Privacy Notice

Private View: studio enquiries

When you submit an enquiry, we use your name, email, optional country, selected works, budget, timing and message to respond and, at your request, prepare a possible offer (pre-contractual steps). The notice checkbox acknowledges reading, not marketing consent. This form is for adults. Do not send sensitive data, identity documents or payment details.

The source and campaign, when present in the link, are stored only with your enquiry to evaluate which channels generate requests, on the legitimate-interest basis of improving the service. This flow uses no advertising pixels, advertising identifiers or analytics cookies. To limit abuse, we temporarily store daily technical fingerprints of network addresses and emails, not raw IP addresses in the enquiry tables; counters expire within two days and are removed at the next enquiry.

Only authorised administrators can see enquiries. We use the Sites/OpenAI and Cloudflare infrastructure described below; your message is not sent to AI services for recommendations. Photos chosen for the wall preview remain in your browser and are not uploaded. Selections use simple catalog rules and do not make decisions with legal effects on you.

Enquiry details are removed after 180 days without an update, at the next enquiry intake or administration operation. Any sales documents are separate and follow the obligations applicable to that transaction. Guest enquiries are independent of a profile: contact the operator with your reference for access, correction, objection or erasure. Administrators can delete individual requests. This form does not subscribe you to newsletters or send marketing campaigns.

1. Who is responsible

HOUSE OF BEBA S.R.L., Romanian tax identifier 45780216, Trade Register number J2022004626402, registered office: Strada Gheorghe Țițeica nr. 169, etaj 3, apartament 8, Sector 2, București, România. Contact for the website, certificates and personal data: bogdan.nedelcov@houseofbeba.com.

This notice covers the archive, accounts and certificate verification. You do not need an account to browse public content. BEBA does not request your identity-provider password, payment details or an identity-document copy for ordinary registration.

2. Data and purposes

Account: technical identifier, verified email, identity-provider name, preferred name, username, optional biography, language, role, status, accepted terms version and acceptance time. These support access, preferences, account administration and registration records. Likes are linked to your account for synchronisation.

Certificates: code, artwork details, private registered-holder link, acquisition explanation, voluntarily supplied additional information, optional phone number and photographic evidence. These support manual review and communicating the outcome. The public certificate page does not disclose the claimant's name, email, phone or evidence photos.

Security and communication: technical events, administrative changes, claims and service-email delivery records. Infrastructure may process IP addresses, browser information and logs needed to deliver and secure the service. We have not integrated audience analytics, advertising pixels or advertising profiling.

3. Legal grounds

Data strictly necessary for an account and your claims support the requested service and registration steps. Security, prevention of fraudulent claims and registry integrity rely on legitimate interests balanced against individuals' rights. A specific legal obligation may require relevant records to be retained.

Marketing, if offered later, requires a separate optional choice that you can withdraw. Acknowledging this notice is not blanket consent. An account is not conditional on promotional messages. Certificate verification involves human review, not solely automated decisions with legal effects.

4. Providers and transfers

The service uses Sites/OpenAI for the platform and ChatGPT authentication, Cloudflare for infrastructure, database and files, Supabase for enabled identity-provider authentication, and Resend for service emails when delivery is configured. Only data necessary for each function are transmitted. Google, Microsoft or another selected provider sees the authentication request under its own notice. This authentication does not give us access to your inbox, contacts or social-account content.

Provider infrastructure and support may involve processing outside the European Economic Area; we do not claim all data stay exclusively in Romania. Transfers must use applicable GDPR mechanisms, such as adequacy decisions or contractual safeguards, with necessary measures. You may request information about recipients and applicable safeguards. Data are not sold to advertisers.

5. Retention and erasure

Account data and likes are retained while the account is active. Claim data support review and administration of the private registry association. Account erasure removes operational profile data, likes, claims and evidence photos, and removes the private owner link. The artwork record and code, without your identity, may remain in the archive.

A dispute, documented fraud concern or legal obligation may require limited records to be retained only as necessary for that case, for the duration of proceedings and applicable statutory periods. A minimal technical closed-account identifier may be kept to block old-session reuse. Emails already received by recipients and independent provider accounts cannot be erased through BEBA.

An external outage may delay completion without restoring account access. Backups follow infrastructure recovery and elimination cycles; their duration depends on recovery needs, provider configuration and specific applicable obligations. They are not an archive intended to reuse erased data.

6. Rights and contact

Subject to GDPR conditions, you may request access, a data copy, rectification, erasure, restriction or portability, or object to processing. You may withdraw consent-based processing for the future. You may complain to Romania's ANSPDCP or your competent authority.

Contact us specifying the right you wish to exercise. We verify identity proportionately to risk, without automatically requiring an identity-document copy. We normally respond within one month; any permitted complexity extension is explained within that period. If a request cannot be fully met, we explain the reasons and available challenge routes.

7. Minors and updates

Minors may browse public content. Self-service accounts are for people aged at least 16; minors are subject to the legal-representation rules in the Terms. If we learn that a younger child registered without the representative process, we suspend use pending review or erase data that should not be retained.

We publish the current version here. Material changes to purposes, recipients or functions are communicated before they apply, and separate consent is sought when required. Silence is not agreement to new purposes.