Privacy Policy

Document: DOC 4

Version: 2.1

Effective date: 3 August 2026

Introduction

This Privacy Policy explains how Karen Tinta ("we", "us", "our") collects, uses, stores, and shares personal data when you visit this website (https://karen-tinta.stoodio.io) (the "Website").

This Website is built and operated using Stoodio, a professional platform for artists provided by STOODIO LTD (trading as Stoodio), a company incorporated in England and Wales. Stoodio's mission is to help artists develop and promote their practice, connect with galleries, collectors, and other art sector professionals, and manage their career. Stoodio processes certain data on our behalf as a data processor, and also processes certain data in its own capacity as an independent controller, as further described in Section 9.

We are committed to protecting your personal data and processing it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Website may also be accessed by visitors located in the European Economic Area (EEA); where applicable, the processing of personal data of EEA residents is also governed by EU GDPR (Regulation (EU) 2016/679). Please read this Policy carefully before using the Website.

If you have any questions about how we handle your personal data, you can contact us using the details below.

You can always reach Karen Tinta through the contact form on this Website, or contact Stoodio at hello@stoodio.io

Capitalised terms describing Stoodio's AI commitments have the meanings given in the Stoodio Terms and Conditions at stoodio.io/legal/terms

1. Who We Are

Karen Tinta is the data controller in respect of personal data collected via this Website. This means we determine the purposes and means of processing your personal data.

Our contact details are:

• Name: Karen Tinta

• Website: https://karen-tinta.stoodio.io

This Website is powered by Stoodio (STOODIO LTD, stoodio.io). Stoodio acts as our data processor for the purposes of operating this Website and, separately, as an independent data controller for certain data it collects for its own purposes, as described in Section 9.

2. What Personal Data We Collect

2.1 Data you provide directly

We collect personal data that you voluntarily provide when you interact with the Website, including:

• Inquiry and contact forms: your name, email address, telephone number (optional), the content of your message, your stated interest in specific artworks, your preferred contact method, and your approximate budget range (optional).

• Newsletter sign-up: your email address and, where provided, your name.

• Discovery information: how you found this Website (e.g. via Instagram, a gallery referral, a search engine), where you choose to tell us.

2.2 Data collected automatically

When you visit the Website, certain data is collected automatically through cookies and similar technologies:

• Technical data: your IP address, browser type and version, device type, operating system.

• Usage data: pages you visit, artworks you view and how long you spend viewing them, the order in which you browse content, how you arrived at the Website (referral source), and your approximate geographic location (country and city, derived from your IP address).

• Session data: the date and time of your visit, session duration, and whether you have visited the Website before.

This data is collected using cookies and similar client-side tracking technologies. For full details of the cookies we use, please see our Cookie Policy.

3. How We Use Your Personal Data

3.1 To respond to your inquiries

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is in responding to genuine inquiries about our work.

We use the information you submit via inquiry and contact forms solely to respond to your message, answer your questions, and follow up regarding artworks you have expressed interest in. We do not use this information for unsolicited marketing unless you have separately opted in to receive communications from us.

3.2 To send you our newsletter

Legal basis: Consent (Article 6(1)(a) UK GDPR).

If you subscribe to our newsletter, we will use your email address and name to send you updates about our work, upcoming exhibitions, events, and new artworks. We will only send you marketing communications if you have given us your explicit consent to do so. You may withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any newsletter or by contacting us directly.

3.4 To understand how the Website is used

Legal basis: Consent (Article 6(1)(a) UK GDPR) for non-essential analytics cookies; Legitimate interests (Article 6(1)(f) UK GDPR) for essential technical data.

We use analytics data to understand which artworks attract the most interest, how visitors navigate the Website, and where our audience comes from. This helps us improve the Website and our presentation of work. Analytics that rely on non-essential cookies are only activated if you have given your consent via the cookie banner.

3.5 To comply with legal obligations

Legal basis: Legal obligation (Article 6(1)(c) UK GDPR).

We may process your personal data where necessary to comply with applicable laws, including tax and accounting obligations in connection with sales of artworks.

3.6 To record how you found this Website

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR).

Where you voluntarily tell us how you discovered this Website (for example, via Instagram, a gallery referral, or a search engine), we use that information to understand which channels bring visitors to this Website and to improve our outreach. We have a legitimate interest in understanding how our audience finds us. Providing this information is entirely optional; you are never required to do so.

