Privacy statement

Last updated: 19 July 2026

This Privacy Statement explains how Avenue de l’élégance B.V., trading under the name Wendy Buiter, collects, uses, stores and protects personal data when you visit our websites, contact us, subscribe to our newsletter, purchase products or services, request a commission, interact with embedded content or use other services offered by us.

This Privacy Statement applies to:

  • wendybuiter.com;
  • wendybuiter.shop;
  • associated online shops, landing pages and forms operated by us;
  • communications and services offered under the Wendy Buiter name.

1. Who is responsible for your personal data?

The controller responsible for the processing of personal data is:

Avenue de l’élégance B.V.
Trading name: Wendy Buiter
Registered address: De Zalmhaventoren 1, 3016DA Rotterdam
Chamber of Commerce number: 92463436
VAT number: NL866058060B01
Email: hello@wendybuiter.com
Website: wendybuiter.com

Avenue de l’élégance B.V. determines why and how personal data is processed.

We have not appointed a formal Data Protection Officer. Questions or requests relating to privacy can be submitted to hello@wendybuiter.com.

2. What personal data do we process?

Depending on how you interact with us, we may process the following categories of personal data:

  • name;
  • billing and delivery address;
  • email address;
  • telephone number;
  • company name and company details;
  • VAT number, where applicable;
  • account and login information;
  • order history;
  • information about purchased or requested products and services;
  • payment status and transaction reference;
  • correspondence and messages;
  • information provided in contact, commission, partnership or application forms;
  • photographs, visual references or other materials supplied for commissioned artwork;
  • newsletter subscriptions, preferences, tags and engagement;
  • IP address;
  • approximate location derived from an IP address;
  • browser, device and operating-system information;
  • cookie identifiers and similar online identifiers;
  • website visits, page views, clicks and navigation behaviour;
  • referral source;
  • interaction with advertisements, affiliate links and socialmedia-content;
  • any other information that you voluntarily provide to us.

We do not intentionally request special-category personal data. Please do not provide sensitive medical, political, religious or other special-category information unless this is strictly necessary and has been specifically agreed with us.

3. How do we obtain personal data?

We may obtain personal data:

  • directly from you;
  • when you place an order;
  • when you create an account;
  • when you contact us;
  • when you request a commissioned artwork;
  • when you subscribe to or interact with our newsletter;
  • when you visit or use our websites;
  • through cookies, pixels, tags and comparable technologies;
  • through socialmedia platforms;
  • from payment, delivery and technical service providers;
  • through affiliate and creator-marketing platforms;
  • from publicly available business sources where relevant to a professional enquiry.

4. Purposes and legal grounds

We only process personal data when there is a lawful basis for doing so.

4.1 Orders and contractual services

We process personal data to:

  • process and deliver orders;
  • accept and administer payments;
  • provide commissioned artworks and other bespoke services;
  • provide framing, delivery or installation services;
  • communicate about an order or service;
  • manage returns, repairs, complaints and customer service;
  • maintain an account and order history.

The legal basis is the performance of a contract or taking steps at your request before entering into a contract.

If required information is not provided, we may be unable to process an order or provide the requested service.

4.2 Financial and tax administration

We process invoices, transaction information, customer details and other legally required records to comply with accounting, tax and administrative obligations.

The legal basis is compliance with a legal obligation.

4.3 Contact requests and correspondence

When you contact us by email, telephone, social media or through a form, we use the information you provide to answer your question and handle your request.

Depending on the nature of the enquiry, the legal basis is:

  • taking steps before entering into a contract;
  • performance of a contract;
  • our legitimate interest in responding to enquiries and maintaining business relationships.

4.4 Commissioned artwork

When you request a personalised or commissioned artwork, we may process:

  • contact and billing information;
  • photographs and visual references;
  • information about the subject, recipient, desired style and personalisation;
  • correspondence relating to the commission;
  • delivery and presentation preferences.

The legal basis is taking steps before entering into a contract and the performance of the commission agreement.

We ask customers not to supply more personal information than is necessary. Where photographs or information concern another person, the customer is responsible for ensuring that they are entitled to provide those materials to us.

4.5 Customer accounts

If you create a customer account, we process your login, contact, delivery and order information to operate the account and make future purchases easier.

The legal basis is performance of the agreement relating to the account and our legitimate interest in providing an efficient customer experience.

