Arcos

Privacy policy

Last updated: 14 July 2026

Who is responsible for your information

The person responsible for personal information processed through this website is Arvydas Kostinas, who operates the artist practice Arcos in Vilnius, Lithuania.

For privacy questions or requests, use the contact page.

Information collected

Arcos collects only the information needed to answer inquiries, process artwork orders, arrange delivery, manage payment and availability records, protect the website, and meet legal record- keeping obligations.

  • Contact details you provide, such as your name and email address.
  • Inquiry messages, the selected artwork, and your presentation or delivery preferences.
  • Checkout and order details, including the selected artwork, price, billing and shipping details, email address, and payment status.
  • Technical information generated when the site is used, such as IP address, browser or device information, request data, server logs, and security logs.
  • Cart information stored locally in your browser, including artwork identifiers and presentation choices.

Arcos does not intentionally request special-category personal data, and this website is not directed to children.

How the information is used

  • to reply to artwork inquiries and studio messages;
  • to process checkout, payment, temporary reservation, and order confirmation;
  • to arrange packing, shipping, tracking, and delivery;
  • to maintain accounting, tax, and transaction records;
  • to protect the website, prevent fraud, diagnose errors, and keep artwork availability accurate;
  • to comply with legal obligations or resolve disputes.

Legal basis

Processing connected with an inquiry may be based on steps taken at your request before a contract and the legitimate interest in responding to genuine messages. Order, payment, and delivery data may be processed to perform a contract. Accounting and tax records may be processed to meet legal obligations. Website security and operational logs may be processed for legitimate interests. Consent will be used where the law requires it for an optional feature.

Service providers and recipients

Necessary information may be shared with service providers only where needed to operate the website or complete an artwork order. Current providers may include Stripe for payment processing, Vercel for hosting and delivery of the website, Supabase for inventory and checkout records, email providers for communication, and FedEx or another selected carrier for delivery.

The website currently loads typefaces through Google Fonts. When those files are requested, the visitor's browser connects to Google's servers and sends the technical information required to deliver the files, such as an IP address and browser request data.

Payment-card information is handled by Stripe. Arcos does not store full payment-card numbers on this website.

International processing

Some service providers may process information outside Lithuania or the European Economic Area. Where required, the provider or Arcos must rely on a lawful transfer mechanism and appropriate safeguards.

Retention

Inquiry messages are kept only for as long as reasonably needed for communication and follow-up. Order, payment, shipping, accounting, and tax records may be retained for the period required by law or needed to establish, exercise, or defend legal claims.

Cart choices remain in the visitor's browser until they are changed, the cart is cleared, or browser storage is deleted. Hosting, payment, database, and security providers retain technical records according to their own operational and legal retention periods.

Your rights

Subject to the conditions in applicable data-protection law, you may request access to your personal information, correction, deletion, restriction, data portability, or object to processing. Where processing is based on consent, you may withdraw that consent without affecting processing that was lawful before withdrawal.

You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate or another competent data-protection authority.

No sale or advertising profiling

Arcos does not sell personal information. The current website does not intentionally use advertising cookies, cross-site advertising pixels, or behavioural advertising profiles. If the website's tools change, this privacy policy and the cookie policy will be reviewed before the new processing is introduced where required.

Contact

For privacy questions or requests, contact Arcos through the contact page.