Last updated 26 October 2026.
Who handles your personal data
LimeDeck, s. r. o. is the controller for personal data used to run belianska.com and sell Ivana Belianska's artworks.
- Registered office: Štiavnická 1960/4, 034 01 Ružomberok, Slovakia.
- Company identification number, IČO: 50 141 597.
- Commercial Register: District Court Žilina, section Sro, insert 64960/L.
- Privacy contact: [email protected].
- Telephone: +421 944 346 269.
- Telephone support hours: Monday to Friday, 08:00 to 10:00 Bratislava local time, excluding public holidays in Slovakia.
Information we use
When you contact us, we receive your name, email address, message and the artwork, commission category or dimensions you select. If you supply reference photographs or other materials, they may contain personal data. Please send only information needed for your enquiry or commission and avoid sensitive personal information that we have not requested.
We also record any marketing permission you give and any request to stop marketing.
For an order, we also use the agreed brief, order correspondence, billing and delivery details, a delivery phone number where needed, invoices, and payment, refund and complaint records. Stripe processes payment details through its payment service. We receive the transaction information needed to administer the order. We do not ask you to send full card details through the contact form or by email.
Our hosting and security providers process technical information such as IP addresses, requested pages, browser information, request times and errors to deliver and protect the website. Contact-form delivery records also contain submission and message identifiers and delivery outcomes.
Why we use it
We use personal data for the following purposes and legal bases:
- Discussing a requested purchase or commission, preparing an offer and fulfilling an order. We process this information to take steps at your request before a contract and to perform the contract, under Article 6(1)(b).
- Responding to general enquiries that do not concern a prospective contract. We rely on our legitimate interest in answering correspondence, under Article 6(1)(f).
- Keeping accounting and tax records, marketing consent records and withdrawal confirmations and meeting other statutory duties. We process this information to comply with legal obligations, under Article 6(1)(c).
- Administering statutory consumer claims. We process this information to comply with legal obligations, under Article 6(1)(c), and to perform the contract where applicable, under Article 6(1)(b).
- Securing the service, preventing abuse and establishing or defending legal claims. We rely on our legitimate interests in protecting the service and our legal position, under Article 6(1)(f).
- Understanding how visitors use the website through limited cookieless analytics. We rely on our legitimate interest in assessing interest in the artwork and improving the website, under Article 6(1)(f). The analytics section below explains this processing.
- Sending email updates about new artworks and commission availability. We rely on your consent under Article 6(1)(a), or on the existing-customer exception under §116(15) and (16) of Slovak Act No. 452/2021 Z. z., as explained below.
You do not need to consent to necessary enquiry handling or order processing. Providing information is voluntary, but we cannot respond without contact details or fulfil an order without the necessary order and delivery information.
With your consent, we may email you about new artworks and commission availability. We may also email existing customers about our own similar artworks and services where the law allows it, they were offered an opt-out when their details were collected and they have not opted out. Every marketing email includes a simple, free way to unsubscribe. You can withdraw consent or object to direct marketing at any time, and we stop these emails.
We do not use advertising tracking.
Who receives information
Ivana is an independent artist collaborating with LimeDeck. Ivana and authorised LimeDeck personnel can access customer enquiries and order correspondence to discuss artwork, fulfil orders and provide support. Access is limited to what each person needs for their work.
Our providers include:
- Railway for website hosting in its EU West region.
- Cloudflare for website delivery, security and artwork-image hosting.
- Google Workspace for our business mailboxes and order correspondence.
- Resend for sending contact-form email notifications.
- PostHog EU Cloud for the cookieless analytics described below.
- Stripe for invoices and payments.
- The carrier agreed for your order, for delivery information.
We may also disclose necessary information to accountants, professional advisers or public authorities where required for their work or by law. Providers' roles depend on the service. For example, a payment provider may process some information as an independent controller to fulfil its own legal duties. We do not sell your personal data.
