Legal
Privacy policy
How this site collects, uses and protects personal data, and what you can ask us to do with it.
Last updated: 8 August 2026
1. Who is responsible for your data
The data controller is Andre Minato, working as Minato, an independent artist. Written questions about this policy, or about the data we hold on you, go to the contact page, or by email to studio@minato.art.
To complete before publishing: a postal address for the controller, and confirmation of the contact email. The GDPR requires the identity and contact details of the controller to be stated. If you are registered as a business in a member state, add the registration details here.
2. What we collect, and why
Contact form
Name, email address, phone number if you provide one, reason for writing and the text of your message.
Why: to answer you. Legal basis: Article 6(1)(b), steps taken at your request before entering into a contract, where the message concerns a possible agreement with the studio; otherwise Article 6(1)(f), our legitimate interest in replying to people who write to us.
Email list
Your email address.
Why: to tell you about new collections, private viewings and openings. Legal basis: Article 6(1)(a), your consent, given when you submit the form. You can withdraw it at any time and every message carries an unsubscribe link.
Atelier Aquarelle applications
Name, nationality, city, email address, phone number, a link you choose to share, preferred working language, and your written answers about your intention and your relationship with painting.
Why: to read your application and select the twelve participants. Legal basis: Article 6(1)(a), your consent, together with Article 6(1)(b) for steps taken before a possible booking. Consent is given by ticking the box, which is never pre-ticked and has to be ticked again on every submission.
The answers you write are free text. Please do not include information you would not want us to read, and in particular do not include special category data as defined in Article 9, such as health, religion, political opinions or sexual orientation. We do not ask for any of it and we do not need it.
Technical data
Our hosting provider records standard server logs, which include IP addresses, for security and to keep the site running. We do not analyse them for marketing and we do not combine them with anything else.
Legal basis: Article 6(1)(f), our legitimate interest in operating a secure site.
3. Cookies and browser storage
This site sets no cookies. There is no analytics, no advertising, no tracking pixel and no social media widget. That is why you are not seeing a cookie banner: there is nothing to consent to.
One exception, which is not a cookie but does use your browser's storage. On the Atelier
Aquarelle application page, your answers and the step you are on are saved in
localStorage so that you can close the tab and pick up where you left off. That
data stays on your device, is never sent anywhere until you press submit, expires after
seven days and is deleted the moment your application is sent. Your consent tick is never
stored. You can clear it at any time from your browser settings.
4. Who else processes your data
We use the following providers, each acting as a processor under a data processing agreement. Several are based in the United States; those transfers rely on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
| Provider | What it does | Where |
|---|---|---|
| Vercel | Hosting and delivery of the site | United States |
| Formspree | Delivery of the contact form and the email list form | United States |
| Notion | Storage of Atelier Aquarelle applications | United States |
| Resend | Notification email when an application arrives | United States |
| Upstash | Rate limiting, stores a temporary hashed record of the IP address | European Union |
| Google Fonts | Serves the typefaces used on this site | United States |
Note on Google Fonts. Loading the typefaces from Google's servers means your IP address reaches Google when a page opens. German courts have treated this as a transfer of personal data without consent. We intend to serve the typefaces from this domain instead, which removes the third party entirely. Until that change is made, this row stays in the table.
We never sell your data and we never share it for anyone else's marketing.
5. How long we keep it
| Data | Retention |
|---|---|
| Messages sent through the contact form | Two years from the last exchange, then deleted |
| Messages that lead to a contract | As long as required by tax and accounting law |
| Email list | Until you unsubscribe |
| Aquarelle applications, not selected | Twelve months, so we can invite you to a later round |
| Aquarelle applications, selected | Two years after the session |
| Draft saved in your browser | Seven days, or until you submit |
| Server logs | As set by our hosting provider, typically under 30 days |
6. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy.
- Rectify anything inaccurate or incomplete.
- Erase your data, where there is no legal reason for us to keep it.
- Restrict how we use it while a dispute is resolved.
- Portability: receive your data in a structured, machine readable format.
- Object to processing based on legitimate interest.
- Withdraw consent at any time, without affecting anything done before you withdrew it.
Write to studio@minato.art. We answer within one month. There is no charge, and you do not have to give a reason.
If you think we have handled your data badly, you can complain to the supervisory authority in the country where you live or work. In Germany, that is the data protection authority of your federal state. You do not need to speak to us first, though we would rather you did.
7. Automated decisions
None. Applications to Atelier Aquarelle are read and selected by a person. There is no profiling and no automated decision making within the meaning of Article 22.
8. Children
This site is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, write to us and we will delete it.
9. How your data is protected
The site is served over HTTPS only. Applications travel encrypted and are stored in access controlled accounts. The application endpoint validates and limits everything it receives, and rejects anything malformed. Our server logs record whether a submission succeeded, never its contents.
10. Changes to this policy
If we change how we handle personal data, we update this page and the date at the top. Substantial changes affecting people already on the email list will be announced by email.
This policy is written to be read, not to be survived. If any part of it is unclear, ask and we will explain it.