Privacy Policy & Cookie Policy

Last updated: 23 October 2026

Data Controller

The controller responsible for the processing of personal data on this website is:

Eva Gamaiun
Freiberufliche Künstlerin
Germany

Email: hello@evagamayun.com

Personal Data I Collect

I collect and process personal data only where necessary to operate this website, communicate with you, process orders, provide requested services, or comply with legal obligations.

Depending on how you use this website, this may include:

Your name and contact details;
Billing and shipping addresses;
Email address and information you provide when contacting me;
Order details, purchase history and payment status;
Payment-related information necessary to process transactions;
Information provided when subscribing to my newsletter;
Information relating to cancellations, withdrawal requests, returns, refunds and complaints, including information submitted through the withdrawal form;
Technical information necessary to operate and secure the website, such as IP addresses, browser and device information.

How I Use Your Personal Data

Your personal data may be used to:

Provide, operate and maintain this website and online shop;
Process payments, orders and deliveries;
Respond to enquiries and provide customer support;
Send newsletters where you have subscribed;
Process withdrawal requests, returns, refunds and complaints;
Maintain the security and functionality of the website;
Comply with legal, accounting and tax obligations;
Protect my legitimate interests where permitted by applicable law.

Legal Bases for Processing

Depending on the circumstances, personal data is processed on the following legal bases under the General Data Protection Regulation (GDPR):

Art. 6(1)(b) GDPR — processing necessary to fulfil a contract or take steps at your request before entering into a contract;
Art. 6(1)(c) GDPR — processing necessary to comply with a legal obligation;
Art. 6(1)(f) GDPR — processing necessary for my legitimate interests, provided these interests are not overridden by your rights and freedoms;
Art. 6(1)(a) GDPR — processing based on your consent, where consent is required.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Website Hosting and WooCommerce

This website is built using WordPress and Elementor and is hosted through Elementor Hosting.

The hosting provider processes technical information necessary to deliver, maintain and secure the website. This may include IP addresses, browser and device information, access times, requested pages and server log information.

Such processing is generally based on my legitimate interest in providing a secure and functional website under Art. 6(1)(f) GDPR.

The online shop operates using WooCommerce, a WordPress e-commerce platform. WooCommerce processes information necessary to manage orders, checkout, customer information, payment status, refunds and other shop-related functions.

Relevant customer and order information may be stored in the website's WordPress database and made available to authorised service providers where necessary to operate the shop.

Elementor Hosting and other technical service providers may use subprocessors to deliver their services.

For more information, please see:

Payments

Payments on this website are processed through WooPayments and PayPal, depending on the payment method selected at checkout.

These providers may receive personal and payment-related information necessary to process transactions, prevent fraud, provide payment security, handle disputes and comply with applicable legal obligations.

WooPayments uses third-party payment infrastructure, including Stripe, to process payments. PayPal processes payments according to its own applicable terms and privacy policy.

Depending on the service and purpose of processing, payment providers may act as independent data controllers for certain processing activities.

I receive transaction-related information, such as payment status, transaction references and order details, but I do not receive or store full payment card numbers or card security codes.

For further information, please see:

Shipping and Fulfilment

To fulfil an order, I may share the information necessary to produce and deliver your purchase with shipping providers and fulfilment partners. This may include your name, delivery address, contact details and relevant order information.

Depending on the destination and shipping method, orders may be delivered using postal and courier services, including Deutsche Post / DHL for standard shipping and DHL Express for express delivery.

For some products, such as fine-art prints, I use Prodigi as a production and fulfilment service. Prodigi may receive the customer information necessary to produce, package and ship the purchased product.

For orders of the Evidence-Based Magic Oracle Deck, I use Next Smart Ship as a fulfilment provider. The information necessary to process and deliver these orders may be shared with Next Smart Ship.

These providers may use production partners, logistics providers and shipping carriers as necessary to fulfil orders.

Personal data is shared only to the extent reasonably necessary for the relevant order and delivery.

