1. Data Controller

The controller responsible for the processing of personal data relating to art commission requests is:

2. Scope of This Privacy Policy

This Privacy Policy applies specifically to personal data processed in connection with custom digital art commissions offered by The Inked Fennec.

It covers data submitted through the commission request form as well as subsequent communication, commission administration and project file storage.

Other processing activities relating to the general website, shop, tattoo services, cookies or other website functions may be covered by the general Privacy Policy of The Inked Fennec.

3. Personal Data Collected

When you submit a commission request or communicate with me about a commission, I may process the following information:

• first and last name
• billing address
• country
• email address
• commission type and selected options
• character names and source information
• commission descriptions and instructions
• reference images and files
• requested usage rights
• information regarding payment and invoicing
• email correspondence relating to the commission
• approval, revision and project communication

Please provide only information and reference material that is necessary for your commission request.

4. Purpose of Processing

Personal data is processed for the following purposes:

• reviewing and responding to commission requests
• determining whether a requested commission can be accepted
• preparing quotes and confirming prices
• communicating with clients
• creating and completing commissioned artwork
• handling revisions and approvals
• issuing and managing invoices
• delivering completed artwork
• maintaining necessary business records
• complying with legal, tax and accounting obligations
• establishing, exercising or defending legal claims where necessary

5. Legal Bases

Where the GDPR applies, personal data required to respond to your request and take steps before entering into a commission contract, or to perform an accepted commission contract, is generally processed on the basis of Article 6(1)(b) GDPR.

Personal data that must be retained or processed in order to comply with legal obligations, including applicable tax and accounting requirements, may be processed under Article 6(1)(c) GDPR.

Where processing is necessary for legitimate business interests, such as maintaining security, documenting business communications or defending legal claims, Article 6(1)(f) GDPR may apply, provided that your interests and fundamental rights do not override those interests.

Where processing is based specifically on consent, Article 6(1)(a) GDPR applies and the consent may be withdrawn for the future.

6. Commission Form & Website Transmission

When you submit the commission request form, the information entered into the form must be technically transmitted through the website's hosting and server infrastructure.

Hosting, technical service or IT providers may therefore process personal data on my behalf where this is technically necessary to operate the website and transmit commission requests.

These service providers may act as processors where applicable.

7. Email — Google Workspace

Commission requests and subsequent communication may be processed through Google Workspace.

This includes emails sent to and from:

Google Workspace is used for business email and related communication. This means that names, email addresses, commission details, reference information and correspondence may be processed through Google's infrastructure when emails are sent, received or stored.

Google may use affiliated companies and subprocessors to provide its Workspace services.

8. Google Drive

Google Drive may be used to securely organize and store data necessary for processing commissions.

Information stored in Google Drive may include:

• commission reference images
• commission descriptions
• project-related documents
• artwork files
• client instructions
• other files required to complete the commission

Google Drive is used for project organization, cloud storage, backup and access to files required for carrying out the commission.

9. Google as a Service Provider

Google Workspace and Google Drive are services provided within the Google Workspace environment.

For relevant Google Workspace offerings in the European Economic Area, the contracting Google entity may be Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.

Google provides contractual data-processing terms for its business services and may engage approved subprocessors for the provision, maintenance and support of Google Workspace.

10. International Data Transfers

Although Google provides services in the European Economic Area, personal data may in certain circumstances also be processed by Google companies or subprocessors located outside the European Economic Area.

Where personal data is transferred to a country outside the EEA and an adequate level of data protection is not otherwise established, appropriate safeguards such as the European Commission's Standard Contractual Clauses may be used where applicable.

The safeguards applicable to a particular transfer may depend on the relevant Google service, recipient and destination country.

11. Recipients of Personal Data

Personal data is not disclosed to third parties without a reason.

Depending on the commission and technical requirements, recipients or categories of recipients may include:

• Google Workspace and Google Drive service providers
• website hosting and technical service providers
• IT service providers where necessary
• payment or invoicing providers where used for the commission
• tax advisers or accounting service providers where applicable
• public authorities where disclosure is legally required

12. Reference Images

Reference images uploaded or sent for a commission are processed only to the extent necessary to review, plan and create the requested artwork, unless another use has been expressly agreed.

Please do not submit unnecessary personal information or sensitive personal material as reference content.

You should only provide reference material that you are permitted to share with me for the purpose of creating the commission.

13. Storage Period

Personal data is retained only for as long as necessary for the respective processing purpose.

Commission inquiries that do not result in an accepted commission may be deleted once they are no longer required for communication or business purposes.

Data relating to completed commissions may be retained for as long as necessary to manage the project, provide documentation, address possible claims and comply with applicable statutory retention requirements.

Invoice, accounting and tax-related data may need to be retained for statutory retention periods.

Project and reference files may be deleted when they are no longer required, subject to technical backup cycles and any applicable legal obligations.

14. Is Providing Your Data Required?

You are not legally required to submit an art commission request.

However, certain information is necessary in order for me to review, communicate about and perform a commission.

If required information is not provided, I may be unable to process or accept the commission request.

15. Automated Decision-Making

Commission requests are not subject to automated decision-making or profiling that produces legal effects or similarly significant effects within the meaning of Article 22 GDPR.

Commission requests are reviewed individually.

16. Your Data Protection Rights

Where the GDPR applies, you may have the right to:

• request access to your personal data
• request correction of inaccurate personal data
• request deletion of personal data where the legal requirements are met
• request restriction of processing where applicable
• receive certain personal data in a portable format where applicable
• object to certain processing based on legitimate interests
• withdraw consent at any time where processing is based on consent

The exercise of these rights may be subject to statutory conditions and exceptions.

Requests regarding your personal data may be sent to: support@the-inked-fennec.com

17. Right to Lodge a Complaint

You also have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data is being processed unlawfully.

The competent supervisory authority for The Inked Fennec in Saxony is:

18. Data Security

Appropriate technical and organizational measures are used to protect personal data against unauthorized access, loss, alteration or disclosure to the extent reasonably possible.

However, no method of electronic transmission or digital storage can guarantee absolute security.

19. Changes to This Privacy Policy

This Commission Privacy Policy may be updated if processing activities, service providers or legal requirements change.

The current version will be made available on this website.