4.6 Newsletter and email marketing

When you subscribe to our newsletter, we use your email address and, where provided, your name, interests and preferences to send you news about artwork, exhibitions, events, products, articles and related activities.

The legal basis is your consent.

We use Mailchimp to administer and send newsletters. Mailchimp may register information such as:

  • whether a newsletter was delivered;
  • whether it was opened;
  • which links were clicked;
  • the date and time of interaction;
  • technical and device-related information.

We may use tags, groups and segments within Mailchimp to adapt the content of newsletters to interests, previous interactions or the source through which someone subscribed. This is referred to in this statement as newsletter tagging or segmentation.

You may withdraw your consent at any time by using the unsubscribe link in a newsletter or by contacting us. Withdrawal does not affect the lawfulness of processing that took place before consent was withdrawn.

Where legally permitted, we may send existing customers information about similar products or services. Recipients can object to this at any time.

4.7 Analytics and website improvement

We use analytics information to understand how our websites are used, identify technical issues and improve content, navigation and performance.

We use Google Analytics. Depending on the configuration and the choices made in our cookie banner, Google Analytics may process information such as:

  • IP address;
  • device and browser data;
  • approximate location;
  • visited pages;
  • session duration;
  • clicks and interactions;
  • referral source;
  • cookie and online identifiers.

Where Google Analytics or related features use non-essential cookies or comparable tracking technologies, the legal basis is your consent.

We aim to configure analytics in a privacy-conscious manner, including appropriate data-retention settings and available IP-protection measures. The exact technologies and retention periods may also be described in our cookie settings.

4.8 Meta Pixel

We use the Meta Pixel, provided by Meta Platforms, to measure website activity, understand whether advertisements lead to visits or conversions, build advertising audiences and improve the relevance of advertising on platforms such as Facebook and Instagram.

Depending on your interaction and consent settings, Meta may receive information such as:

  • page visits;
  • products viewed;
  • purchases or other conversions;
  • browser and device information;
  • IP address;
  • cookie and advertising identifiers;
  • interactions with our website.

The Meta Pixel is only activated where legally required consent has been provided.

Meta may process the data for its own purposes in accordance with its own privacy documentation. In certain situations, Meta and Avenue de l’élégance B.V. may have separate or joint responsibilities for particular processing activities.

4.9 Pinterest Tag

We use the Pinterest Tag to measure the effectiveness of Pinterest content and advertisements, understand website visits and conversions and create or refine advertising audiences.

Pinterest may receive data such as:

  • visited pages;
  • products or content viewed;
  • conversions;
  • IP address;
  • device and browser details;
  • cookie and advertising identifiers.

The Pinterest Tag is only activated where legally required consent has been provided.

Pinterest may also process data for its own purposes under its own privacy terms.

4.10 Affiliate links and LinkPizza

Some pages, blog posts, socialmedia-content and newsletters may contain affiliate links. An affiliate link is a trackable link through which we may receive a commission when a visitor clicks the link or completes a purchase or other qualifying action.

We use LinkPizza and may also participate in other affiliate or partner programmes.

When you click an affiliate link, the affiliate platform, advertiser or merchant may process:

  • click and referral information;
  • date and time;
  • website or page of origin;
  • cookie or affiliate identifiers;
  • IP address;
  • browser and device data;
  • information about a resulting transaction.

Where affiliate tracking involves non-essential cookies or comparable tracking technologies, the legal basis is your consent.

We generally do not receive full payment-card information or detailed information about everything purchased from an affiliate partner. We may receive aggregated reporting, transaction references and commission information.

Affiliate relationships do not normally affect the price paid by the visitor. Commercial or affiliate content will be identified where required.

4.11 Embedded socialmedia-content

Our websites may include embedded content from platforms such as Instagram, Facebook, Pinterest, YouTube or other socialmedia services.

Embedded content may behave as though you visited the external platform directly. The platform may collect information about your device, IP address, website activity and account interaction, particularly if you are logged in to that platform.

Where embedded content uses non-essential tracking technologies, it should only be loaded after consent has been provided through the cookie settings.

The relevant socialmedia platform is responsible for its own subsequent processing.

4.12 Socialmedia interaction

When you follow, message, mention, comment on or otherwise interact with Wendy Buiter through social media, we may process your public profile details and the content of the interaction to respond, communicate and manage our online presence.

The legal basis is our legitimate interest in communication, community management and promotion, or your consent where required.

The socialmedia platform also processes personal data independently under its own terms.

