Privacy information.

Last updated: 24 September 2026

1. Introduction

This Privacy Policy explains how Viarcana processes personal data when users browse the website, contact customer support, interact with artworks and products, proceed to checkout, receive transactional communications, or otherwise use the services made available through Viarcana.

Viarcana is operated by Andrea Crocco, an Italian sole trader.

Viarcana does not currently provide customer accounts and does not use personal data for newsletters or unsolicited promotional email.

Where physical products are purchased through Fourthwall, Fourthwall acts as the seller and Merchant of Record for the relevant transaction. Viarcana does not directly collect or store full payment-card credentials.

This Privacy Policy is intended to provide the information required under Regulation (EU) 2016/679 (GDPR), applicable Italian data-protection legislation and, where relevant, other privacy laws applicable according to the user's jurisdiction.

2. Data Controller

The data controller for personal data processed directly by Viarcana is:

Viarcana has not appointed a Data Protection Officer because, based on its current processing activities, the appointment of a DPO is not considered mandatory under Article 37 GDPR.

Certain third-party providers described below may act as independent data controllers or data processors depending on the specific processing activity.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through viarcanastudio.com, related Viarcana-controlled subdomains, customer-support forms, transactional communication systems and other interfaces operated directly by Viarcana.

The checkout used to purchase physical products may be operated by Fourthwall through a Fourthwall domain or through a Viarcana-branded custom domain.

Even where the checkout is displayed using a Viarcana-branded domain, the underlying transaction may still be operated by Fourthwall as seller and Merchant of Record.

4. Categories of Personal Data We Process

4.1 Browsing and technical data

When you access the website, our infrastructure may automatically process technical information necessary to provide, secure and maintain the service.

This may include your IP address, date and time of access, requested URL, browser type, operating system, device information, preferred language, referring page, HTTP response information, security events and technical identifiers.

4.2 Analytics data

Where you have provided the required consent, Viarcana uses Google Analytics to understand how the website is used.

Analytics information may include page views, session information, pseudonymous identifiers, browser and device characteristics, approximate geographic information, referring source and interactions with the website.

4.3 Contact and customer-support data

When you contact Viarcana, we may process information such as your name, email address, message content, order reference, correspondence history and information necessary to investigate your request.

For issues involving damaged, incorrect or defective products, we may also ask you to provide photographs or other evidence relating to the order.

Please avoid including unrelated individuals, identification documents, financial information, health information or other sensitive personal information in attachments unless strictly necessary.

4.4 Order-related data

Where an order is completed through Fourthwall, Viarcana may receive limited order information from Fourthwall when necessary to provide order-status features, customer support or transactional communications.

This may include:

• customer email address;
• order reference;
• artwork or product purchased;
• product variant or size;
• quantity;
• order amount;
• order and fulfillment status;
• shipping or tracking information, where made available by Fourthwall.

Viarcana does not intentionally store full payment-card numbers, CVV codes or equivalent payment credentials.

4.5 Transactional email data

When Viarcana sends a transactional email, we may process the recipient's email address, message content, order reference, delivery status, bounce information, provider message identifiers and technical delivery logs.

5. Sources of Personal Data

Personal data may be collected directly from you, automatically from your browser or device, or received from third parties involved in providing Viarcana services.

In particular, Viarcana may receive order-related information from Fourthwall after you complete or interact with a purchase through its checkout.

6. Purposes and Legal Bases for Processing

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing performed before withdrawal.

Where Viarcana relies on legitimate interests, those interests are assessed against the rights and freedoms of the affected individuals.

7. Fourthwall Checkout, Orders and Payments

Physical products displayed through Viarcana may be purchased through Fourthwall.

For qualifying transactions, Fourthwall acts as the seller and Merchant of Record.

Fourthwall may be responsible for activities including payment processing, taxation connected with the transaction, production, fulfillment, shipping, refunds, returns and other operations associated with the sale.

During checkout, Fourthwall may collect information such as your name, email address, billing and shipping information, payment information, products purchased, order data and technical information.

Fourthwall processes this information according to its own legal obligations, contractual role and privacy documentation.

Viarcana only receives the information Fourthwall makes available and that is reasonably necessary for functionality such as order synchronization, customer support, transactional communications and order-status display.