Processing outside the EEA
Our providers operate internationally and may process information outside the European Economic Area, including in the United States. Hosting the website or analytics in the EU does not mean that all provider operations take place in the EEA.
Transfers requiring safeguards are covered by providers' data-processing terms, which include the European Commission's standard contractual clauses. Applicable terms and information about processing locations and subprocessors are available from Railway, Cloudflare, Google Workspace, Resend, PostHog and Stripe.
You can contact us at [email protected] for information about the safeguards applying to your data.
How long we keep information
We keep information only while it is needed for the relevant purpose. Our retention limits are:
- Enquiries that do not result in an order: up to two years after the enquiry is resolved.
- Completed-order correspondence, agreed briefs and reference materials: up to five years after delivery, while needed to administer the order, handle complaints or establish or defend legal claims. We delete information earlier when it is no longer needed. Reference materials are used for the specific commission and reused for follow-up work or another commission only at your request.
- Accounting documents subject to Slovak statutory retention: 10 years following the year to which they relate.
- Marketing contact details: while you consent to receive emails, or, for permitted existing-customer marketing, up to one year after our customer relationship ends. We stop marketing when you withdraw consent or object.
- Marketing consent records and withdrawal confirmations: while consent remains in effect and for four years after withdrawal to meet Slovak legal requirements. We retain a minimal opt-out record while needed to prevent further marketing.
- Contact-form delivery records held by Resend: its standard 30-day retention period.
- Routine hosting and security logs: the providers' default retention schedules, described in Railway's log-retention information and Cloudflare's security-data retention information. We do not export these logs to a separate logging service.
- Analytics events: PostHog's default pay-as-you-go retention terms, which provide seven-year retention. Its retention and deletion terms explain what happens after that period.
We retain relevant information for longer where a specific legal obligation, unresolved claim or dispute requires it. We limit that retention to the records needed for that purpose. We delete or anonymise information when it is no longer needed.
Customer correspondence and reference materials stay in our business mailboxes. We do not use Google Vault or keep a separate archive or backup of them. Deleted emails may remain temporarily in Google's recovery and backup systems. Google's data-processing terms provide for deletion within 180 days after the information can no longer be recovered from our account, unless the law requires longer retention.
Cookies and analytics
Our website application does not set advertising or analytics cookies or store analytics identifiers in local or session storage.
Cloudflare may use security cookies when it checks a visitor or presents a security challenge. For example, cf_clearance records a passed challenge and normally lasts 30 minutes under Cloudflare's default settings. These cookies protect access to the website. Cloudflare explains their purposes in its security-cookie information.
We use PostHog EU Cloud to understand page visits and interactions and estimate daily visitor numbers. It receives page addresses, referrers, browser and device information and information about interactions with page elements. We do not send the contact form's name, email or message fields to analytics.
PostHog processes the visitor's IP address and browser information to create a hash that changes daily, then removes the raw IP address from the analytics event. We do not use persistent browser identifiers, create person profiles or record browsing sessions. You can object to processing based on legitimate interests by contacting [email protected].
Your rights
Depending on the circumstances, you can ask to access your data, correct it, erase it, restrict its use or receive and transfer data that qualify for portability. You may object to processing based on legitimate interests. If processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. Legal recordkeeping duties or other lawful grounds may prevent immediate deletion of some records.
Contact [email protected] to exercise your rights. We may request proportionate information to verify your identity. We normally respond within one month of receipt. If complexity or the number of requests requires an extension permitted by law, we explain the reason within the first month.
You may complain to the Office for Personal Data Protection of the Slovak Republic or another competent supervisory authority, including one in the EU country where you live or work.
LimeDeck agrees orders and handles customer claims through personal correspondence. We do not make decisions about customers based solely on automated processing that produce legal or similarly significant effects. Stripe's own payment and fraud-prevention processing is explained in its privacy notice.
Updates
We update this notice when our processing changes. The publication date identifies the current version. Where a change requires new information or consent, we provide that before starting the relevant processing.