PRIVACY POLICY
How we collect, use and protect your personal data
YOUR DATA, EXPLAINED CLEARLY
Last updated: 2 November 2026
This Privacy Policy explains how The Art Nest collects and uses personal data through theartnest.academy, its booking and sales services, and its student support channels. It is intended to cover the activities described here. Local privacy rules in countries outside Andorra and the European Economic Area may provide additional rights or require additional notices.
1. Who is responsible for your data?
The data controller is:
The Art Nest, SLU
Carrer de l’Aigüeta, No. 19, 1st Floor, Door 3A
AD500 Andorra la Vella, Principality of Andorra
Email: tim@theartnest.academy
2. What data we use, why we use it and our legal bases
Depending on how you interact with us, we may process the following data.
Website visits and security
We may process technical information such as your IP address, browser and device information, pages requested, timestamps and security or server logs, where these are recorded by our hosting, security or website systems.
We use this information to operate the website, prevent abuse, troubleshoot technical problems and protect our systems. Our legal basis is our legitimate interest in operating and securing the website.
Booking a qualification call
When you book a call through Calendly, we receive your name, email address, time zone and answers to the booking questionnaire, including information about your artistic level, professional goals and situation.
We use this information to arrange and prepare for a call you requested and to assess whether our programme may be suitable for you. Our legal basis is taking steps at your request before entering into a contract.
Only our staff can access this information. We do not share it with anyone outside The Art Nest.
Bookings may be copied to Google Sheets and to our internally managed CRM. Please do not include special-category or other highly sensitive information in the questionnaire.
Free course and newsletter
If you request our free course, we use your name and email address to provide it and manage your access. Our legal basis is providing the service you requested.
We send newsletters and other marketing emails only where we have the required permission. You can unsubscribe at any time. Refusing marketing does not prevent you from requesting the free course or purchasing a product.
Orders, payments and invoices
For purchases, we may process your name, email address, billing address, country, order and payment references, and, where relevant, a business registration or VAT number. Some products are purchased online through our online sales and payment platform. Other programmes are paid by bank transfer or Wise transfer. Invoices are generated by our CRM and kept for accounting purposes.
We use this information to process orders, provide products, manage payment and customer support, issue invoices and meet legal accounting or tax obligations. The legal bases are performing a contract and complying with legal obligations. We may also use limited information to prevent fraud and protect our business, based on our legitimate interests.
We do not intend to collect full payment-card details in our CRM. Payment details are handled by the relevant payment provider under its own terms.
Mentoring, student support and learning progress
For students, we may process contact details, messages, requests for feedback, progress notes and information about participation or attendance. Community and support activity may take place on Discord. We record relevant educational and support information in our CRM.
We use this information to provide the mentoring or training, respond to requests, monitor progress and provide student support. Our legal basis is performing the contract and, where appropriate, our legitimate interest in organizing and improving student support.
We use custom tools provided by third-party services to help our staff with reminders, summaries and progress reports. These tools support our staff, who remain responsible for any decision about you. The data handled by these tools stays private and is never sold.
Testimonials, student artwork and portfolios
We may display student testimonials, videos, before-and-after artwork, portfolio profiles, names, works and links to platforms such as ArtStation. We use these materials only where we have the student’s permission. The student retains ownership of their work.
You may withdraw your permission for future display by emailing tim@theartnest.academy. Withdrawal does not affect processing that took place lawfully before the withdrawal.
Embedded services
We do not use analytics or advertising trackers on this website, and our fonts are hosted on our own server. The Calendly booking calendar loads only when you click a booking button, and our videos are embedded in YouTube’s privacy-enhanced mode. When you open the booking calendar or play a video, Calendly or YouTube may receive technical information such as your IP address and may set their own cookies, under their own privacy policies. Plain links to Facebook, Instagram, LinkedIn, YouTube, ArtStation or Trustpilot do not load those services merely because the link is displayed. If you click a link, the third party may receive technical information such as your IP address.
