Privacy policy

Joy & Paint is run by Paola Medina Culma, a self-employed trader registered in Portugal. She is responsible for your personal data (the “controller”, in data protection law).

For anything about your data, write to joyandpaint.info@gmail.com or use our contact page.

• When you book: your name, email address, the pieces you choose, any note you add and your language. We use them to hold your seats, take payment, send your confirmation, prepare your pieces and tell you when they are ready to collect. We can’t take a booking without them.
• When you pay: Stripe handles the payment on its own secure page. We send Stripe your email address and what you are buying. We never see your card details; Stripe tells us whether the payment went through.
• When you write to us: what you put in the contact form: your name, email address, phone number if you give it, the details of your event and your message. We use them to reply.
• When you sign up to the newsletter: your email address, your language, where you signed up, and when and how you agreed. You only join once you confirm your address from the email we send.
• When you visit the website: Cloudflare, which hosts the site, processes your IP address to deliver pages and block attacks. We don’t keep logs of your visits.
• If you accept analytics: Google Analytics records which public pages are visited, roughly where from, on what kind of device, and which campaign brought the visit. See cookies.

Data protection law asks us to say on what basis we use your data:

• Contract: to take and manage your booking and payment.
• Legal obligation: to keep the payment and accounting records that tax law requires.
• Consent: for the newsletter and Google Analytics. You can withdraw it at any time; this doesn’t affect what happened before.
• Legitimate interests: to answer your messages, to tell our team about new bookings and to keep the website secure.

We don’t make decisions about you by automated means alone, and we don’t build profiles for advertising.

We don’t sell your data. These services help us run Joy & Paint and handle data on our behalf:

• Stripe, for payments and refunds.
• Cloudflare, for hosting the website, our database and files, sending booking emails and protecting forms from spam.
• Brevo, for the newsletter. Its emails contain a small image that tells us whether an email was opened.
• Google, for Gmail, where we receive your messages and booking notices, and for Google Analytics if you accept it.

Some of these companies, including Stripe, Cloudflare and Google, may process data in the United States. They do so under the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

• Bookings and payments: for as long as tax law requires us to keep accounting records, currently 10 years.
• Checkouts that weren’t paid: 3 months.
• Messages from the contact form and emails: 2 years after our last exchange, unless they belong to a booking.
• Newsletter: until you unsubscribe. We then keep your address with a record of your consent and when you withdrew it for 3 years, so we can show we respected your choice.
• Google Analytics: 2 months.

We use the browser storage the website needs to work, such as keeping your booking together while you pay. Google Analytics cookies are only set if you accept them. The cookies page lists everything we store. You can change your choice at any time with “Cookie settings” at the bottom of every page.

You can ask us to:

• show you the data we hold about you;
• correct anything that’s wrong;
• delete your data;
• limit how we use it, or object to a use based on our legitimate interests;
• give you your data in a format you can take elsewhere;
• stop sending the newsletter, which you can also do from the link in every newsletter email.

Write to joyandpaint.info@gmail.com. We will reply within one month, and may ask you to confirm who you are first.

If you are unhappy with how we handle your data, you can complain to the Portuguese data protection authority, the CNPD, at www.cnpd.pt.

Children are welcome at our workshops with an adult, and the adult makes the booking and pays. We don’t ask children for their own details.

We will update this page when the way we use your data changes, and change the date at the top. If a change matters for a booking you have made, we will tell you by email.