Privacy Policy

The data controller for personal data processed via this website is:

ALISTER STRATEGIES, S.L. — trading as “The Sky That Evening”
Calle Núñez de Balboa 120, Cink Coworking, 28006 Madrid, Spain
Tax ID (CIF/NIF): B93989465 · EU VAT: ESB93989465
Sole director: Domenique Alister Wissink
Contact: hello@theskythatevening.com

In this policy we refer to ALISTER STRATEGIES, S.L. as “we”, “us” or “The Sky That Evening”. We have not appointed a Data Protection Officer, as we are not required to; privacy questions go to the address above.

We only process what is necessary to sell, produce and deliver your canvas, and to operate this website.

• Order data — name, delivery address, email, phone, order contents, price paid. Purpose: performance of the sales contract. Legal basis: Art. 6(1)(b) GDPR.
• Product configuration — the coordinates (latitude/longitude), the date and the size you chose. Purpose: rendering and printing your unique artwork. Legal basis: Art. 6(1)(b) GDPR.
• Payment data — handled by Stripe. We receive a confirmation and limited card metadata, never full card numbers. Legal basis: Art. 6(1)(b) GDPR.
• Invoicing and tax records — the data required on a Spanish invoice. Legal basis: Art. 6(1)(c) GDPR (legal obligation).
• Support correspondence — the content of any email or message you send us. Legal basis: Art. 6(1)(b) and 6(1)(f) GDPR.
• Technical data — IP address, device type, referring page, page views. Legal basis: Art. 6(1)(f) GDPR (secure, functioning store), and Art. 6(1)(a) consent where cookies are non-essential.
• Customer photos and videos you choose to send us of your canvas. Legal basis: Art. 6(1)(a) GDPR (consent), withdrawable at any time.

The coordinates you enter can reveal a home address. We treat them as ordinary personal data tied to your order, never enrich them, and never use them for marketing or profiling.

We do not knowingly collect data from anyone under 16 and we do not use your data for automated decision-making or profiling in the sense of Art. 22 GDPR.

We use strictly necessary cookies and local storage to run the order flow and checkout. Non-essential cookies are only set with your consent, which you can withdraw at any time by clearing your browser storage. Stripe sets its own cookies during payment for fraud prevention.

We share the minimum data necessary with the following recipients, all bound by GDPR-compliant data-processing agreements:

• Stripe Payments Europe, Ltd. — payment processing, tax calculation and fraud prevention (Ireland / EU).
• Print production partner — made-to-order printing, stretching and shipping, with production hubs in the EU and worldwide. Receives your name, delivery address and the print file.
• Hosting and database infrastructure — order records and rendered artwork storage (EU region).
• Open-Meteo and public meteorological archives — queried by coordinate; no personal data is sent with the request.
• Email provider — transactional emails (order confirmation, shipping updates).
• Tax, accounting and legal advisors, and competent authorities where legally required.

We do not sell your personal data. International transfers, where they occur (for example a print hub outside the EU), rely on the EU Standard Contractual Clauses.

• Order and invoice records: 6 years under the Spanish Commercial Code, and up to 4–10 years for tax purposes under Spanish tax law.
• Rendered print files: kept while your order is in production and up to 12 months after delivery for reprint or support, then deleted.
• Support correspondence: up to 24 months after the last message.
• Technical logs: no longer than 14 months.

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data where legally possible (Art. 17).
• Restrict or object to processing (Art. 18 & 21).
• Data portability (Art. 20).
• Withdraw consent at any time, without affecting past processing.
• Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es) or your local EU supervisory authority.

To exercise any right, email hello@theskythatevening.com. We respond within one month.

We use TLS encryption in transit, encrypted storage at rest, row-level access control on our database, and least-privilege access for staff. Payment card data never touches our servers — it is processed directly by PCI-DSS certified providers.

We may update this policy to reflect changes in our services or the law. Material changes appear on this page with an updated “Last updated” date.

Terms & Conditions · Legal Notice · Shipping & Returns