Legal
Privacy Policy
This Privacy Policy describes how Palena Studio collects, uses, stores, and shares your personal information when you visit our website, make an enquiry, place an order, or otherwise interact with us. Please read it in full. By using our website or services, you acknowledge that you have read and understood this policy.
1. Introduction
Palena Studio is committed to protecting your privacy and handling your personal information with transparency, care, and respect. We collect only what we need, use it only for the purposes described here, and never sell it to anyone.
This policy applies to all personal information collected through palenastudio.com (our “Website”), through direct correspondence by email or telephone, and in connection with any commission, order, or service we provide. It applies regardless of where you are located — we serve clients globally and have designed this policy to be consistent with the highest international standards of data protection.
This policy should be read alongside our Cookie Policy, which provides specific detail on how we use cookies and similar technologies.
2. Data controller
The data controller — the entity responsible for deciding how and why your personal information is processed — is:
Palena Studio
Istanbul, Turkey
support@palenastudio.com
All data protection enquiries, rights requests, and privacy concerns should be directed to the above address, marked for the attention of Privacy.
3. Information we collect
3.1 Information you provide directly
When you contact us, submit an enquiry, place an order, register a piece, or apply for trade access, we may collect:
- Identity information — full name, title
- Contact information — email address, telephone number, mailing and delivery address, country of residence
- Professional information — studio or company name, professional licence details, website, when you apply for trade or atelier access
- Order and commission information — specifications, material preferences, dimensions, correspondence relating to your commission
- Ownership information — serial numbers and piece details when you register a work
- Payment information — processed directly by our payment service providers; we do not store full card numbers or banking credentials on our own systems
- Communications — any information you choose to share with us in emails, enquiry forms, or other correspondence
3.2 Information collected automatically
When you visit our website, certain technical information may be collected automatically through cookies and server logs:
- Device and browser information — device type, operating system, browser type and version
- Usage data — pages visited, time on page, referring website, actions taken on the site
- Network information — IP address, approximate geographic location derived from IP (country or region level only)
- Cookie data — see our Cookie Policy for full details
Automatically collected data is used in aggregate and anonymised form where possible. We do not combine automatically collected data with your identity information unless strictly necessary for security or fraud prevention purposes.
3.3 Information from third parties
We may receive limited information about you from third parties in the following circumstances:
- From 1stDibs or other authorised platforms through which you place an order or enquiry, to the extent necessary to fulfil that order
- From logistics and shipping partners, to coordinate delivery of your commission
- From payment processors, confirmation that a transaction has been authorised or completed
We do not purchase data from data brokers or marketing list providers.
4. How we use your information
We use the personal information we collect for the following purposes only:
4.1 Fulfilling orders and commissions
Processing and managing your order or bespoke commission, including design development, production coordination, invoicing, shipping, and after-sale support. This is the primary purpose for which we collect personal information from clients.
4.2 Responding to enquiries
Communicating with you about a potential commission, a piece you have seen in our catalogue, trade programme enquiries, or any other question you direct to us.
4.3 Ownership documentation
Maintaining our atelier archive of works produced, issuing Certificates of Authenticity to registered owners, and providing ownership support. This record serves the long-term interests of piece owners and future owners.
4.4 Trade and professional accounts
Managing approved trade and atelier relationships, including verifying professional credentials, applying trade pricing, and coordinating project support.
4.5 Marketing communications
Sending you notifications about new works, exhibitions, or studio news — but only where you have given us explicit consent to do so. You may withdraw this consent at any time, at no cost and without affecting any other aspect of your relationship with us.
4.6 Website improvement
Analysing aggregated, anonymised usage data to understand how visitors use our website and to improve its design, content, and performance.
4.7 Legal and regulatory compliance
Complying with applicable laws, including financial record-keeping requirements, export control regulations, anti-money laundering obligations, and responding to lawful requests from regulatory or law enforcement authorities.
4.8 Fraud prevention and security
Protecting our website, clients, and business from fraudulent activity, unauthorised access, and security threats.
