to rectification: to request correction of inaccurate or incomplete information.
Right to erasure: to request deletion of your personal data where the legal conditions are met.
Right to restriction: to request that the processing of your information be restricted in certain circumstances.
Right to data portability: to receive certain personal data in a structured, commonly used and machine-readable format, where the legal conditions apply.
Right to object: to object to processing based on legitimate interests in circumstances provided for by law. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.
You also have the right to lodge a complaint with a competent data protection supervisory authority if you believe your personal data has been processed unlawfully.
To exercise your rights, please contact me using the details provided in this Privacy Policy.
I will respond to your request without undue delay and, in any event, within one month of receiving it. Where necessary, this period may be extended by up to two further months, taking into account the complexity and number of requests. If an extension is required, I will inform you within the initial one-month period and explain the reasons for the delay.
Children's Privacy
My website is intended for a general audience and is not specifically directed at children under the age of 16.
I do not knowingly collect personal data from children in circumstances where parental consent or authorisation is required under applicable data protection law.
If you believe that a child has provided personal data through my website in circumstances where such consent or authorisation was required, please contact me so that I can review the matter and take appropriate action.
Changes to This Privacy Policy
I may update this Privacy Policy from time to time to reflect changes in my business practices, website functionality, service providers or applicable legal requirements.
Any changes will be published on this page, together with the date of the latest revision.
I encourage you to review this page periodically.
Contact and Complaints
If you have questions about this Privacy Policy, wish to exercise your data protection rights or have concerns about how your personal data is handled, please contact me:
Claudia Wiebe
Ziegelstraße 15/1
88214 Ravensburg, Germany
Email: claudia@claudiawiebe.com
You also have the right to lodge a complaint with the competent data protection supervisory authority - Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW).
