Privacy statement

doroART is the sole proprietorship of Dorota Roszkowska, a visual artist in Arnhem, registered with the Dutch Chamber of Commerce under number 09098141. She is responsible for the data that arrives through this site.

There is no separate data protection officer. A business this size is not required to have one, and it is more honest to say that you reach the artist herself. Questions go to the address at the foot of this page.

This site keeps track of which pages are read, and that only happens if you agree to it. One cookie belongs to that. Until you have answered the question, nothing happens: no cookie, nothing in your browser’s storage, and not one request to PostHog, the service that does the counting.

If you say yes, that one cookie appears. It is called ph_ followed by the project’s code, it applies to this site alone, and it stays for a year. It holds a random number and a number for this visit, and nothing else: no name, no email address, nothing you typed. What PostHog keeps alongside that number sits in your browser’s storage, and it goes out together with the cookie.

If you say no, the cookie is not set and nothing about your visit goes to PostHog. The only thing kept is your answer itself: one word in your browser, not a cookie, so that the question does not come back on every page.

You may change your mind, at any time. At the foot of every page it says Cookies; that is where you give your answer again. Withdraw it and the cookie is deleted and the counting stops at once.

If your browser already says that you do not want to be followed, with Do Not Track or Global Privacy Control, that counts as a no. You are not shown the question and you are not counted.

One thing stands apart from this and counts nothing: the basket. Put something in it and two cookies remember which basket is yours and how much is in it. Without those two, your basket is empty again on the next page. They disappear after ten days.

If you have said yes, one thing is passed on for each page: which page you are reading, and in which language. That goes to PostHog, on European servers, and it stays inside the European Union. The number in the cookie shows that this is the same browser as last time. Who is behind it stays unknown.

PostHog also sees your IP address. There is no way around that, every request on the internet carries it, and an approximate location is derived from it. Nothing further is recorded: no recording of your screen, no map of where you click, no surveys, and no automatic record of everything you click on.

Vercel Web Analytics runs alongside that as well, also when you have said no. It counts page views without cookies and without recognising you.

What it records is the page requested, the country, the kind of device and browser, and the site you arrived from. Those figures are totals and cannot be traced back to you. No profile is built and nothing goes to advertisers.

The site runs on Vercel. Every page requested appears in a log: the time, the URL, your IP address and your browser. That is part of serving a website, and it is what makes faults and abuse findable. Those logs are kept briefly and are not used to follow visitors.

Vercel is a company in the United States, so data may be processed outside the European Union. The European Commission’s standard contractual clauses apply to that.

The contact page carries one form. What you fill in is sent:

• Your name and your email address
• Your message
• The work your question was about, if you arrived from one
• The page you sent the form from, the language of the site, and the time

It becomes one email in the artist’s mailbox. There is no database and no customer file behind this site: the message is an email, nothing more.

Delivery runs through Resend, a service that sends email on behalf of doroART. Resend processes the message in order to deliver it and keeps a short delivery record of it.

Your email address is used to answer you. It does not go on a list, no newsletter follows from it, and it is not sold or passed on.

If a sale, a commission or a rental comes of it, the correspondence belongs to the accounts and is kept for as long as the law requires, seven years. A message that leads nowhere is cleared out.

There may be a Cloudflare check beside the send button, called Turnstile. You can see at once whether it is there: a small box appears next to the button.

The check looks at whether a person is filling in the form rather than a program. It is not a tracker. No profile is made of you and it does not follow you from site to site. For that one check, Cloudflare sees your IP address and some details about your browser.

The texts and images are managed in Sanity, the system the artist keeps the site up to date in. Sanity delivers that content to this site and is told nothing about you.

The shop is not on this site yet. While that is the case, an order goes by email and what is written above about the forms applies.

Once the shop opens, this is where it will say which details are needed to order, to pay and to ship, and which parties are involved. That will be written here before the first order is possible.

The GDPR gives you rights over your own data:

• Access: ask what is held about you
• Correction: have what is wrong put right
• Erasure: have removed what does not have to be kept
• Restriction and objection: have the use stopped
• Portability: receive your data in a readable file

Write to the address at the foot of this page, or use the form on the contact page. You will have an answer within a month. To stop someone else asking for your data, you may be asked to confirm who you are.

If you are unhappy with how it goes, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

If something about the site changes, this page changes with it. Last updated on 5 September 2026.