Painting / Photography

Emotion and Moment –
tightly tied

Landscapes, cities, bodies, encounters – caught right where they happen.

Privacy policy

This privacy policy explains which personal data we process when you visit this website and shop with us, for what purposes and on what legal basis. This English version is provided for convenience; the German version is legally binding.

1. Controller

Alireza Ferdowsizadeh (ARYO Studio)
Paul-Gerhardt-Ring 18
13589 Berlin, Deutschland
Email: hello@aryostudio.com

We have not appointed a data protection officer, as we are not legally required to do so.

2. Hosting and server logs

This website is run by a hosting provider in Germany acting on our behalf. We have a data processing agreement with them in accordance with Art. 28 GDPR.

When you visit the website, the server automatically processes technically necessary data: IP address, date and time, the page requested, the amount of data transferred, the referrer URL, and your browser and operating system. This data is needed to deliver the website and keep it secure, for example to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website. Log data is deleted automatically after a short period unless it is needed to investigate a security incident.

3. Cookies and local storage

We only use technically necessary cookies. There is no tracking, and we do not use any analytics or advertising services. The legal basis for storing information on your device is Section 25(2) No. 2 TDDDG; for the associated data processing it is Art. 6(1)(b) or (f) GDPR.

You can delete or block cookies in your browser at any time. Without the cookies listed above, however, the basket will not work.

4. Contact by email

If you email us, we process your email address, your name and the content of your message in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding).

Our mailbox is hosted by our hosting provider in Germany (see section 2), with whom we have a data processing agreement under Art. 28 GDPR. We delete enquiries once they have been dealt with, unless statutory retention obligations apply.

5. Orders in the shop

When you buy artworks or tickets, we process the data you provide at checkout: name, billing and delivery address, email address, phone number where applicable, the items ordered, and payment and order details. Required fields are marked; without them we cannot fulfil your order. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). You can check out as a guest; a customer account is not required.

For delivery, we pass your name and delivery address on to the shipping company we use. We only share your email address or phone number with the shipping company if you have expressly consented at checkout (Art. 6(1)(a) GDPR), for example to receive delivery notifications. You can withdraw this consent at any time.

For workshops and events, we also use your data to organise your participation and to let you know about any changes to the date.

We keep order and invoice data for as long as German commercial and tax law requires (Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB)), for a maximum of ten years. After that, it is deleted.

Withdrawal form (“Withdraw from contract”)

If you use the form on the “Withdraw from contract” page to withdraw from a contract, we process the data you enter (name, email address, order number or contract details, any further notes) as well as the date and time of receipt. We use this data to handle the withdrawal and to confirm receipt to you by email. The legal basis is Art. 6(1)(c) GDPR (legal obligation to provide the withdrawal function and confirmation of receipt) and Art. 6(1)(b) GDPR. We keep the data together with the order data.

6. Payment providers

Depending on the payment method you choose, we pass the data required for payment (amount, order number, name, email address, billing address) on to the relevant payment provider. The legal basis is Art. 6(1)(b) GDPR. The payment providers also process the data under their own responsibility to prevent fraud and meet legal obligations. The providers’ payment scripts are only loaded in the basket and at checkout.

7. Newsletter

If you subscribe to our newsletter, we process your email address and, if provided, your first name in order to send you news about art sales, demos, workshops, life drawing sessions, exhibitions and the shop from time to time (usually no more than once or twice a month). The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) of the German Act against Unfair Competition (UWG)).

We use the double opt-in procedure: after signing up, you receive an email with a link to confirm your subscription. Only then will you receive the newsletter. We store the time of sign-up and confirmation in order to be able to prove your consent (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR). If you do not confirm your subscription, we automatically delete your data after 30 days.

We use Sender.net (UAB Sender.lt, Lithuania) to send the newsletter. Sender processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Sender partly uses sub-processors outside the EU, including in the USA; transfers there are based on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). The sign-up form on our website does not load any content from Sender; your details are only transmitted from our server to Sender when you submit the form. With your consent, it is recorded statistically whether the newsletter is opened and which links are clicked, so that we can check delivery and improve the newsletter.

You can withdraw your consent at any time, for example via the unsubscribe link in every newsletter or by emailing us. After you unsubscribe, we delete your data from the mailing list; we only keep your email address on a block list where necessary to make sure we do not write to you again.

8. Instagram

Our website links to our Instagram profiles. These are simple links: no data is sent to Instagram (Meta Platforms Ireland Limited) unless you click one of them. The images in the News section come from our own Instagram posts, but they are stored on and delivered from our own server. Viewing the News page does not create any connection to Instagram.

Videos (reels) in the News section are played via the Instagram player. It only loads when you click “Play video” on a video. Only then does your browser connect to Meta’s servers, transmitting in particular your IP address, browser and device information and the address of the page you are viewing; Meta may set or read cookies in the process. If you are logged in to Instagram, Meta can link the visit to your account. Data may be transferred to the USA; Meta is certified under the EU-US Data Privacy Framework. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It applies only to that video; the player is not loaded automatically the next time you open a page. More on how Instagram processes data: Instagram’s privacy policy.

9. People in photographs (street photography)

In the photography section (AFFoto) we show artistic photographs, including street and everyday photography taken in public spaces. People may appear in these images and may be recognisable. The photographs were created as independent works of art and are shown in the portfolio at a usual size to present the artistic work. We do not publish names or any other details that could identify the people shown.

This publication serves artistic purposes. In Berlin, Section 19 of the Berlin Data Protection Act (BlnDSG), which implements Art. 85 GDPR, applies: for processing for artistic purposes, large parts of the GDPR apply only to a limited extent. Whether an image may be shown is governed by the freedom of the arts (Art. 5(3) German Basic Law) and the German Art Copyright Act (Sections 22, 23 KUG): without consent we only show people who appear incidentally next to a location, or where the non-commissioned image serves a higher interest of art – and only as long as legitimate interests of the person shown are not violated (Section 23(2) KUG). We do not publish images that show people in a degrading, compromising or intimate situation. Where the GDPR does apply in an individual case, we rely on our legitimate interest in the artistic work and its presentation (Art. 6(1)(f) GDPR).

If you recognise yourself in an image and would like it to be removed, please write to hello@aryostudio.com. As a rule, we will then remove the image from the website.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

For any of these requests, simply email hello@aryostudio.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, www.datenschutz-berlin.de.

11. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Last updated: October 2026