We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.
5. Legal basis for processing
For individuals in the European Union, the United Kingdom, and other jurisdictions where a legal basis for processing is required, we rely on the following:
| Processing activity | Legal basis |
|---|---|
| Fulfilling orders and commissions | Performance of a contract — processing is necessary to deliver what you have commissioned or ordered from us |
| Responding to pre-sale enquiries | Legitimate interests — responding to enquiries is a core business activity and does not override your interests or rights |
| Ownership documentation and archive | Legitimate interests — maintaining provenance records serves the long-term interests of piece owners; contract performance where registration is part of an order |
| Trade account management | Performance of a contract; legitimate interests |
| Marketing communications | Consent — we only send marketing to those who have explicitly opted in |
| Website analytics | Legitimate interests — improving our website; consent where required by applicable law for non-essential cookies |
| Financial record-keeping | Legal obligation — applicable Turkish commercial law and international accounting standards |
| Fraud prevention and security | Legitimate interests — protecting our clients, business, and systems |
Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms. You may request further information about this assessment at any time.
7. International data transfers
Palena Studio is based in Istanbul, Turkey, and serves clients globally. Your personal information may be transferred to and processed in countries other than your country of residence, including Turkey and the countries where our service providers operate.
Turkey has been granted an adequacy decision by the European Commission for certain categories of data transfer. Where we transfer data to countries without a formal adequacy finding, we implement appropriate safeguards including:
- Standard contractual clauses approved by the relevant data protection authority
- Contractual obligations on recipients to apply equivalent levels of data protection
- Selection of service providers that maintain recognised certifications (such as EU-US Data Privacy Framework participation where applicable)
You may request information about the specific safeguards we have in place for any transfer by contacting us at support@palenastudio.com.
8. Retention periods
We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by applicable law. Our general retention framework is as follows:
| Category | Retention period | Reason |
|---|---|---|
| Order and commission records | 10 years from completion | Legal and financial record-keeping obligations |
| Ownership and provenance archive | Indefinitely | Serves the long-term interests of piece owners and future owners; part of the work’s permanent record |
| Pre-sale enquiry records | 3 years from last contact | Legitimate interests; potential future engagement |
| Trade account records | Duration of relationship + 5 years | Legal and financial obligations; legitimate interests |
| Marketing consent records | Until consent withdrawn + 3 years | Evidence of consent; legal compliance |
| Website analytics data | 26 months (aggregated) | Industry standard for analytics; data is anonymised |
| Security and fraud logs | 12 months | Security and fraud prevention |
When personal information is no longer required, we delete it securely or irreversibly anonymise it. Where deletion is not possible for technical reasons, we will isolate and protect the information from further use until deletion is possible.
9. Your rights
Depending on your location, you have the following rights with respect to your personal information. We honour these rights for all our clients globally, regardless of whether they are legally required in your specific jurisdiction.
Right of Access
You may request a copy of the personal information we hold about you, together with information about how we use it.
Right to Rectification
You may request that we correct any inaccurate or incomplete personal information we hold about you.
Right to Erasure
You may request deletion of your personal information where we no longer have a legitimate reason to retain it, subject to legal retention obligations.
Right to Restriction
You may request that we limit processing of your information in certain circumstances — for example, while the accuracy of data is being verified.
Right to Portability
Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
Right to Object
You may object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on consent (such as marketing), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right to Complain
You have the right to lodge a complaint with your local data protection authority. In Turkey: Kişisel Verileri Koruma Kurumu (KVKK). In the EU: your national supervisory authority. In the UK: the ICO.
To exercise any of these rights, please contact us at support@palenastudio.com with the subject line “Privacy Rights Request.” We will acknowledge your request within 5 business days and respond in full within 30 days. In complex cases, this period may be extended to 60 days, and we will notify you if this is the case.
We may need to verify your identity before processing a rights request. We will not charge a fee for reasonable requests.
