Privacy Policy
Version 1.0
Last updated 12 September 2026
This site collects very little. A contact form that takes your name, email and message, and a newsletter that takes your email. Nothing else is gathered about you, and nothing is sold.
What follows explains each of those in full, because you are entitled to know exactly what happens to what you send.
01
The studio is responsible for your data
Amadeus Art is the data controller for the personal information described in this policy. That means we decide what is collected and why, and we are accountable for it.
Amadeus Art
Via alla Dogana 4
6830 Chiasso
Switzerland
For anything to do with your data, write to studio@amadeus.art. A person reads that address; there is no ticketing system between you and us.
The studio is based in Switzerland. Because we offer our work to people in the European Economic Area and the United Kingdom, this policy meets the EU General Data Protection Regulation and the UK GDPR as well as the Swiss Federal Act on Data Protection. If you live in a US state with its own privacy law, section 10 sets out the rights that apply to you.
02
Two forms, and the traces any website leaves
We collect personal information in three ways. Two of them are things you choose to send us. The third happens automatically whenever anyone visits a website.
The contact form
When you send an enquiry we receive your name, your email address and the message you write. Nothing in the form is mandatory beyond the name and email, and we ask for those only so we can reply to you properly.
Whatever you put in the message field is up to you. Please do not send financial details, identification documents or health information through it — a web form is the wrong place for any of those, and we have no need for them.
The newsletter
Signing up gives us your email address and nothing more. No name, no interests, no profile. We also record the date you subscribed and the fact that you asked to, which is what lets us demonstrate your consent was real if we are ever asked to.
Visiting the site
Our host records standard technical information for every visit — the pages requested, the time, the browser and operating system, and a truncated IP address. This is how the site gets served to you and how we spot abuse. We do not use it to build a picture of you, and we do not connect it to anything you have sent us.
03
Each purpose has one legal basis
Under the GDPR we may only process your information if we have a specific legal ground for doing so. There are four here, and they are not interchangeable.
We never use the contact form to add anyone to the newsletter. Writing to us about a painting is not consent to be marketed to, and treating it as though it were would be unlawful as well as rude.
04
Only as long as there is a reason
If you ask us to delete something sooner, we will, unless a law requires us to keep it. Where that happens we will tell you which obligation applies and how long it runs.
05
Two suppliers, both under contract
We do not sell your personal information, we do not rent it, and we do not share it for anyone else's advertising. Two companies process it on our behalf, each bound by a data processing agreement that lets them use it only on our instructions.
Beyond those, we would only disclose your information if a court or regulator lawfully required it, or if it were genuinely necessary to establish or defend a legal claim. If that ever happened we would tell you, unless we were forbidden from doing so.
06
No tracking cookies, and no banner to dismiss
This site sets only the cookies strictly necessary to serve pages and keep the contact form working. Under the EU ePrivacy rules, cookies of that kind do not require your consent, which is why you are not being asked to click anything.
We measure how the site is used through Framer Analytics, which counts page views in aggregate without cookies and without assigning you an identifier. It tells us that a page was read. It cannot tell us that you read it.
We do not use advertising cookies, tracking pixels, social media plugins or cross-site profiling of any kind.
07
When information crosses a border
The studio is in Switzerland, which the European Commission recognises as providing an adequate level of data protection. Information moving from the EEA or the UK to us therefore needs no additional safeguard.
Some of our suppliers may store or process data in the United States. Where that happens we rely on one or more of the following, in this order of preference: the supplier's certification under the EU–US or Swiss–US Data Privacy Framework; the European Commission's Standard Contractual Clauses, together with the UK's International Data Transfer Addendum where UK data is involved; or your explicit consent.
The adequacy of the EU–US Data Privacy Framework was upheld by the EU General Court in September 2025 in Latombe v Commission, and remains in force. That judgment may still be appealed to the Court of Justice, so we keep Standard Contractual Clauses in place alongside it rather than relying on the Framework alone.
You may ask us for a copy of the safeguards that apply to any particular transfer.
08
Security, stated honestly
The site is served over an encrypted connection. Access to form submissions and the subscriber list is limited to people in the studio who need it, and protected by strong, unique credentials with two-factor authentication. Our suppliers are chosen partly on their security record.
No system is perfectly secure, and we would rather say so than claim otherwise. If a breach ever occurred that was likely to put your rights at risk, we would notify the relevant supervisory authority within seventy-two hours and tell you directly where the law requires it.
09
If you are in the EEA, the UK or Switzerland
These rights are yours by law. Exercising them costs nothing and we will not treat you differently for it.
Write to studio@amadeus.art and we will respond within one month. If your request is unusually complex we may extend that by two further months, and we will tell you why within the first month.
We take no automated decisions about you and do no profiling.
10
If you live in a US state with a privacy law
Twenty US states now have comprehensive consumer privacy laws in force, including California, Virginia, Colorado, Connecticut, Texas, Oregon, Indiana, Kentucky and Rhode Island. They differ in detail, but the rights they grant are broadly consistent, and we extend the following to residents of any of them.
We do not sell or share your personal information, as those terms are defined in the California Consumer Privacy Act and equivalent state laws, and we have not done so in the preceding twelve months.
We do not process sensitive personal information, and we do not knowingly sell or share the personal information of anyone under sixteen.
Because we take no advertising money and run no tracking, there is nothing here to opt out of — but the right stands, and you are welcome to exercise it. An authorised agent may make a request on your behalf with written proof of authorisation.
California residents may also ask, once a year, for details of any personal information disclosed to third parties for their own direct marketing purposes under the Shine the Light law. Our answer will be that there was none.
11
If we get it wrong
Please tell us first — most problems are quicker to fix directly, and we would rather know. But you are never obliged to come to us before going to a regulator.
12
Not a site for children
This site is not directed at children under sixteen and we do not knowingly collect their personal information. If you believe a child has sent us something, write to us and we will delete it.
13
When this policy changes
We update this policy when what we do changes, and we date every version at the top of the page. If a change materially affects your rights — a new purpose, a new recipient, a longer retention period — we will say so plainly rather than quietly reissuing the text, and where the law requires it we will ask for your consent again.
Earlier versions are available on request.
Amadeus Art, Chiasso
Version 1.0, 12 September 2026