Privacy Policy

Last updated: 15 September 2026

This policy explains what personal data this website collects, why, and what rights you have over it. It is written to meet the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act.

The short version: this site sets no cookies, runs no analytics, and tracks nobody. The only personal data collected is what you type into the inquiry or newsletter form and send on purpose.

1. Who is responsible for your data

The data controller for this website is:

Bo Åke Adamsson
enskild näringsverksamhet (Swedish sole trader)
Tärna Prästgård 112
733 93 Sala, Sweden
Registered office: Sala, Västmanlands län
Organisationsnummer: 410622-XXXX

The studio trades as an enskild näringsverksamhet, a Swedish sole trader. For that business form the organisationsnummer is the proprietor's own personal identity number, so the last four digits are withheld here to guard against identity fraud. The full number, and the studio's Swedish VAT registration number, are stated on every quote and invoice and are given in full on request.

For any question about this policy or about your data, write to ba.adamsson@gmail.com.

2. What is collected, and why

Artwork inquiries

When you send an inquiry about a work, the form collects your name, email address, your message, and the title of the artwork you asked about.

This is used only to answer you and, if you go ahead, to arrange the sale. The legal basis is Article 6(1)(b) GDPR: steps taken at your request before entering into a contract.

If you subscribe, the form collects your email address, used only to send occasional news about new works and exhibitions. The legal basis is your consent, Article 6(1)(a) GDPR. You can withdraw it at any time by replying to any newsletter or writing to ba.adamsson@gmail.com, and withdrawing it does not affect anything sent beforehand.

Server logs

This site is hosted on GitHub Pages. GitHub records standard technical request data, including IP addresses, to deliver the site and protect it from abuse. That processing is GitHub's, under GitHub's privacy statement. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in serving a working, secure website.

3. Cookies and tracking

This website sets no cookies. There is no Google Analytics or any other analytics, no advertising pixels, no social media trackers, and no profiling of any kind. Fonts are served from this site's own server, so no third party is contacted to render the page. Because nothing but strictly necessary technical processing takes place, no cookie banner is required.

4. Who else processes your data

Form submissions are transmitted and delivered by Formspree, Inc., a United States company, acting as a data processor. Their handling is governed by the Formspree privacy policy.

Because Formspree and GitHub are both established in the United States, your data is transferred outside the EU/EEA. These transfers rely on the EU-US Data Privacy Framework and, where that does not apply, on the European Commission's Standard Contractual Clauses. You may request a copy of the safeguards in place by writing to ba.adamsson@gmail.com.

Your data is never sold, rented, or handed to anyone for marketing purposes.

5. How long it is kept

Inquiries that do not lead to a sale. Kept for up to 24 months, then deleted.
Inquiries that lead to a sale. Kept as long as Swedish accounting law requires, which is seven years from the end of the financial year of the transaction.
Newsletter subscriptions. Kept until you unsubscribe.

6. Your rights

Under the GDPR you have the right to:

Access. Get a copy of the personal data held about you.
Rectification. Have inaccurate data corrected.
Erasure. Have your data deleted, where no legal duty requires keeping it.
Restriction. Ask that processing be limited while a dispute is resolved.
Portability. Receive your data in a machine-readable format.
Objection. Object to processing based on legitimate interests.
Withdrawal of consent. At any time, for the newsletter.

To exercise any of these, write to ba.adamsson@gmail.com. You will get an answer within one month.

If you believe your data is being handled unlawfully, you have the right to complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm. See imy.se.

7. Security

This site is served over HTTPS, so everything you send is encrypted in transit. Inquiries are received in an email account protected by a strong password and two-factor authentication. No payment card details are ever collected through this website.

8. Children

This site is not directed at children and does not knowingly collect data from anyone under 13. If you believe a child has sent personal data through this site, write to ba.adamsson@gmail.com and it will be deleted.

9. Changes

If this policy changes, the revised version will be posted here with a new date at the top. Material changes affecting newsletter subscribers will also be sent by email.