10. Information for US residents
This section provides additional information for residents of US states with specific privacy legislation, including California (CCPA/CPRA), Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), and other states with applicable privacy laws.
10.1 Categories of personal information collected
In the preceding 12 months, we have collected the following categories of personal information as defined under applicable US state privacy law:
- Identifiers — name, email address, postal address, telephone number, IP address
- Commercial information — records of products or services commissioned or purchased
- Internet or network activity information — browsing history on our website, interactions with our website
- Geolocation data — country or region level only, derived from IP address
- Professional or employment information — for trade applicants only
- Inferences — none; we do not build profiles or inferences about individuals
10.2 Purposes of collection
We collect the above categories of personal information for the business purposes described in Section 4 of this policy. We do not collect personal information beyond what is necessary for those purposes.
10.3 Sale or sharing of personal information
We do not sell personal information. We do not share personal information with third parties for cross-context behavioural advertising. We do not use sensitive personal information for purposes beyond what is necessary to provide our services.
10.4 Your rights under US state law
Depending on your state of residence, you may have the right to:
- Know what personal information we collect about you and how we use it
- Access a copy of the personal information we hold about you
- Request correction of inaccurate personal information
- Request deletion of your personal information, subject to certain exceptions
- Opt out of the sale or sharing of personal information (not applicable — we do not sell or share data)
- Non-discrimination — we will not discriminate against you for exercising your privacy rights
To exercise your rights, please contact us at support@palenastudio.com. You may designate an authorised agent to submit a request on your behalf, in which case we will require written authorisation from you.
10.5 Shine the Light (California)
California residents may request, once per year, information about personal information shared with third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes. California residents wishing to request this information may still contact us at the address below.
11. Security
We implement and maintain appropriate technical and organisational security measures designed to protect your personal information against unauthorised or unlawful access, accidental loss, destruction, alteration, or disclosure. These measures include:
- Encrypted data transmission using TLS (Transport Layer Security) across our website
- Access controls limiting personal data access to those with a need to process it
- Regular review of our information security practices and vendor security standards
- Password policies and multi-factor authentication for internal systems where applicable
- Physical security at our atelier and offices
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law. We maintain an internal incident response process for this purpose.
While we take every reasonable precaution, no method of transmission over the internet or electronic storage is completely secure. If you believe your information has been compromised in connection with our services, please contact us immediately at support@palenastudio.com.
13. Third-party links
Our website may contain links to third-party websites — including our 1stDibs listing, press coverage, and design platforms. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policy of any third-party website you visit.
The inclusion of a link on our website does not constitute an endorsement of that website’s privacy practices.
14. Children
Our website and services are intended exclusively for adults. We do not knowingly collect personal information from individuals under the age of 16 (or such higher age as may be required by applicable local law).
If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us at support@palenastudio.com and we will take prompt steps to delete that information from our records.
15. Changes to this policy
We may update this Privacy Policy periodically to reflect changes in our data practices, applicable law, or business operations. The version number and date of the most recent revision are shown at the top of this page.
Where changes are material — meaning they significantly alter how we collect, use, or share your personal information — we will provide prominent notice on our website and, where we have your contact details, notify you directly before the changes take effect.
Your continued use of our website or services after an update constitutes acceptance of the revised policy. If you do not agree to the revised policy, please discontinue use of our website and contact us to discuss your options.
16. Contact us
For any questions, concerns, or requests relating to this Privacy Policy or to the personal information we hold about you, please contact us:
Palena Studio — Privacy
support@palenastudio.com
Subject line: Privacy Enquiry
We aim to acknowledge all privacy-related communications within 5 business days and to respond in full within 30 days.
If you are not satisfied with our response, you have the right to escalate your complaint to the relevant data protection supervisory authority in your jurisdiction. In Turkey, this is the Kişisel Verileri Koruma Kurumu (KVKK) at kvkk.gov.tr. In the European Union, contact your national data protection authority. In the United Kingdom, contact the Information Commissioner’s Office (ICO) at ico.org.uk.