Privacy
Privacy statement
Last updated: February 2026
The short version: this website does not track you. It sets no advertising cookies, runs no analytics, embeds no social media widgets and shares nothing with third parties. If you write to us, we use your details only to answer you.
1. Who is responsible
This website, rochan-art.com, is operated by the artist ROCHAN (“we”, “us”). For any question about this statement or about your personal data, write to hello@rochan-art.com. That address reaches us directly.
2. What we collect, and why
2.1 The enquiry form
When you use the contact form, you send us:
- your name;
- your e-mail address;
- the message you write;
- the language of the page you wrote from.
We use this for one purpose only: to read and answer your enquiry. It is not added to a mailing list, not used for marketing, and not passed on to anyone else.
Legal basis. Under Article 6(1)(b) and 6(1)(f) of the GDPR, the processing is necessary to respond to a request you initiated and rests on our legitimate interest in answering enquiries about the artwork.
Retention. Enquiry correspondence is kept for as long as it is relevant to the conversation, and in any case no longer than 24 months after the last message, after which it is deleted. If a message leads to a sale or a commission, the related records may be kept longer where accounting law requires it.
2.2 Spam protection
The form includes a hidden field that human visitors never see and never fill in, plus the hosting platform’s built-in anti-spam check. A submission that trips either of these is rejected and not stored. This exists to keep automated junk out of the mailbox, so that real enquiries are actually read.
2.3 Server logs
Like every web server, our hosting provider records technical request data — IP address, time, requested page, browser user agent — for security, abuse prevention and error diagnosis. These logs are not used to build a profile of you, are not combined with the form data, and are rotated and deleted by the provider on a short cycle. The legal basis is our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).
3. Cookies and local storage
We set no advertising cookies and no tracking cookies. There is no Google Analytics, no Meta pixel, no advertising network and no cross-site tracking of any kind on this website.
The only thing stored on your device is a single entry in your browser’s local storage, named rochan.notice.v1. It records that you have dismissed the privacy notice, so that it is not shown to you again. It contains no identifier, is never sent to our server, and you can remove it at any time by clearing site data for this domain in your browser settings.
Because this entry is strictly necessary to remember a choice you made yourself, it does not require consent under the ePrivacy rules. If you prefer to block it, you can — the site works exactly the same without it.
The hosting platform may also set a strictly necessary technical cookie to keep a page request working correctly. Such cookies carry no advertising function and are not used to profile you.
4. Third parties and transfers
We do not sell, rent or trade personal data. It is never used for advertising profiling.
Two categories of processor are involved in the ordinary running of the site:
- our hosting provider, which serves the pages and processes the form submission on our behalf;
- our e-mail provider, which delivers your enquiry to our mailbox.
Both act on our instructions under a data processing agreement. Where any transfer outside the EEA occurs, it is covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
5. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erasure — ask us to delete your data (the “right to be forgotten”);
- restrict or object to our processing;
- data portability — receive your data in a machine-readable form;
- withdraw consent at any time, where processing rests on consent;
- lodge a complaint with a supervisory authority. In Norway this is Datatilsynet (datatilsynet.no); elsewhere in the EEA, the authority in your country of residence.
To exercise any of these, write to hello@rochan-art.com. We answer without undue delay and within one month at the latest. Exercising your rights is free of charge.
6. Security
The site is served exclusively over HTTPS with HTTP Strict Transport Security, a strict Content Security Policy, and modern security headers that block framing, MIME sniffing and cross-origin leakage. Form input is validated and length-limited on the server. Access to the mailbox holding enquiries is restricted to the artist.
No system is perfectly secure, but we take the protection of your message seriously and keep the technical surface deliberately small — no third-party scripts, no external fonts, no embedded trackers.
7. Children
This website is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.
8. Copyright of the artwork
Not a privacy matter, but worth stating: all images of works on this site are © ROCHAN. They may not be reproduced, printed, used commercially or included in training datasets without written permission.
9. Changes to this statement
If we change how data is handled, this page is updated and the date at the top changes with it. Material changes will be made evident on the site itself.
10. Contact
Questions, requests, or a concern about your data — one address for all of it:
hello@rochan-art.com