4.13 Brand partnerships and professional enquiries

When you contact us regarding a brand partnership, press request, event, representation, wholesale relationship or other professional collaboration, we may process:

  • contact and company details;
  • professional profile information;
  • campaign or project details;
  • correspondence;
  • proposals, contracts and invoicing information.

The legal basis is taking steps before entering into a contract, performance of a contract and our legitimate interest in managing professional relationships.

4.14 Fraud prevention, security and legal claims

We may process personal data to:

  • protect our websites and accounts;
  • prevent fraud and misuse;
  • establish, exercise or defend legal claims;
  • investigate security incidents;
  • comply with lawful requests from public authorities.

The legal basis is our legitimate interest in protecting our business and users, or compliance with a legal obligation.

5. Cookies and similar technologies

Our websites use cookies and similar technologies, including pixels, tags and local-storage technologies.

These may be divided into the following categories:

Necessary cookies

These are required for functions such as:

  • shopping carts;
  • checkout;
  • security;
  • account login;
  • remembering privacy choices;
  • basic website operation.

Where these technologies are strictly necessary to provide a service requested by the visitor, separate consent is generally not required.

Preference cookies

These remember choices such as language, display preferences or other optional settings.

Analytics cookies

These help us understand website use and performance.

Marketing and tracking technologies

These may be used by us and third parties to:

  • measure advertising;
  • track conversions;
  • create audiences;
  • personalise advertising;
  • follow website activity across sites or devices;
  • attribute affiliate commissions.

Tracking cookies and comparable tracking technologies require prior consent. Refusing tracking may not be made unnecessarily difficult, and a website should remain accessible where tracking consent is refused.

Non-essential cookies and tracking tools should not be activated before consent has been given.

You can accept, refuse or adjust cookie categories through the cookie banner or cookie settings. You can withdraw or change your consent at any time through the cookie-settings link on the website.

The current list of cookies, providers, purposes and durations should be made available through the cookie banner or a separate cookie policy.

6. With whom do we share personal data?

We may share personal data with service providers where this is necessary for the purposes described in this statement.

These may include:

  • website hosting and technical maintenance providers;
  • WordPress, WooCommerce and related service providers;
  • email and communication providers;
  • Mailchimp;
  • Google;
  • Meta Platforms;
  • Pinterest;
  • LinkPizza and affiliate networks;
  • payment-service providers;
  • banks and financial institutions;
  • bookkeepers, accountants and tax advisers;
  • delivery and logistics providers;
  • framing, printing, production or installation partners;
  • cloud-storage and file-transfer providers;
  • IT-security, spam-prevention and backup providers;
  • professional advisers;
  • public authorities where disclosure is legally required.

We require service providers acting on our behalf to process personal data securely and only in accordance with appropriate instructions and agreements.

Some third parties, such as payment providers, banks, socialmedia platforms and affiliate merchants, may act as independent controllers. Their own privacy statements apply to their processing.

We do not sell personal data as a standalone commercial product.

7. International transfers

Some of our service providers or their group companies may process personal data outside the European Economic Area, including in the United States.

Where personal data is transferred outside the EEA, we aim to rely on an appropriate legal transfer mechanism, such as:

  • an adequacy decision issued by the European Commission;
  • participation in an applicable recognised data-transfer framework;
  • Standard Contractual Clauses approved by the European Commission;
  • another transfer mechanism permitted under applicable data-protection law.

The European Commission recognises adequacy decisions and Standard Contractual Clauses as mechanisms that may support lawful international transfers.

Where necessary, additional contractual, organisational or technical safeguards may be applied.

You may contact us for further information about the safeguards relevant to a particular transfer.

8. Retention periods

We do not retain personal data longer than reasonably necessary for the purposes for which it was collected, unless a longer period is required by law.

We generally use the following retention periods:

Orders, invoices and financial records

We retain records that form part of our financial and tax administration for at least the period required under applicable Dutch tax and accounting law, generally seven years.

Customer accounts

Account information is retained until the account is deleted, unless particular order or administrative information must be retained longer for legal reasons.

Inactive accounts may be periodically reviewed and deleted or anonymised.

Contact enquiries

General enquiries are normally retained for up to two years after the last substantive contact, unless the information becomes part of a contract, dispute or ongoing professional relationship.

Quotations and unsuccessful commission enquiries

Information relating to a quotation or enquiry that does not result in an agreement is normally retained for up to two years after the last contact.

