Privacy Policy

1. Who we are

Curiosa Naturalis ("the Atelier", "we") operates this catalogue of natural-history illustrations and is the data controller responsible for any personal information collected through the site.

2. Information we collect

• Account data — email address, full name (optional) and an encrypted password when you register.
• Order data — the plates and licences purchased, the price paid, the currency, and a reference to the payment processor's transaction. We do not store full card details on our servers.
• Download activity — the signed download tokens issued for each order, the number of times they have been used, and their expiry.
• Technical data — minimal log information such as IP address, browser user-agent and timestamps, used to operate the service securely and to prevent abuse.

3. How we use it

We use the information above to: create and manage your account; process orders and deliver licensed files; communicate transactional messages (receipts, download links, password resets); detect fraud and abuse; comply with legal obligations such as tax and accounting; and improve the catalogue.

4. Legal bases

Where the GDPR applies, we rely on (a) the performance of the licence contract for order processing and downloads; (b) our legitimate interest in operating a secure service for fraud prevention and basic analytics; (c) legal obligation for tax and accounting records; and (d) your consent for any optional communication you have explicitly opted into.

5. Sharing

We do not sell your personal data. We share it only with the processors strictly necessary to operate the service: our hosting and database provider, our payment processor, and our transactional email provider. Each processor is bound by confidentiality and data-protection obligations.

6. Cookies

We use a small number of strictly necessary cookies and local storage entries to keep you signed in and to remember the contents of your cart. We do not use third-party advertising cookies. If we ever introduce optional analytics, you will be asked for consent first.

7. Retention

Account data is retained for as long as your account remains open. Order and invoice data is retained for the period required by applicable tax law (typically up to ten years). Expired download tokens are purged on a routine schedule.

8. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. You may exercise these rights by contacting us; we will respond within the period required by law. You also have the right to lodge a complaint with your local supervisory authority.

9. Security

Personal data is held in a managed database with row-level access controls; passwords are hashed; download links are signed with short-lived HMAC tokens; and master image files are kept on private storage and served only through a watermarking proxy. No system is perfectly secure, but we apply industry-standard measures to protect your information.

10. International transfers

Some of our processors may be located outside your country of residence. Where such transfers occur, we rely on adequacy decisions or standard contractual clauses to ensure your data receives an equivalent level of protection.

11. Children

The catalogue is not directed at children under the age of 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we may delete it.

12. Changes

We may update this Privacy Policy from time to time. Material changes will be announced on this page with a revised "last updated" date. For significant changes affecting registered users, we will additionally notify you by email.

13. Contact

For privacy enquiries, or to exercise any of the rights described above, please reach the Atelier through the contact channels listed on the About page. See also our Terms of Use.