Payment-card credentials are not stored in Viarcana's own database.

Before completing a purchase, users should also review Fourthwall's applicable privacy policy and terms.

8. Google Analytics

Viarcana uses Google Analytics 4 to obtain statistical information about the use of the website and improve its functionality, usability and content.

Google Analytics may process pseudonymous identifiers, session information, pages visited, device and browser information, approximate geographic information and traffic-source information.

Viarcana uses Google Analytics for analytics purposes and does not intentionally use Analytics data for personalized advertising or remarketing.

Where required by applicable law, Google Analytics is activated only after the user has provided consent.

Users may withdraw consent at any time through the cookie or privacy preferences made available on the website.

9. Cookies and Similar Technologies

Viarcana may use cookies, local storage and similar technologies.

Strictly necessary technologies

These technologies are used where necessary for website functionality, security, fraud prevention, technical operations, checkout routing or the storage of essential preferences.

Where permitted by applicable law, these technologies may be used without consent.

Analytics technologies

Google Analytics and similar non-essential analytics technologies are activated only after consent where required by applicable law.

Viarcana does not currently use advertising or behavioural-profiling cookies for its own advertising purposes.

Users can reject optional cookies and may change their preferences later through the site's cookie settings.

10. Customer Support and Uploaded Photographs

If you contact Viarcana regarding an order or product, we may ask for information reasonably necessary to investigate the issue.

For complaints involving damaged, incorrect or defective products, photographs may be required to demonstrate the problem.

Such photographs and attachments may be used to:

• evaluate the reported problem;
• provide customer support;
• communicate with Fourthwall where necessary;
• prevent fraud or abuse;
• document resolution of the request.

Users should avoid including unnecessary personal data in photographs or attachments.

11. Transactional Emails

Viarcana may send transactional communications relating to orders, order status, customer support, fulfillment, technical issues or other interactions initiated by the customer.

These messages are not marketing newsletters.

Viarcana uses Amazon Simple Email Service (AWS SES) to deliver transactional messages.

Fourthwall may also send separate transactional communications connected with transactions for which Fourthwall acts as seller or Merchant of Record.

Viarcana does not attempt to suppress Fourthwall communications that are necessary to operate, document or support a transaction.

12. Service Providers and Data Recipients

Viarcana may disclose personal data to trusted service providers where this is necessary to operate the website and provide the requested services.

Key providers currently include:

Fourthwall
Checkout, Merchant of Record services, payments, orders, production, fulfillment, shipping and customer transaction management.

Cloudflare
Website infrastructure, content delivery, security, Cloudflare Workers, database and storage infrastructure and related technical services.

Amazon Web Services
Transactional email delivery through Amazon Simple Email Service.

Google
Website analytics through Google Analytics, subject to consent where required.

Personal data may also be disclosed to professional advisers, accountants, legal professionals, courts, public authorities or law-enforcement bodies where required by law or reasonably necessary to establish, exercise or defend legal rights.

Viarcana does not sell customer contact lists or personal information to advertisers or data brokers.

13. International Transfers of Personal Data

Certain providers used by Viarcana operate internationally and may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA and applicable law requires safeguards, transfers may rely on mechanisms such as:

• an adequacy decision issued by the European Commission;
• the EU-U.S. Data Privacy Framework where applicable;
• Standard Contractual Clauses approved by the European Commission;
• other legally recognized safeguards.

Providers such as Cloudflare, AWS, Google and Fourthwall may apply their own lawful international-transfer mechanisms according to their role and applicable legal requirements.

You may contact Viarcana for additional information regarding safeguards applicable to specific transfers.

14. Data Retention

Viarcana retains personal data only for as long as reasonably necessary for the purposes for which it was collected or where longer retention is required by law.

Information may be retained for longer where reasonably necessary to establish, exercise or defend legal claims, respond to regulatory obligations or investigate fraud or security incidents.

Aggregated or irreversibly anonymized information may be retained for longer because it no longer identifies an individual.

15. Data Security

Viarcana implements reasonable technical and organizational safeguards designed to protect personal data from unauthorized access, alteration, loss, misuse or disclosure.

These measures may include HTTPS encryption, access controls, restricted administrative permissions, server-side secret management, infrastructure security, monitoring, logging, data minimization and separation between public and private resources.