4. How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purposes described in this Policy, and in any event no longer than is permitted by applicable law.

• Inquiry and contact data: retained for up to 3 years from the date of your last communication with us, or for as long as a commercial relationship exists.

• Newsletter subscriber data: retained for as long as you remain subscribed. If you unsubscribe, your data will be deleted within 30 days.

• Analytics and usage data: retained in aggregated or anonymised form indefinitely; individual-level data retained for up to 26 months from collection.

Data retained by Stoodio as our processor is deleted or returned within 90 days of the termination of our processing arrangement with Stoodio, in accordance with the Data Processing Agreement between us and Stoodio.

5. Your Artwork and Data: What Will Never Happen

Neither Karen Tinta nor Stoodio will ever use the artwork images or creative content on this Website to train, or to let anyone else train, generative AI that produces visual work, nor to replicate or imitate Karen Tinta's style, technique, or body of work, nor sell or license that content, or data derived from it, to any third party for AI training or dataset creation.

Stoodio does use non-generative, assistive AI to operate the platform: to measure how work is received, to keep the platform safe from spam and abuse, to make content accessible, and to help the right people discover Karen Tinta's work. Those systems produce scores, matches, and recommendations. They do not produce images, and they never will.

6. Who We Share Your Data With

6.1 Stoodio (platform provider and processor)

This Website is operated on our behalf by Stoodio (STOODIO LTD). Stoodio processes personal data submitted via this Website as our data processor, acting only on our instructions and in accordance with a Data Processing Agreement that requires Stoodio to protect your data to a standard no less than that set out in this Policy.

Stoodio also processes certain data it collects via this Website in its own capacity as an independent data controller, for its own purposes. Please see Section 9 for full details.

6.2 Email delivery provider

We use a third-party email delivery service to send inquiry notifications and newsletter communications. This provider processes your email address on our behalf as a data processor.

6.3 Platform hosting and infrastructure provider

This Website is hosted on Vercel Inc.'s infrastructure (Vercel, vercel.com). Vercel processes certain technical data — including IP addresses and request logs — as part of delivering and securing the Website. Vercel acts as a data processor on behalf of Stoodio under a data processing agreement. For further details of Vercel's data handling practices, please refer to Vercel's privacy policy at vercel.com/legal/privacy-policy.

6.5 Legal requirements

We may disclose your personal data to law enforcement, regulatory authorities, or courts where required to do so by applicable law or court order.

6.6 No sale of personal data

We do not sell your personal data to any third party.

8. Cookies

This Website uses cookies and similar technologies to operate correctly and to improve your experience. We distinguish between:

• Essential cookies: necessary for the Website to function (e.g. maintaining your session, remembering your cookie preferences). These do not require your consent.

• Analytics cookies: used to collect information about how visitors use the Website (pages visited, artworks viewed, session duration, referral source). These cookies are only set if you have given your consent via the cookie banner.

• Marketing and preference cookies: used to remember your preferences and, where applicable, to support targeted communications. These cookies are only set if you have given your consent.

You can withdraw your consent to non-essential cookies at any time by clicking the cookie settings link in the footer of this Website. For a full list of the cookies we use and their purpose, please see our Cookie Policy.

9. Stoodio's Independent Use of Data

In addition to processing data on our behalf as described in Sections 3 and 6.1, Stoodio (STOODIO LTD) collects and processes certain data in its own capacity as an independent data controller, for the following purposes:

• Generating aggregated and anonymised analytics about how visitors engage with artist websites on the Stoodio platform, in order to improve the platform and provide artists with performance insights.

• Computing performance metrics and scores that reflect the commercial and audience activity of artists on the platform (including, for example, metrics relating to artwork engagement, inquiry volumes, and audience geographic distribution).

• Sharing data relating to this Website and its visitors — in aggregated and fully anonymised form only, from which no individual visitor can be identified — with galleries, collectors, art advisors, art-technology platforms, and other professional operators active in the art sector. This sharing is carried out on the basis of Stoodio's legitimate interests in providing market intelligence services to the art sector. Stoodio does not, at present, share individual (non-anonymised) visitor data with third parties. Stoodio reserves the right to update this Policy in the future to introduce individual-level data sharing with third parties, subject to the legal basis applicable at the time and any consent mechanisms required by law. Any such change will be communicated to you in advance in accordance with Section 13.

• Operating and improving the Stoodio platform.

Where you separately opt in to hearing from Stoodio, Stoodio processes your name and email address as an independent controller, on the basis of your consent (Article 6(1)(a)), to send you future news about us and our work, where we choose to share updates through Stoodio. Stoodio does not use this opt-in to contact you about other artists. You may withdraw at any time via the link in any email Stoodio sends or by contacting hello@stoodio.io. This data is retained until withdrawal and deleted within 30 days of it.

Stoodio's independent processing of your data is subject to Stoodio's own privacy policy, available at stoodio.io/privacy. That policy sets out the legal bases, purposes, and retention periods applicable to Stoodio's own processing activities, and describes the rights you may exercise against Stoodio as an independent controller. If you have questions about Stoodio's processing of your data, you may contact Stoodio directly at hello@stoodio.io.

Where Stoodio's processing of your data for its own purposes requires your consent (for example, in relation to non-essential analytics cookies), that consent is sought via the cookie banner displayed on this Website, separately from any processing by us as the Artist.

9A. Automated Processing and Profiling

Stoodio uses automated processing to compute engagement metrics relating to how visitors interact with artworks on this Website — for example, which works receive the most views, how long visitors spend on each artwork page, and patterns of interest across the artist's portfolio. This processing constitutes profiling within the meaning of Article 4(4) UK GDPR, in that it analyses aspects of visitor behaviour to evaluate interest in specific artworks.

This profiling does not produce legal effects concerning you and does not significantly affect you in a comparable way. It is used solely to generate aggregated insights for the artist and, in anonymised form, for Stoodio's market intelligence services. Accordingly, the restrictions in Article 22 UK GDPR on solely automated decision-making do not apply to this processing. You are not subject to any decision based solely on automated processing that produces legal or similarly significant effects.

Where you have separately opted in to hearing from Stoodio, Stoodio uses your contact details only to send you news about us and our work, as described in Section 9. That processing happens only with your consent and stops when you withdraw it.

10. International Transfers

This Website and its supporting infrastructure are operated within the United Kingdom and the European Union. Where any personal data is transferred outside the UK or EEA by Stoodio or any sub-processor, Stoodio ensures that appropriate safeguards are in place in accordance with UK GDPR, including Standard Contractual Clauses (UK Addendum) or adequacy decisions where applicable.

11. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: you may request a copy of the personal data we hold about you.

• Right to rectification: you may ask us to correct any inaccurate or incomplete data.

• Right to erasure: you may ask us to delete your personal data in certain circumstances (for example, where we no longer need it for the purpose for which it was collected, or where you withdraw consent).

• Right to restriction: you may ask us to restrict our processing of your data in certain circumstances.

• Right to data portability: where processing is based on your consent or on a contract, you may ask us to provide your data in a structured, machine-readable format.

• Right to object: you may object to processing based on legitimate interests. Where processing is based on your consent, you may withdraw it at any time. Objection to direct marketing is absolute: tell us once and it stops.

• Right to withdraw consent: where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details below.

You can always reach Karen Tinta through the contact form on this Website, or contact Stoodio at hello@stoodio.io

We will respond within one month of receiving your request. In complex cases or where we receive multiple requests simultaneously, we may extend this period by a further two months; if we do so, we will notify you within one month of receiving your request and explain the reason for the extension. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

If you are located in the European Economic Area, you may also lodge a complaint with your local data protection supervisory authority. A full list of EEA supervisory authorities is available at edpb.europa.eu.

12. Children's Privacy

This Website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has submitted personal data to us, please let us know and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in how we process personal data or changes in applicable law. The current version, with its effective date, will always be available on this Website. Where changes are material, we will notify you by publishing the updated Policy on this Website with a new effective date. Where you have provided us with an email address and the change directly affects how we process your personal data, we will also endeavour to notify you by email in advance of the change taking effect.

This Policy was last updated on 3 August 2026.

14. Contact

If you have any questions, concerns, or requests relating to this Privacy Policy or to the processing of your personal data, please contact:

Karen Tinta

Website: https://karen-tinta.stoodio.io

If your question relates to data processed by Stoodio in its own capacity as an independent controller, please contact Stoodio directly at hello@stoodio.io or visit stoodio.io/privacy.

Template generated by STOODIO LTD · stoodio.io · All artist websites powered by Stoodio

Last updated 3 August 2026, version 2.1