top of page

Privacy Policy

Last updated: October 2026

This page explains which personal data I process when you visit this website and what rights you have (in accordance with the EU General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021)).​

1. Controller

Sandra Hoffmann (Künstlername: shine) Klosterneuburg, Österreich

E-Mail: shine.abstractart@gmail.com

​

2. What data I process

Visiting the website: When you access this site, technically necessary data is collected (e.g. IP address, time of access, page visited, browser). The purpose is the secure operation of the website. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Enquiries via contact form or email: I process your name, email address and message in order to respond to your enquiry about an artwork, a commission or a studio visit. Legal basis: pre-contractual measures or legitimate interest (Art. 6(1)(b) and (f) GDPR).

Purchases: If you buy an artwork, I additionally process billing and delivery data for order handling and invoicing. Payment is made by bank transfer or in cash; no payment data is collected via this website. Legal basis: performance of a contract and legal obligations (Art. 6(1)(b) and (c) GDPR).

3. Cookies

Technically necessary cookies are set without consent (Section 165(3) TKG 2021). All other cookies are only set with your consent (Art. 6(1)(a) GDPR), which you can give via the cookie banner and withdraw at any time via "Cookie Settings" at the bottom of the page. The banner is operated by Usercentrics GmbH, Sonnenstraße 23, 80331 Munich, Germany; your consent decision is stored.

4. Recipients and storage location

I do not share or sell your data. The following service providers process data on my behalf:

  • Wix.com Ltd., Tel Aviv, Israel – website hosting and contact form

  • Usercentrics GmbH, Munich, Germany – cookie banner

  • Google Ireland Limited, Dublin, Ireland – email inbox (Gmail)

Data may also be transferred to Israel and the USA. Israel is covered by an EU adequacy decision; transfers to the USA are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses. The website is transmitted in encrypted form (HTTPS).

5. Retention period

I delete enquiries that do not lead to a purchase no later than 12 months after our correspondence ends. Purchase and invoice data is retained for 7 years (Section 132 Austrian Federal Fiscal Code, BAO).

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent. To exercise these rights, simply email me at shine.abstractart@gmail.com.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at.

7. Links to Instagram

I link to my Instagram profile (Meta Platforms Ireland Ltd.). Data is only transferred when you click the link; Meta's privacy policy applies there.

bottom of page