Privacy Policy

1. Data Controller

Iryna Novytska, aka “Virinaflora”
Location: Setúbal, Portugal
Email: hellovirinaflora.com

2. Contact Form & Communications

When you send a message through the contact form, we collect your name, email address, and message contents.

• Purpose: To respond directly to your inquiry and discuss potential collaborations or commissions.
• Legal Basis: Our legitimate interests under Art. 6(1)(f) GDPR to respond to inquiries, or taking steps prior to entering into a contract under Art. 6(1)(b) GDPR.
• Service Provider: Messages are transmitted and delivered via Resend. Your contact details are never added to a mailing or marketing list.
• Retention: Inquiries are retained only for as long as necessary to handle your communication or satisfy standard business and tax recordkeeping obligations.

3. Spam Protection & Security

The contact form is protected by Cloudflare Turnstile to prevent automated abuse and spam without displaying invasive puzzles.

• Data Processed: Turnstile evaluates browser signals, technical metadata, and IP address. Your IP address is also temporarily cached to rate-limit repetitive submissions.
• Legal Basis: Legitimate interests under Art. 6(1)(f) GDPR to safeguard our website infrastructure from malicious traffic and spam.

4. Hosting & Media Delivery

This website is hosted on Vercel, and media assets (such as images and videos) are delivered through Sanity CDN.

• Data Processed: Standard server logs may briefly collect technical network information (such as IP address, user-agent, and requested file paths) to ensure delivery, stability, and operational security.
• Legal Basis: Legitimate interests under Art. 6(1)(f) GDPR to provide a reliable, functioning website.

5. Privacy-Friendly Analytics

This website may use a self-hosted instance of Umami to measure aggregate visitor metrics.

• Umami does not use cookies, does not store personal data, and does not track users across other websites.
• All visit metrics are completely aggregated and anonymous.

6. International Data Transfers

Infrastructure providers such as Vercel, Cloudflare, and Resend may process technical request data outside the European Economic Area (EEA), including in the United States. Where personal data is transferred internationally, it is protected under appropriate legal transfer mechanisms, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (SCCs).

7. Your Rights & Supervisory Authority

Under the General Data Protection Regulation (GDPR), you have the right to:

• Request access to, correction of, or deletion of your personal data.
• Restrict or object to the processing of your personal data.
• Request data portability.

To exercise any of these rights, email us at hellovirinaflora.com.

You also have the right to lodge a complaint with a competent supervisory authority, particularly in the EU/EEA member state of your habitual residence, place of work, or where the alleged infringement occurred.