Privacy Policy
Last updated: 1 October 2026
At Jonna Freya, I value your privacy and want to be transparent about how I collect, use and protect personal data.
This Privacy Policy explains what personal data I may collect when you visit jonnafreya.com, contact me, purchase an artwork, submit a withdrawal request, or request a commission, and how I use that information.
Jonna Freya is responsible for the processing of your personal data as described in this Privacy Policy.
1. Who I am
Jonna Freya
KVK: 42143777
VAT: NL005531635B226
Website: jonnafreya.com
Email: info@jonnafreya.com
The Netherlands
For privacy-related questions, you can contact me at info@jonnafreya.com.
2. What personal data I collect
Depending on how you interact with my website and services, I may collect the following categories of personal data.
When you place an order
I may collect:
your name
billing and delivery address
email address
telephone number, if provided or required for delivery
details of the products you purchase
order number and order history
payment and transaction information
information required for invoicing and accounting
I do not need or intend to store your full payment card details. Payment information is processed through the relevant payment provider.
When you contact me
If you contact me by email or through a contact form, I may collect:
your name
email address
any other contact details you provide
the content of your message
information you choose to include in an enquiry
I use this information to respond to your message, enquiry or request and to provide customer service.
When you submit a withdrawal request
If you use the online withdrawal form, I may collect:
your name
email address
order number
the product or products concerned
information you provide in your withdrawal request
I use this information to process your withdrawal and any resulting return or refund.
When you request a commission
If you submit a commission enquiry, I may collect:
your name
email address
contact details
information about your desired artwork
preferred size and materials
budget
requested timeframe
reference photographs or other files you provide
other information necessary to discuss and complete the commission
Reference photographs are only used for the purposes for which they were provided, such as discussing and creating your commission, unless another use has been separately agreed.
When you visit the website
Depending on your cookie and privacy settings, technical information may be processed when you use the website, such as:
IP address
browser type and version
device type
operating system
pages visited
date and time of visits
referring website
interactions with the website
cookie and consent information
Some of this information may be collected automatically by Squarespace as part of operating and securing the website.
3. How I use your personal data
I use personal data only where there is a valid legal basis and only for purposes that are relevant to my business.
This may include:
Processing and fulfilling orders
I use your information to:
process your order
receive and confirm payment
prepare and ship your artwork
communicate with you about your order
handle returns, refunds or complaints
provide customer service
The legal basis is generally the performance of a contract with you.
Processing withdrawal requests
I use your information to:
receive and process your withdrawal request
identify the relevant order
arrange returns and refunds
communicate with you about your withdrawal
The legal basis is generally the performance of a contract with you and compliance with applicable consumer law.
Processing commission requests
I use your information to:
respond to your commission enquiry
discuss your wishes and requirements
prepare a quote
communicate with you during the commission process
create and deliver the commissioned artwork
The legal basis is generally taking steps at your request before entering into a contract and, once the commission is accepted, performing the contract.
Accounting and legal obligations
I may process order and transaction information to:
maintain business records
issue invoices
comply with tax and accounting obligations
comply with other legal requirements
The legal basis is compliance with a legal obligation.
Communication
I may use your contact details to respond to questions, enquiries, orders, commissions, returns or other requests you have made.
The legal basis depends on the nature of the communication and may include contract, pre-contractual measures or legitimate interests.
Website operation and security
Technical information may be processed to:
operate the website
maintain website security
prevent misuse
remember necessary preferences
keep the webshop and checkout functioning correctly
The legal basis may be legitimate interest or another applicable legal basis depending on the specific processing.
Analytics and marketing
At present, optional analytics and advertising cookies are disabled on my website.
If I introduce optional analytics, advertising or other tracking technologies in the future, I will update this Privacy Policy and Cookie Policy where necessary and obtain consent where legally required.
4. Cookies
My website uses cookies and similar technologies.
Necessary cookies are used to operate essential website functions, such as the webshop, checkout and remembering relevant preferences.
