Privacy Policy
Last updated: 29 July 2026
Who we are
This website, musivum.org, is operated by Rachael Que Vargas, sole operator, trading as Musivum: The Museum of Mosaic Environments (“Musivum,” “we,” “us,” “our”). We are the data controller for the personal data described here.
Reach us about privacy at privacy@musivum.org, or at director@musivum.org.
We operate from the United States, and personal data collected through this site is processed there. We apply the standards of the EU General Data Protection Regulation and UK GDPR to everyone, wherever you live. When Musivum is established as a Spanish entity, this policy will be updated to reflect Spain’s LOPDGDD and oversight by the Agencia Española de Protección de Datos.
What we collect, why, and on what basis
We collect only what each interaction requires.
| What we collect | Why | Lawful basis |
|---|---|---|
| Site analytics — pages viewed, approximate location, device and browser data | To understand how the site is used and improve it | Consent. Analytics cookies fire only after you accept them. |
| Store orders — name, billing and shipping address, email, order contents, and the payment confirmation returned by Stripe. We never store card numbers. | To take and fulfil your order, provide receipts and support, and meet tax obligations | Contract, and legal obligation for tax records |
| Newsletter signup — your email address, and the date, time and source of your opt-in | To send you Statumen, and to record that you asked for it | Consent, by double opt-in |
| Open Call submissions — name, email, artist details, images, and anything you include | To review your submission, correspond about it, and administer the Open Call | Consent, and contract where we proceed together |
| Correspondence — anything you send to director@, curator@ or privacy@musivum.org | To answer you and keep a record | Legitimate interest |
| Lumen membership — subscription and billing status | To provide and bill your membership | Contract |
We do not sell your personal data. We do not profile you, and we make no automated decisions about you.
Who processes data for us
- Namecheap — website hosting
- Stripe — payment processing, as our processor under a standing data-processing agreement. We never see or store your full card details.
- WooCommerce — store and checkout
- Ghost — hosting and delivery of Statumen and the Lumen membership list
- Google Workspace — our email
- Google Analytics — site measurement, loaded only with your consent
- Elementor Pro Forms — the Open Call form and on-site signup
- Complianz — our cookie-consent tool and its consent records
International transfers
We operate from the United States, so your data is processed there, and our processors may process it in the US and elsewhere. Where the personal data of EU or UK residents is transferred, we rely on the safeguards our processors provide, such as Standard Contractual Clauses. When Musivum, S.L. exists, transfer terms will be reconfirmed.
How long we keep it
We keep personal data only as long as the purpose requires, then delete or anonymise it.
- Order and tax records — seven years, the conservative interim period pending confirmation of tax residency
- Newsletter — until you unsubscribe, plus thirty days. We keep a permanent record that you opted out, so we never contact you again in error.
- Open Call, not selected — a limited review window, then deleted
- Open Call, selected — for the life of the project relationship
- Analytics — fourteen months, then deleted automatically
- Correspondence — two years
- Consent records — three years after consent is withdrawn, as evidence that processing was lawful
Your rights
You have the right to access the data we hold about you, to have it corrected, to have it deleted, to receive it in a portable format, to object to or restrict processing, and to withdraw consent at any time. Withdrawing consent does not affect processing already carried out. Every marketing email carries a one-click unsubscribe.
To exercise any of these, email privacy@musivum.org. We respond within the time the law allows.
If you are in the EU or UK you may complain to your local supervisory authority. Once Musivum is a Spanish entity, that authority is the AEPD.
Changes
We update this policy as our services and legal footing develop. The date above shows the current version.