Google Search Console is used for website administration and search visibility. It is not, by itself, a visitor-facing analytics tag.
3. Who may receive your data?
We use the following service providers or platforms for the purposes described above:
- o2switch, for website hosting.
- Cloudflare, Inc., for Cloudflare Tunnel and related network or security services for our internally managed systems.
- Calendly, for call bookings.
- Google Workspace, including Google Sheets, for booking records and related administration.
- Systeme.io, for the free course, newsletter and automated marketing emails.
- Our online sales and payment platform, operated by a company established in Estonia, for online sales, payment processing and course access.
- Discord Inc., for student community and support.
- Google and YouTube, for video content and website administration (Google Search Console).
- Trustpilot and ArtStation, when you follow a link or interact with their services.
The invoicing CRM and student CRM are administered by The Art Nest on a server we manage. The server is located in Andorra.
A provider may act as our processor for some activities and as an independent controller for others, such as its own account administration, security or payment compliance. We will identify and document each provider’s role in its applicable contract and privacy information.
Our online sales and payment platform processes your order, payment and course access under its own terms and privacy policy, and shares with us the information needed to provide the product and support you.
You may request the identity of the specific recipients of your personal data by emailing tim@theartnest.academy.
4. International transfers
The Art Nest is established in Andorra. The European Commission adopted an adequacy decision for Andorra in 2010. In January 2024, the Andorran data protection authority reported that the Commission’s review confirmed that Andorra continued to provide an adequate level of protection.
Some providers, including providers based in the United States, may process data outside Andorra or the European Economic Area. For each such provider, we will use a valid transfer mechanism applicable to that provider and processing, such as an active EU-U.S. Data Privacy Framework certification that covers the relevant legal entity and data, or contractual safeguards such as standard contractual clauses where applicable.
An adequacy decision for Andorra does not, by itself, establish a lawful safeguard for onward transfers from Andorra to a separate country.
5. How long we keep data
We keep personal data only for as long as needed for the purposes described above, subject to applicable legal obligations and claims.
| Data | Retention period |
|---|---|
| Qualification-call details for people who do not become clients | 12 months after the last interaction, then delete or anonymize |
| Newsletter details | Until you unsubscribe, or until 24 months of inactivity, then remove from active marketing |
| Minimal unsubscribe record | Kept as needed to ensure that we continue to respect your opt-out |
| Free-course account and activity | While the course is available to you, then up to 12 months after your last activity unless you become a client |
| Student progress and support notes | During the programme and up to 24 months after it ends, then delete or anonymize unless needed for a dispute |
| Order, contract and invoice records | 5 years from the date of the invoice, then delete |
| Website security logs | 30 days, unless needed to investigate an incident |
| Testimonials and portfolio material | While the relevant permission remains in force; remove from future display after withdrawal |
6. Your rights
Subject to applicable law, you may ask us to:
- confirm whether we process your personal data and provide access to it;
- correct inaccurate or incomplete information;
- delete data or restrict its use;
- provide data you supplied in a portable format, where the right applies;
- stop processing based on legitimate interests, where the law gives you that right;
- stop using your personal data for direct marketing; and
- withdraw consent at any time where processing is based on consent.
To exercise a right, email tim@theartnest.academy with the subject line « Privacy request ». We may ask for information reasonably needed to verify your identity. We will respond within the applicable legal time limit.
You may complain to the Agència Andorrana de Protecció de Dades (APDA). If you are in the European Union, you may also complain to the supervisory authority in your country of habitual residence, workplace or the place of the alleged infringement. In France, this is the CNIL.
7. Children
Our services are intended for adults. We do not knowingly accept students under 18 or intentionally collect their personal data. If you believe that a minor has provided us with personal data, contact us so that we can review and, where appropriate, delete it.
8. Security
We use appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, alteration or disclosure.
Our measures include role-based access to our systems, two-factor authentication on administrator accounts, weekly backups and regular security updates.
9. Changes to this Policy
We may update this Policy when our services, providers or legal obligations change. We will publish the current version on this website and update the date above.