AUREN
Privacy Policy
Draft for final legal and technical verification. Matters marked “TO VERIFY BEFORE PUBLICATION” must be confirmed against the live website configuration before this notice is published.
1. Data Controller
AUREN is a bespoke art concept operated by Solenya S.a.r.l., the data controller for personal data processed in connection with AUREN enquiries and commissions.
Solenya S.a.r.l. · 4, rue d’Arlon · L-8399 Windhof · Luxembourg.
The intended contact address is contact@auren.art. This email address is not yet activated and must not be relied upon for privacy requests until activation has been confirmed. In the meantime, requests may be sent to the postal address above.
TO VERIFY BEFORE PUBLICATION: confirm the operational privacy contact channel and whether a data protection officer or representative is required.
2. Personal Data We Collect
When you contact AUREN through its enquiry form, we collect the information you submit: your name, email address, commission interest and message, together with your response to the privacy consent checkbox. Correspondence may include additional information you choose to provide about a potential commission. Please do not include unnecessary sensitive personal information.
Framer is used for website hosting, forms and integrated analytics. These services may involve technical information in addition to submitted form content.
TO VERIFY BEFORE PUBLICATION: identify the technical data actually processed, including any IP addresses, device or browser information, timestamps, logs, spam-prevention data, analytics identifiers or consent records. Do not assume that a particular category is collected without checking the configured services.
3. Purpose and Legal Basis
AUREN processes enquiry information to respond personally, understand the proposed artwork, discuss a possible commission and manage related correspondence. If you request steps towards a commission before entering into a contract, processing necessary for those steps may rely on Article 6(1)(b) GDPR. Processing necessary to fulfil an agreed commission may also rely on Article 6(1)(b).
Where an enquiry is made on behalf of an institution or company, or processing is not necessary for a contract with the individual concerned, an appropriate basis may be legitimate interests under Article 6(1)(f), such as responding to professional enquiries. TO VERIFY BEFORE PUBLICATION: confirm the applicable basis and document the specific interests and balancing assessment.
Where AUREN relies on consent, Article 6(1)(a) applies. Consent can be withdrawn at any time without affecting processing lawfully carried out before withdrawal. The enquiry checkbox is not consent to marketing or unrelated uses. Any processing required by an applicable legal obligation must be assessed under Article 6(1)(c).
TO VERIFY BEFORE PUBLICATION: map each actual processing activity to its legal basis, including forms, security measures and analytics, and confirm the role of the consent statement shown on the contact form.
4. Contact Forms and Service Providers
AUREN uses Framer for website hosting, native contact forms and integrated analytics. Enquiries submitted through the website are processed through the configured Framer form service and made available through the submission destinations set for AUREN.
TO VERIFY BEFORE PUBLICATION: confirm the recipient configured for the form, the actual form storage and forwarding arrangements, who can access submissions, and any email or other services involved in handling correspondence. The intended contact@auren.art mailbox is not yet active.
TO VERIFY BEFORE PUBLICATION: review Framer’s applicable data protection terms and processing agreement, confirm the roles of the parties and the relevant subprocessors, and document any additional providers. No unverified provider-specific processing or retention details are asserted in this policy.
5. Data Retention
Enquiries that do not result in a commission are generally deleted from AUREN’s own correspondence records within six months after the last relevant communication, unless longer retention is required or justified. Where information is retained longer, the reason and appropriate retention period should be documented.
Information relating to an agreed commission may need to be retained to manage the relationship and meet applicable legal obligations. TO VERIFY BEFORE PUBLICATION: confirm the retention rules for commission, contractual, accounting and other records; no unverified period is stated here.
The six-month correspondence rule does not establish retention periods for Framer, email providers, analytics, technical logs, backups or other service-provider systems. TO VERIFY BEFORE PUBLICATION: check those systems’ actual settings, provider retention terms and deletion procedures, including whether records can be removed from all relevant locations.
6. Website Analytics and Cookies
AUREN uses Framer’s integrated analytics. No additional Google Analytics or Meta Pixel scripts are currently installed through Framer Custom Code. This statement is limited to that configuration and does not establish whether other integrations, embeds or technologies are present elsewhere on the site.
TO VERIFY BEFORE PUBLICATION: confirm the analytics data actually collected, whether it constitutes personal data, its purposes, applicable legal basis and retention arrangements. Verify whether the live site sets cookies, uses local storage or employs other similar technologies, including through forms and any embedded services.
Where consent is required for cookies or similar technologies, it must be obtained before the relevant processing begins and visitors must have an appropriate way to withdraw it. TO VERIFY BEFORE PUBLICATION: determine whether a consent mechanism is necessary and confirm that the implemented mechanism and policy accurately reflect the live site. No assertion that the site is cookie-free or that a particular tracking technology is active is made without verification.
7. International Data Transfers
The use of Framer or other configured providers may involve processing or access outside the European Economic Area. The actual locations and arrangements must be checked; this policy does not assume a particular destination country or transfer safeguard.
TO VERIFY BEFORE PUBLICATION: identify any actual international transfers, the relevant recipients and countries, and the applicable GDPR safeguards or other valid transfer basis. Confirm the relevant contractual documents and how individuals can obtain information about the safeguards. Do not describe standard contractual clauses, adequacy decisions or other arrangements as being in place until they have been verified.
8. Your Rights
Subject to the conditions and exceptions in the GDPR, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing and data portability where applicable. You may object to processing based on legitimate interests, and withdraw consent where consent is relied upon. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Privacy requests may be addressed to Solenya S.a.r.l. at 4, rue d’Arlon, L-8399 Windhof, Luxembourg. The future address contact@auren.art will be available only after activation; it is not currently an operational privacy contact. AUREN may need appropriate information to verify a requester’s identity, limited to what is necessary for the request.
You have the right to lodge a complaint with a competent supervisory authority. In Luxembourg, this is the Commission nationale pour la protection des données (CNPD). You may also contact the supervisory authority in the EU Member State of your habitual residence, place of work or the alleged infringement, as applicable.
TO VERIFY BEFORE PUBLICATION: confirm the operational request-handling procedure, contact channel and any details needed to enable individuals to exercise their rights effectively.
9. Updates to This Policy
This policy may be updated to reflect changes in AUREN’s activities, website configuration, service providers or legal requirements. The current version should remain accessible on the website, and material changes should be communicated where appropriate.
Effective date and last review: [TO COMPLETE BEFORE PUBLICATION — verified date].
This document is a draft prepared from the approved information. All items marked for verification, including email activation, technical processing, legal bases, provider arrangements, retention and international transfers, must be checked before publication.