For more information, please see:

Contact Forms

If you contact me through a contact form on this website, I process the information you provide, such as your name, email address and message, in order to respond to your enquiry.

Information submitted through contact forms is sent to my email address and is not additionally stored in the website's database.

Messages received by email may be retained for as long as necessary to respond to your enquiry, handle related correspondence or comply with applicable legal obligations.

Depending on the nature of your enquiry, processing is based on Art. 6(1)(b) or Art. 6(1)(f) GDPR.

If you subscribe to my newsletter, your email address and any other information you voluntarily provide during registration will be processed to send you newsletters and other communications you have requested.

Newsletter subscriptions are managed through Mail Mint, a WordPress-based email marketing system.

Newsletter emails are delivered using SMTP2GO, which processes email addresses and technical delivery information for this purpose.

Subscription information and related records may be stored in the website's WordPress database. Technical email delivery providers may process the information necessary to deliver messages.

Newsletter processing is based on your consent under Art. 6(1)(a) GDPR.

You can unsubscribe at any time using the unsubscribe link included in each newsletter or by contacting me directly.

After unsubscribing, your email address will no longer be used for newsletter delivery. Limited records may be retained where necessary to document consent, withdrawal or compliance with legal obligations.

External Links

This website may contain links to third-party websites and social media platforms.

Following these links takes you to the respective third-party website, where your personal data may be processed according to that provider's own privacy policy.

I am not responsible for the privacy practices or content of external websites.

Cookies and Similar Technologies

This website uses cookies and similar technologies necessary for the operation, security and functionality of the website and online shop.

WordPress and WooCommerce may use technically necessary cookies to maintain shopping cart contents, manage checkout sessions and support other essential shop functions.

Depending on the features used, these may include WooCommerce session and cart cookies, such as woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_*.

These cookies support the functionality of the online shop and are not used by me for advertising purposes.

At present, I do not use Google Analytics, Meta Pixel or other third-party advertising or behavioural tracking technologies.

Where cookies or similar technologies are not strictly necessary, they will only be used in accordance with applicable law and, where required, with your consent.

The storage of information on, or access to information from, your device is governed by applicable data protection and telecommunications privacy laws, including §25 TDDDG (German Telecommunications-Telemedia Data Protection Act).

You can also manage or delete cookies through your browser settings. Disabling necessary cookies may affect the functionality of the shopping cart and checkout.

International Data Transfers

Some service providers may process personal data outside the European Economic Area (EEA).

This may include hosting-related service providers, payment providers, email delivery services and international fulfilment partners.

Where personal data is transferred outside the EEA, applicable data protection requirements must be observed. Depending on the circumstances, transfers may rely on an adequacy decision by the European Commission, appropriate safeguards such as Standard Contractual Clauses, or another legally recognised transfer mechanism.

For more information about international data transfers by individual service providers, please refer to their respective privacy policies.

Data Retention

I retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law.

Order, invoice and accounting records may be subject to statutory retention periods under German commercial and tax law. The applicable period depends on the type of record and the relevant legal requirements.

Customer and order information stored in WooCommerce may be retained as necessary for order fulfilment, customer service, accounting, legal compliance and the establishment, exercise or defence of legal claims.

Contact enquiries are generally retained only for as long as necessary to handle the enquiry and any related follow-up, unless longer retention is required or justified.

Newsletter subscription data is retained until you unsubscribe, subject to any limited records necessary to document consent or comply with legal obligations.

Technical and security-related information is retained only for as long as necessary for the relevant operational or security purpose, subject to applicable requirements.

Your Rights

Depending on the circumstances and applicable law, you have the right to:

Request access to your personal data;
Request correction of inaccurate or incomplete data;
Request deletion of your personal data;
Request restriction of processing;
Object to certain processing;
Request data portability;
Withdraw consent where processing is based on consent;
Lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, please use the contact form or email me at hello@evagamayun.com.

Contact

If you have any questions about this Privacy Policy or would like to exercise your rights, please use the contact form or email me at:

hello@evagamayun.com