Privacy Policy Agreement
Effective Date: August 5, 2026.
Last Updated: August 14, 2026
Version: 2.1 (GDPR‑Compliant 2026)
1. Who We Are
Website: https://dfnungaray.com
Business Name: dFNungaray
Business Type: E-commerce art gallery (WooCommerce platform) specializing in the sale and worldwide export of oil paintings and wood sculptures.
We are committed to protecting your personal data and respecting your privacy rights under the General Data Protection Regulation (GDPR) and applicable international data protection laws. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website, create an account, make a purchase, or interact with us in any way.
Primary Contact for Privacy Matters:
Email:
website.administrator@dfnungaray.comResponse Time: Within 30 calendar days
2. Legal Basis for Processing Personal Data
Under GDPR Article 6, we process your personal data only when we have a lawful basis to do so. Below are the bases we rely on:
Processing Purpose
Data Category
Legal Basis
GDPR Article
Order fulfillment and delivery
Name, billing address, shipping address, email, phone number
Performance of contract
Article 6(1)(b)
Payment processing
Payment method information (processed by third parties; we don’t store card data)
Performance of contract
Article 6(1)(b)
Tax and accounting compliance
Name, address, invoice details, purchase history, tax ID (if applicable)
Legal obligation
Article 6(1)(c)
Fraud prevention and account security
IP address, device information, login history
Legitimate interest (protecting our business and users)
Article 6(1)(f)
Website analytics and improvement
Cookies, IP address, pages visited, user behavior, device type
Consent (for non-essential cookies)
Article 6(1)(a) and Article 7
Marketing communications (newsletters, product updates)
Email address, name, purchase history
Consent (separate opt-in; separate from contract)
Article 6(1)(a) and Article 7
Customer support and inquiry responses
Name, email, phone number, inquiry details
Performance of contract / Legitimate interest
Article 6(1)(b) or (f)
Shipping coordination and customs compliance
Full name, address, phone number, artwork details, value
Legal obligation (customs regulations)
Article 6(1)(c)
Automated profiling or marketing segmentation
Purchase history, browsing behavior, preferences
Legitimate interest / Consent
Article 6(1)(a) or (f)
Our Legitimate Interest Assessment: Where we rely on legitimate interests (e.g., fraud prevention, analytics), we have conducted balancing tests confirming that our interests do not override your fundamental rights and freedoms. You have the right to object to such processing at any time.
3. What Personal Data We Collect and Why
3.1 Orders and Billing Information
- What we collect:
- Full name (first and last name)
- Billing address (street, city, postal code, country)
- Shipping address (may differ from billing address)
- Email address
- Phone number
- County of origin and destination
- Invoice and order history
- Why we collect it:
- To process your order accurately
- To arrange shipping and delivery
- To generate invoice and comply with tax obligations
- To contact you about your order status
- To prevent fraud and verify customer identity
Legal Basis: Performance of contract (Article 6(1)(b)) and legal obligation for tax compliance (Article 6(1)(c))
3.2 Payment Information
- What we collect:
- Payment method type (credit card, GooglePay account, etc.)
- Transaction amount and date
- Payment status and receipt information
- What we do NOT collect or store:
- Full credit card numbers (PCI-DSS compliant)
- Card security codes (CVV/CVC)
- Full bank account details
- Passwords for payment accounts
- Why we collect it:
- To process your transaction securely
- To generate payment receipts
- To reconcile accounts and prevent duplicate charges
- To dispute fraudulent transactions if necessary
How it’s protected: Payments are processed exclusively through secure third-party payment processors (Stripe, Google Pay, Mercado Pago or similar PCI-DSS certified providers). These processors act as data processors on our behalf. We do not handle or store sensitive payment data on our servers. All payment transactions are encrypted using SSL/TLS 256-bit encryption.
Legal Basis: Performance of contract (Article 6(1)(b))
3.3 Account and Authentication Data
- What we collect:
- Username (chosen by you)
- Email address (used for login)
- Password (hashed and encrypted, one-way encryption)
- Account creation date
- Login history and IP addresses used to access the account
- Account settings and preferences
- Wishlist or saved items (if applicable)
- Why we collect it:
- To create and manage your account
- To allow you to view your order history
- To enable secure login
- To prevent unauthorized account access
- To help you recover your account if needed
How it’s protected: Passwords are hashed using industry-standard algorithms (bcrypt (default), SHA-384 pre-hashing, or Argon2ID) and are never stored in plain text. Only you and our system have access to your account. We never ask for your password via email.
Legal Basis: Performance of contract (Article 6(1)(b)) and fraud prevention (Article 6(1)(f))
3.5 Customer Support and Communication Data
- What we collect:
- Email address
- Name
- Message content and attachments
- Phone number (if provided)
- Inquiry topic and timestamp
- Why we collect it:
- To respond to your questions or complaints
- To provide customer support
- To track support tickets and resolutions
- To improve our service quality
Legal basis: Performance of contract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f))
3.6 IP Address and Device Information
- What we collect:
- IP address (Internet Protocol address)
- Device type (desktop, mobile, tablet)
- Browser type and version
- Operating system
- Device identifiers
- Approximate geolocation (based on IP)
- Why we collect it:
- To prevent fraud and unauthorized access
- To diagnose technical issues and optimize site performance
- To understand traffic sources and user demographics
- To comply with security and legal obligations
- To detect and prevent cyberattacks or suspicious activity
Legal basis: Legitimate interest (Article 6(1)(f)) and legal obligation (Article 6(1)(c))
International Data Transfer
DFNungaray ArtStore is a mexican webstore hosted in USA, secured through CDN through worldwide servers. Since you purchase from us globally your personal data may be transferred to and processed in countries outside the European Union/European Economic Area (EU/EEA).