Last updated: 29 October 2026
This notice is provided under Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree no. 196 of 30 June 2003 (the Personal Data Protection Code, the “Code”), as amended by Legislative Decree no. 101 of 10 August 2018. It describes how the personal data of those who visit sossioart.com (the “Site”), or who contact the Controller through it, are processed.
1. Data controller
The data controller (the “Controller”) is the artist Sossio (Italy), who can be contacted by email at info@sossioart.com.
2. Data processed
Browsing data. In the course of their normal operation, the computer systems of the provider hosting the Site collect certain personal data whose transmission is inherent in the use of internet communication protocols: the IP address, the browser type and operating system, the address of the page requested, and the time and outcome of the request. These data are used solely to ensure the operation and security of the Site and are not used to identify users, unless this is necessary to establish liability in the event of computer crimes against the Site.
Data provided voluntarily. The Site’s forms do not transmit any data: the enquiry form and the “Private collection previews” sign-up form simply open the user’s own email program with a pre-filled message addressed to info@sossioart.com. The data in that message (for an enquiry: name, role, email address, artwork of interest and message; for the sign-up: the email address), together with the data the email program adds to it, such as the sender’s name and address, reach the Controller only if and when the user sends the message. Data provided by writing to the Controller directly are processed in the same way.
Data relating to the purchase or commission of works. Where an enquiry leads to the purchase of a work or to a commission, the Controller processes the data needed to conclude and perform the contract, including billing and shipping addresses. The Site does not handle payments.
Cookies and browser storage. The Site uses no cookies of any kind, and no profiling or statistical analysis tools. It stores only two kinds of technical information in the user’s browser, and never transmits them: the “Pause” preference, if the user chooses to stop the animations (kept until the user presses “Play” or deletes it), and a record of the pages whose water animation has already been shown during the session (deleted when the browser tab or window is closed). As this information is technical, storing it does not require the user’s consent (Article 122(1) of the Code). The user may nonetheless delete it at any time through the browser’s settings.
3. Purposes and legal bases of processing
- Replying to enquiries about acquisitions, commissions, studio visits or other matters: taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR) or, for enquiries not aimed at a contract (from the press, for example), the Controller’s legitimate interest in replying to them (Article 6(1)(f) GDPR).
- Sale, commission and delivery of works: performance of the contract (Article 6(1)(b) GDPR) and compliance with legal obligations, including tax and accounting obligations (Article 6(1)(c) GDPR).
- Sending the “Private collection previews” (new works and exhibitions): the data subject’s consent (Article 6(1)(a) GDPR and Article 130 of the Code), given by sending the sign-up message, which may be withdrawn at any time by writing to info@sossioart.com.
- Operation and security of the Site: the Controller’s legitimate interest in keeping the Site working properly and protecting it from misuse and cyber attacks (Article 6(1)(f) GDPR).
4. Provision of data
Browsing data are collected automatically when the Site is visited. Providing any other data is optional; without the necessary data, however, the Controller cannot respond to an enquiry, conclude and perform a contract or send the “Private collection previews”. In the event of a sale, where tax law so requires, providing the data needed to comply with it is a legal requirement.
5. Processing methods and recipients
Data are processed by electronic means, using appropriate technical and organisational measures to ensure their security (Article 32 GDPR). They are neither sold nor made public.
Solely for the purposes set out above, data may be disclosed to the parties the Controller relies on, acting as processors (Article 28 GDPR) or as independent controllers: the provider hosting the Site, the Controller’s email service provider and, in the event of a sale or commission, the couriers entrusted with delivery and the professionals who assist the Controller with tax and accounting obligations, as well as, where required by law, the competent authorities. An up-to-date list of processors is available from the Controller on request.
6. Transfers outside the European Economic Area
Where a provider processes personal data outside the European Economic Area, data are transferred only on the basis of an adequacy decision of the European Commission (Article 45 GDPR) or of the standard data protection clauses adopted by the Commission (Article 46(2)(c) GDPR). A copy of the clauses used is available from the Controller on request at info@sossioart.com.
7. Retention period
- Enquiries and correspondence: up to 12 months from the last communication.
- Data relating to sales, commissions and deliveries: for as long as needed to perform the contract and, for tax and accounting records, for the period required by law.
- Sign-ups to the “Private collection previews”: until consent is withdrawn or erasure is requested.
- Browsing data: for as long as strictly necessary to ensure the security of the Site, in line with the policies of the provider hosting it.
8. Rights of the data subject
The data subject may at any time exercise, in the cases and under the conditions provided by Articles 15 to 22 GDPR, the rights of access to their data, rectification, erasure (the “right to be forgotten”), restriction of processing, data portability, and objection to processing based on the Controller’s legitimate interest. They may also withdraw any consent given at any time, without affecting the lawfulness of processing carried out before its withdrawal. The Controller does not use automated decision-making or profiling.
Requests should be sent to info@sossioart.com. The Controller will respond without undue delay and in any event within one month of receipt of the request, a period that may be extended by two further months where necessary, taking into account the complexity and number of requests (Article 12(3) GDPR).
The data subject also has the right to lodge a complaint, under Article 77 GDPR, with the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome, Italy (www.garanteprivacy.it), or with the supervisory authority of the EU Member State in which they habitually reside or work.
9. Links to third-party websites and services
The Site contains links to third-party websites and services, such as those for sharing a page on WhatsApp or Facebook. No data are sent to these third parties until the user follows a link; from then on, data are processed by them as described in their own privacy notices.
10. Changes to this notice
This notice may be updated to reflect changes to the Site or to the applicable law. The version in force is always published on this page, with the date of its last update.