Commission records

Contractual, financial and essential provenance information relating to commissioned artworks may be retained for the applicable legal period and, where necessary, for longer where this is justified by authenticity, provenance, copyright, dispute-resolution or archival interests.

Unnecessary supplied reference images and personal details will be deleted when they are no longer required for the commission or associated legal obligations.

Newsletter data

Newsletter subscription data is retained until you unsubscribe or we discontinue the newsletter.

After unsubscribing, limited information may be retained on a suppression list to ensure that you are not unintentionally re-subscribed.

Cookie and analytics data

Cookie durations and analytics retention periods vary by provider and configuration. Current information should be displayed in the cookie settings.

Legal disputes and security records

Relevant data may be retained for as long as necessary to establish, exercise or defend legal claims or investigate security incidents.

The AVG requires organisations to establish and justify retention periods rather than retain personal data indefinitely.

9. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction.

Depending on the nature of the processing, measures may include:

  • encrypted website connections;
  • passwords and access controls;
  • multi-factor authentication where available;
  • restricted administrative access;
  • regular software and security updates;
  • backups;
  • anti-spam and security tools;
  • confidentiality obligations;
  • processor agreements;
  • secure payment processing;
  • internal data-minimisation and retention procedures.

No online system is completely secure. We therefore cannot guarantee absolute security.

10. Automated decision-making and profiling

We do not make decisions that produce legal or similarly significant effects based solely on automated processing.

We may use limited profiling or segmentation for:

  • newsletter personalisation;
  • website analytics;
  • advertising audiences;
  • campaign measurement;
  • affiliate attribution;
  • showing more relevant content.

This processing does not normally result in decisions with legal or comparably significant consequences for individuals.

11. Your privacy rights

Subject to the conditions and exceptions in applicable law, you have the right to:

  • receive clear information about the processing of your personal data;
  • request access to your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • object at any time to direct marketing;
  • receive certain personal data in a structured, commonly used and machine-readable format;
  • request transfer of eligible data to another organisation where technically feasible;
  • withdraw consent at any time;
  • lodge a complaint with a supervisory authority;
  • obtain information about relevant international-transfer safeguards;
  • not be subject to certain decisions based solely on automated processing.

Withdrawing consent does not affect processing that was lawful before withdrawal.

The Autoriteit Persoonsgegevens confirms that individuals have rights including access, rectification, erasure, restriction, objection and data portability.

12. Exercising your rights

You can submit a privacy request by emailing:

hello@wendybuiter.com

Please clearly state which right you wish to exercise and provide sufficient information for us to identify the relevant data.

We may ask for additional information to verify your identity. Any identification document should be provided only when specifically requested, and unnecessary information should be obscured.

We will normally respond within one month. This period may be extended where permitted by law if a request is complex or if multiple requests have been submitted. We will inform you if an extension is required.

Requests are generally handled free of charge. A reasonable fee may be charged, or a request may be refused, where requests are manifestly unfounded or excessive, as permitted by law.

13. Complaints

If you believe that we have not handled your personal data properly, please contact us first so that we can attempt to resolve the matter.

You also have the right to lodge a complaint with the Dutch supervisory authority:

Autoriteit Persoonsgegevens

You may also contact the data-protection authority in the EU or EEA country where you live, work or where the alleged infringement occurred.

14. Children

Our websites and commercial services are not specifically directed at children.

We do not knowingly use personal data from children for behavioural advertising without the legally required involvement of a parent or guardian.

Where personal data or photographs of a child are supplied for a commissioned artwork or another service, the person providing the materials must be authorised to do so.

15. Third-party websites

Our websites contain links to external websites, shops, socialmedia platforms, affiliate partners and other third parties.

We are not responsible for the privacy practices, security or content of external websites. We recommend reviewing the privacy information of the relevant third party before providing personal data.

16. Changes to this Privacy Statement

We may update this Privacy Statement when our services, technologies, service providers or legal obligations change.

The most recent version will be published on this page. The date at the top indicates when the statement was last updated.

Where changes are material, we may provide an additional notice through the website, newsletter or another appropriate communication channel.

17. Contact

For privacy questions, requests or complaints, contact:

Avenue de l’élégance B.V.
Trading name: Wendy Buiter
Email: hello@wendybuiter.com
Address: De Zalmhaventoren 1, 3016 DA Rotterdam
Chamber of Commerce number: 92463436
VAT number: NL866058060B01