Optional analytics and advertising cookies are currently disabled.
For more information about the cookies used on the website and how to manage your preferences, please see my Cookie Policy.
5. Who I share your data with
I may share personal data with service providers where this is necessary to operate my business and provide services to you.
Depending on how you use the website, these may include:
Squarespace
My website and webshop are hosted and operated using Squarespace.
Squarespace may process information necessary to host the website, operate the webshop, process orders and payments, maintain security and provide related services.
Payment providers
Payments may be processed through payment providers available through my website, including Squarespace Payments and PayPal, depending on the payment method you choose.
These providers process payment information according to their own privacy policies.
Delivery providers
I may share your name, delivery address and other information necessary for shipping with the relevant postal or delivery service.
Google Workspace
I use Google Workspace for business email and related business services.
Information you send to info@jonnafreya.com may therefore be processed through Google Workspace.
Professional advisers and authorities
Where necessary, I may share information with professional advisers, accountants, government authorities or other parties where this is legally required or necessary to protect my legal rights.
I do not sell your personal data.
6. International data transfers
Some of the service providers I use may process or store personal data outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, I rely on an applicable legal transfer mechanism and appropriate safeguards where required by applicable data protection law.
The relevant service providers may have their own information about international data transfers in their privacy policies.
7. How long I keep your data
I do not keep personal data longer than necessary for the purposes for which it was collected, unless a longer retention period is required by law.
Different types of information may therefore be retained for different periods.
For example:
Order, invoice and accounting records may need to be retained for the legally required accounting and tax retention period.
Information relating to an enquiry may generally be kept for as long as reasonably necessary to handle the enquiry and any follow-up.
Commission information may be retained for as long as reasonably necessary to administer the commission, maintain relevant business records and deal with any legal or contractual obligations.
Consent records may be retained where necessary to demonstrate that consent was obtained.
When personal data is no longer required, I will delete it or otherwise securely dispose of it where appropriate.
8. Your privacy rights
Depending on the circumstances and applicable law, you may have the right to:
request access to your personal data
request correction of inaccurate or incomplete information
request deletion of your personal data
request restriction of processing
object to certain processing
request data portability
withdraw consent where processing is based on consent
object to direct marketing
request information about how your personal data is processed
These rights are subject to applicable legal conditions and exceptions.
To exercise a privacy right, contact:
I will normally respond to a privacy rights request within one month. In certain circumstances, this period may be extended as permitted by law. If I need additional information to verify your identity, I will let you know.
I may need to verify your identity before processing a request in order to protect your personal data.
Automated decision-making
I do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
9. Withdrawing consent
Where I process personal data based on your consent, you can withdraw that consent at any time.
Withdrawing consent does not affect the lawfulness of processing that took place before you withdrew your consent.
For cookie consent, you can manage your preferences through the cookie settings available on the website.
10. Security
I take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or unauthorised disclosure.
No method of transmission or electronic storage is completely secure, so absolute security cannot be guaranteed.
11. Children's privacy
My website and webshop are not specifically directed at children.
I do not knowingly collect personal data from children without an appropriate legal basis or parental involvement where required by law.
If you believe that a child has provided personal data to me without appropriate consent, please contact me at info@jonnafreya.com.
12. Third-party websites
My website may contain links to third-party websites or services.
I am not responsible for the privacy practices, content or security of third-party websites.
I recommend checking the privacy policy of any third-party website before providing personal data.
13. Complaints
If you have a question or concern about how I handle your personal data, please contact me first:
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe that your personal data has been processed in violation of applicable data protection law.
14. Changes to this Privacy Policy
I may update this Privacy Policy from time to time, for example when the website, services or data processing activities change.
The latest version will always be published on jonnafreya.com with the date of the latest update.
15. Contact
If you have any questions about this Privacy Policy or how your personal data is handled, please contact:
Jonna Freya
Email: info@jonnafreya.com
Website: jonnafreya.com
KVK: 42143777
VAT: NL005531635B226