However, no method of transmission or storage over the Internet can be guaranteed to be completely secure.

16. Your Rights under the GDPR

Where the GDPR applies, you may exercise the rights provided by applicable data-protection law, including the right to:

• obtain confirmation as to whether your personal data is being processed;
• access your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data where legally permitted;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive applicable personal data in a portable format;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Requests will normally be handled within one month, subject to any extension permitted under applicable law.

To exercise your privacy rights, contact: support@viarcanastudio.com.

Viarcana may request reasonable information necessary to verify the identity of the person submitting a request.

17. Complaints in the European Union

Individuals protected by the GDPR have the right to lodge a complaint with the competent supervisory authority if they believe their personal data has been processed unlawfully.

In Italy, the competent authority is:

Garante per la protezione dei dati personali

Depending on applicable law, you may also contact the supervisory authority in the EU or EEA country in which you reside, work or where the alleged infringement occurred.

18. United Kingdom Privacy Rights

Where UK data-protection law applies, individuals may exercise the rights provided by the UK GDPR and applicable UK data-protection legislation.

Eligible individuals may also lodge a complaint with the Information Commissioner's Office (ICO).

19. United States Privacy Rights

Depending on your state of residence and whether applicable legal thresholds are met, United States privacy laws may provide additional rights.

These may include rights to request access, correction, deletion, portability or information about categories of personal information collected or disclosed.

Certain laws may also provide rights to opt out of the sale or sharing of personal information, targeted advertising or certain forms of profiling.

Viarcana does not sell personal information for monetary consideration.

Viarcana does not currently use customer personal information for cross-context behavioural advertising or targeted advertising.

Where legally required and technically applicable, Viarcana will respect recognized opt-out mechanisms such as Global Privacy Control.

Users exercising privacy rights will not be unlawfully discriminated against for doing so.

20. Other International Privacy Rights

Depending on your location, privacy legislation in jurisdictions such as Brazil, Canada, Australia, New Zealand or other countries may provide additional mandatory privacy rights.

Where such legislation legally applies to Viarcana, mandatory local rights will be respected.

These rights may include access, correction, deletion, portability, withdrawal of consent, objection to certain processing activities and the right to complain to a competent privacy authority.

21. No Sale of Personal Data

Viarcana does not operate as a data broker and does not sell customer personal information.

Personal data is shared with service providers only where reasonably necessary to operate, secure, analyze or support the website and associated services, or where disclosure is required by law.

22. No Marketing Newsletter

Viarcana currently does not operate a marketing newsletter.

Email addresses obtained in connection with orders or customer-support requests are not automatically subscribed to promotional mailing lists.

If Viarcana introduces marketing communications in the future, any legally required consent, transparency and unsubscribe mechanisms will be implemented before such communications are sent.

23. Automated Decision-Making and Profiling

Viarcana does not currently use solely automated decision-making that produces legal effects or similarly significant effects concerning users.

Viarcana does not use customer data to create behavioural advertising profiles.

Analytics may generate aggregated or pseudonymous website-usage statistics, but Viarcana does not use those statistics to make legally significant automated decisions concerning individual users.

24. Children

Viarcana is not specifically directed to children and does not knowingly seek to collect children's personal data.

Individuals who are below the age required by applicable law to provide valid consent should not consent to optional processing or submit personal information without the involvement of a parent or legal guardian where legally required.

If Viarcana becomes aware that personal data relating to a child has been improperly collected, reasonable steps will be taken to delete or restrict that information as appropriate.

25. Data Required to Provide the Service

Certain personal data may be necessary to respond to a customer-support request or complete a purchase through Fourthwall.

Failure to provide information required for those purposes may prevent Viarcana or Fourthwall from providing the requested service.

Google Analytics is optional. Refusing or withdrawing analytics consent does not prevent normal browsing or purchasing functionality.

26. Changes to this Privacy Policy

Viarcana may update this Privacy Policy from time to time, including where necessary because of changes in applicable law, technology, third-party providers, processing activities or website functionality.

The date displayed at the beginning of this Privacy Policy identifies the latest revision.

Where changes materially affect individuals' rights or the purposes of processing, additional notice will be provided where required by applicable law.

27. Contact

For questions about this Privacy Policy, the processing of personal data, or to exercise a privacy right, contact: