LEGAL NOTICE AND PRIVACY POLICY

Owner and data controller: Pedro Martínez Sánchez.
Trading name: Arte Nocturno.
NIF: 48649625W.
Address: Saavedra Fajardo 13, Murcia, Spain.
Email: pedro@artenocturno.com.
Telephone: +34 644 742 523.
Website: https://www.artenocturno.com/.

Pedro Martínez Sánchez also owns SIDERAL TOURS, the travel agency through which the photography trips and experiences offered on this website are managed. Registered in the Region of Murcia’s Register of Tourism Companies and Activities under C.I.MU.509.m. Supervisory tourism authority: Instituto de Turismo de la Región de Murcia (ITREM).

The website offers photography courses, workshops, trips, and licenses for Art Panel Pro and Art Panel. Purchases are governed by the terms and conditions and the information provided for each offer:
https://www.artenocturno.com/condiciones-generales-de-contratacion/
Specific terms apply to the software:
https://www.artenocturno.com/art-panel-pro-terminos-legales/

The content on this website belongs to the Owner or is used with authorization. Its reproduction, distribution, communication to the public or adaptation requires authorization, except for uses permitted by law or by the applicable license.
Art Panel Pro and Art Panel are offered under a license to use. Third-party components are governed by their own licenses and retain the rights those licenses grant; their notices are included with the software.

Users must use the website lawfully and refrain from compromising its security or other people's access. The Owner takes reasonable steps to maintain the website and address incidents. Interruptions or the content of external websites will be assessed in accordance with the liability established by law; this notice does not exclude the Owner's obligations or consumers' non-waivable rights.
External links may lead to services provided by other controllers, whose terms and policies will apply when you access them.

This policy applies to browsing, inquiries, user accounts, purchases, courses, reservations, and communications with Arte Nocturno and SIDERAL TOURS. The specific processing of license and plugin-usage data is explained in the plugin’s legal terms.
We process the data you provide, such as your name, email, telephone number, billing details and the information needed for the service requested, together with order, payment and communication information. Access and learning progress information is processed to manage accounts and courses. Browsing generates technical connection data, such as IP addresses and access and security logs. Tracking technologies are described in the cookie policy.
Fields marked as mandatory are necessary to deal with your request, enter into the contract or comply with a legal obligation. Not providing them may prevent us from processing that request or providing the service; the remaining fields are voluntary. Subscribing to advertising is optional and is not a condition of purchase.

• Inquiries about products, quotations and bookings: to take the pre-contractual steps you request. Other inquiries are handled on the basis of our legitimate interest in responding to people who contact us.
• Accounts, purchases, delivery of courses or software, support and workshop or trip bookings: to perform the contract and manage the services requested.
• Invoicing, accounting, and obligations to public authorities: to comply with applicable legal requirements.
• Security, fraud prevention and the defence of claims: our legitimate interest in protecting the website, transactions and our rights, while respecting the rights of data subjects and the proportionality of the measures.
• Newsletters, news and promotions: your consent. You can withdraw it using the unsubscribe link in each communication or by writing to pedro@artenocturno.com. Withdrawal does not affect the lawfulness of prior processing.
• Measurement of browsing, unsolicited personalization and advertising using cookies or similar technologies: your consent, under the terms of the cookie policy.

If a trip or service requires additional information, the relevant data protection information will be provided before it is collected. Do not send identity documents, health data or other particularly sensitive data through a general inquiry unless they have been requested for a specific purpose.

Inquiries are retained until they have been addressed. Account and service data are retained as long as needed to manage the relationship and the access you purchased. Marketing communications are retained until you withdraw consent or unsubscribe; the minimum information needed to honor that request and demonstrate prior consent may be retained.
Invoicing and accounting documents are retained for the statutory periods: generally, four years for tax obligations and six years for commercial documentation, without prejudice to circumstances that require a longer period or interrupt the running of that period.
Once the purpose has ended, data needed to address potential liabilities will be kept blocked for the applicable statutory periods and deleted afterwards. Security logs will be retained only for as long as necessary to detect and resolve incidents; those relating to a claim will be retained while it is being handled and for the corresponding liability periods.
The duration of storage through cookies is specifically stated in the cookie policy. License data are governed by the plugin's privacy provisions.

Data are accessed by providers of hosting, maintenance, communications, administrative management and other necessary ancillary services, subject to the relevant data protection obligations and contracts. Hosting and email are provided through ProfesionalHosting (Soluciones Web Online, S.L., Spain). Mailchimp manages subscriptions and sends newsletters on behalf of the Owner. To distribute downloadable files, we use Cloudflare, Inc., which processes connection data, such as IP addresses and technical request information, to serve and protect the download.
Payments are managed through Stripe and PayPal. Stripe acts as a processor when processing payments on our behalf and as a controller for its own security and compliance purposes; within the EEA, its Irish entities Stripe Payments Europe, Limited, Stripe Technology Europe, Limited and Stripe Technology Company, Limited are involved, depending on the service. PayPal (Europe) S.à r.l. et Cie, S.C.A., established in Luxembourg, acts as controller for the processing involved in its payment services. The identification, contact and transaction data needed to execute and verify payment are provided. For trips, the necessary data are disclosed to accommodation providers, carriers, insurers and operators providing the contracted services; the recipients and specific details applicable to the booking will be communicated. These providers do not necessarily act as the Owner's processors: they may be controllers for their own processing.
Data may also be disclosed to authorities where there is a legal obligation and to advisers where necessary to address claims. Personal data are not sold.
If you choose to contact us through WhatsApp or another external platform, that platform processes data under its own terms; you can also use the contact email address.

ProfesionalHosting is a provider established in Spain. Its privacy and data processing terms are available at https://www.profesionalhosting.com/contratos/.
Some of the other services used involve processing outside the European Economic Area:
• Mailchimp, provided by The Rocket Science Group LLC, processes subscription and newsletter data in the United States. Its contractual documentation provides for the EU–US Data Privacy Framework, in which the provider states it participates through Intuit, and the European Commission's standard contractual clauses for transfers requiring that safeguard. Agreement and safeguards: https://mailchimp.com/legal/data-processing-addendum/. Subprocessors and locations: https://mailchimp.com/legal/subprocessors/. Privacy: https://www.intuit.com/privacy/statement/.
• Cloudflare, Inc., uses an international network, including the United States, to distribute downloads. Its data processing agreement provides for the EU–US Data Privacy Framework for covered transfers and standard contractual clauses for other restricted transfers. Safeguards: https://www.cloudflare.com/cloudflare-customer-dpa/. Subprocessors and locations: https://www.cloudflare.com/gdpr/subprocessors/. Privacy: https://www.cloudflare.com/privacypolicy/.
• Stripe provides for international transfers, including to the United States and India, on the basis of adequacy decisions, the EU–US Data Privacy Framework for covered transfers or standard contractual clauses, as applicable. Information about entities, safeguards and obtaining a copy of the clauses: https://stripe.com/es/privacy and https://stripe.com/es/legal/privacy-center.
• PayPal operates internationally and may disclose data to group entities and providers outside the EEA. For intragroup transfers of EU residents' data, it uses approved binding corporate rules; for other transfers, it applies adequacy decisions or standard contractual clauses, as applicable. Information about recipients, safeguards and rights: https://www.paypal.com/es/legalhub/paypal/privacy-full.
You can request information or a copy of the safeguards applicable to our processing at pedro@artenocturno.com. The safeguards must cover the receiving entity and the specific transfer; merely accepting this policy is not general consent to transfer data.
For trips outside the EEA, information about the necessary disclosures to service providers at the destination and the basis applicable to those transfers will be provided before booking.

You can request access to, rectification, erasure, restriction and portability of your data where applicable, and object to processing based on legitimate interests on grounds relating to your situation. You can withdraw your consent at any time, without affecting prior lawful processing, and object to advertising.
Send your request to pedro@artenocturno.com and indicate which right you wish to exercise. Additional information to identify you will only be requested if there are reasonable doubts about your identity. As a general rule, a response will be provided within one month; if a lawful extension of the period is appropriate, you will be informed within that first month.
You can lodge a complaint with the Agencia Española de Protección de Datos: https://www.aepd.es/.

Information about cookies and similar technologies can be found at:
https://www.artenocturno.com/politica-cookies/
If the processing changes significantly, this policy will be updated and you will receive the relevant information before the data are used for a new purpose. Merely publishing a policy does not replace consent where it is required.