Legal information

Privacy Policy

Leer en español

Last updated: 31 October 2026

1. Controller and contact details

The data controller is Robert Przemyslaw Ulmanski, a sole trader operating under the trading name Blanco Lienzo de Mijas.

Studio address: Plaza de los Siete Caños 5, Edificio Santa Ana, Local A1, 29650 Mijas, Málaga, Spain. Email: info@blancolienzo.es. Telephone and WhatsApp: +34 682 91 84 18.

For any privacy question or to exercise your rights, write to info@blancolienzo.es.

2. What data we use and why

We use only the data needed for each purpose:

• Enquiries by email, phone, WhatsApp or form: your contact details and message, so we can reply.
• Bookings and participation: the booker’s name and contact details, activity, date, number of participants, age category where relevant, accepted terms, changes, cancellations and payment status. If you book for a group, you give us each participant’s name and email so we can send them their invitation; please let them know.
• Access to your project: your email and the access codes or links we send you to upload photos, view your project and pay for extras.
• Payments and invoices: amount, payment reference and status, refunds and necessary invoice details. We never receive or keep your full card number.
• Photos used to make your order: your Paint by Numbers photo, up to three Photo Magnets photos and photos for any extras you order, with crops, working versions and print files. We use them only to prepare, check and hand over your order.
• One review invitation after your visit: after your visit we may send you one email with a photo of your artwork and an invitation to leave a review. You can object at any time via the link in the email or by writing to info@blancolienzo.es. We only send it to people who booked with us directly, never to bookings made through other platforms.
• Website security and operation: limited technical data, such as IP address, browser and error or security logs.
• Your artwork, photos and videos on our website and social media, and newsletter: only if you give permission in the consent form. It is optional: booking or taking part never depends on it, and you can withdraw it at any time.

Fields marked as required in a booking are needed to provide the service; without them we cannot confirm it. We do not make decisions based solely on automated processing that have legal effects on you.

3. Legal bases

• Performance of a contract and pre-contract steps: enquiries, bookings, project access, payments and production.
• Legal obligation: invoicing, accounting, official complaint forms and consumer duties.
• Legitimate interests: service security, proportionate fraud prevention, handling legal claims and the single review invitation after your visit.
• Consent: newsletter, non-essential cookies and promotional use of images. You can withdraw it at any time; this does not affect earlier processing.

4. Photos you send us

If a photo shows other people, you must have their permission to send it to us for this use; if it shows a child, the permission of the person with parental responsibility. We may ask for a different photo if the one received cannot be used appropriately.

Where possible we remove unnecessary metadata, such as location. Only the people preparing and checking your order can access it, and a team member checks the result before printing. We do not use your photos to train AI systems. We only show your finished artwork or your order photos on our website or social media if you give permission in the consent form.

For Paint by Numbers, Blanco Lienzo de Mijas uses OpenAI API to prepare the image and then sends the necessary material to Mimi Panda to create the numbered design. Photo Magnets and extras photos are not sent to OpenAI or Mimi Panda. We also use OpenAI API to create the illustration on blancolienzo.es/art from the photo you upload; only you see it on your screen and our copies are deleted after 48 hours.

Please do not send photos for your order by WhatsApp or email: use the private link you receive after booking.

5. Providers and recipients

We share only the data needed with:

• Bókun, for bookings and availability;
• Stripe, for booking and extras payments (extras are paid on a Stripe Checkout payment page) and for refunds;
• Cloudflare, for running the website and privately storing your project files, set up in the European Union;
• OpenAI API (Paint by Numbers and the illustration on /art) and Mimi Panda (Paint by Numbers only);
• Resend, for sending system emails (confirmations, invitations, access codes and the review invitation after your visit);
• Google Workspace, for email and administration;
• WhatsApp (WhatsApp Ireland Limited, part of Meta), when you message us there. WhatsApp also processes data under its own privacy policy, as an independent controller;
• our accountant, insurer, financial institutions and authorities, where necessary or legally required.

We never sell your data or photos, and we do not give them to partners or advertising channels for their own purposes.

6. International transfers

Some providers (for example OpenAI, Mimi Panda, Stripe, Resend or Meta) or their sub-processors may process data outside the European Economic Area. Where this happens, a GDPR transfer mechanism applies, such as an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or standard contractual clauses. You can ask us about the safeguards that apply.

7. How long we keep data

• Photos and project files under our control (including Cloudflare): we keep them 30 days after your order is completed and handed over, so we can correct, reprint or handle a complaint. After that we keep them only if a specific reason remains, for example a new date still to be set, an extras order in progress, an open complaint or your own request. We review that reason every 90 days; once it no longer applies, we delete the files. We do not keep a permanent photo archive.
• OpenAI API: according to its public documentation, data sent through the API is not used to train models by default; its abuse-monitoring logs may keep content for up to 30 days, subject to legal or safety exceptions.
• Mimi Panda: according to its public policy, designs linked to an account are kept while the service is used. We therefore do not promise that Mimi Panda’s copies are deleted by a specific date; we stop using them when production ends and pass on any applicable erasure requests to the provider.
• Bookings and accepted terms: up to five years after the activity, unless a complaint or the law requires longer.
• Invoices and accounting records: six years, or longer if an audit is open.
• Enquiries that do not lead to a booking (including WhatsApp): twelve months after the last contact.
• Newsletter, if activated: until you unsubscribe or after 24 months of inactivity.
• Photos and videos published with your permission: while they remain published or until you withdraw permission; we then stop using them and remove them from our posts within a reasonable time.
• Security logs: normally 90 days.
• Rights requests and complaints: as long as needed to resolve them and show how they were handled.

8. Children

Paint by Numbers and First Canvas are for adults 18+. In Family Canvas Mijas and Photo Magnets, children aged 8–17 take part with an adult who also participates; children under 8 do not take part in Photo Magnets. We ask only for the child’s data needed to organise the activity. Using a child’s image in advertising always requires separate permission.

9. Cookies

The website uses the technical features it needs to work. Analytics or advertising cookies are activated only if you accept them in the cookie panel. See the Cookie Policy for details.

10. Your rights

You can request access, correction, erasure, restriction, objection and portability, and withdraw consent, by writing to info@blancolienzo.es. If your request concerns a copy held by a provider, we also handle it with that provider. We normally reply within one month. If we have reasonable doubts about your identity, we may ask for proportionate verification.

You can also complain to the Spanish Data Protection Agency (AEPD).

11. Security and changes

We limit access to those who need it and use proportionate security measures. We will update this policy when our services or providers change; the current version is always on our website.