Privacy Policy

This policy explains what Cecilia Dan Fine Art collects when you visit this site or contact us, how we use it, how long we keep it, and the choices you have.

In short

This website has no forms, accounts, comments, advertising, or embedded third-party content, and its pages set no cookies.
Cloudflare delivers and protects every page, so it handles each request you make to this site, including your IP address.
Our server keeps technical logs for 30 days. This website uses no analytics software.
If you email or call us, we keep what you send for as long as we need to deal with it. Appraisal files are kept for at least five years, as professional standards require.
We do not sell your personal information or share it for advertising.
You can ask us what we hold about you and ask us to correct or delete it, as described below.

Who is responsible

Cecilia Dan Fine Art is the art advisory and appraisal practice of Cecilia Dan, based in Santa Monica, California. She is responsible for the information described here and decides how and why it is used. You will find our contact details at the end of this policy.

What happens when you visit this website

You can read this website without telling us who you are. Even so, some information is processed in the background whenever a page loads.

Cloudflare

Every request to this website passes through Cloudflare, Inc., a United States company whose network delivers pages, caches content, and protects the site against attack. To do that, it processes your IP address, the approximate location that address indicates, the address you requested, the referring page, and your browser's user agent (the name and version it reports). Cloudflare handles this information for us under its data processing terms. For some of it, such as security and network data, it acts on its own account under its own privacy policy (opens in new tab). Cloudflare decides how long it keeps this information and publishes no fixed limit.

If a connection to this website fails, your browser may send Cloudflare a technical report about the failure. It sends none when a page loads normally. Cloudflare says it does not keep your IP address from these reports.

Our server and its logs

This website runs on a server in a Hetzner Online GmbH data center in Falkenstein, Germany. The server logs each request: the network address it came from, the date and time, the address requested, the status and size of the response, the referring page, and your browser's user agent. Requests normally reach the server through Cloudflare, so that network address is Cloudflare's and not yours. We use these logs to keep the site running, investigate faults, and detect abuse, and we do not combine them with other information. They are deleted automatically after 30 days.

Cookies and your device

The pages of this website set no cookies and use no local storage or similar browser storage. Three related points:

Cloudflare may set a short-lived security cookie if its protections are triggered, for example by a bot check.
The sign-in pages for our staff set the cookies that signing in requires. Visitors never need them.
Your browser may remember two technical instructions from this site: to use a secure connection, for up to one year, and where to send the failure reports described above, for seven days. These are not cookies.

You can block or delete cookies in your browser without affecting your ability to read this website.

Online tracking, Do Not Track, and Global Privacy Control

We do not track visitors across other websites, and no advertising, analytics, or social media company collects information about you through this site. Cloudflare is the one other party that handles your requests. Because it serves many other websites, it may see activity across them over time, and it handles that information as its privacy policy describes.

This website uses no analytics, so a Global Privacy Control (opens in new tab) or Do Not Track signal from your browser has nothing to switch off here. Neither signal stops Cloudflare or our server logs from handling your requests, because the page cannot be delivered without them. We do not sell or share personal information, so the signal has nothing further to stop.

When you email or call us

If you email or call us, we receive what you choose to share, typically your name, email address, telephone number, and message. We use it to answer you and to deal with whatever follows. Our email is hosted in the United States by InMotion Hosting, Inc., and outgoing messages may pass through its delivery providers. This website has no mailing list.

When you engage us

If you engage us for advisory or appraisal services, a separate engagement letter sets out the work. We collect what the work needs, which may include your contact details, information about the works and their ownership and provenance, and financial, tax, insurance, or estate documents. It may come from you or from people acting for you, and we cannot do the work without it. We use it to perform the engagement and to meet our legal, regulatory, and professional obligations.

We follow the Uniform Standards of Professional Appraisal Practice (USPAP) and treat the fact of an appraisal engagement as confidential. We disclose confidential information and the results of an assignment only to the client, to parties the client specifically authorizes (for example attorneys, accountants, executors, insurers, or the Internal Revenue Service), to state appraiser regulators, to third parties where due process of law requires it, and to a duly authorized professional peer review committee.

The information at a glance

In the terms California law uses, we collect these categories of personal information. We do not collect sensitive personal information through this website, and we use any we receive in an engagement only to perform it.

Identifiers: name, email address, telephone number, postal address, and IP address.
Internet or other electronic network activity information: the pages requested, referring pages, and browser details described above.
Geolocation data: the estimated location described above, never your precise position.
Personal information described in Cal. Civ. Code § 1798.80(e) (customer records) and commercial information: what an engagement requires, as described above.

We do not sell your personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not give it to third parties for their direct marketing. We disclose it only as follows:

Website service providers. Cloudflare, Inc. (delivery and security); Hetzner Online GmbH, Germany (server hosting and backup storage); SpinupWP Inc., Canada (server management and backups, with administrative access to the server); and the independent contractors who provide our hosting and maintain this website. Apart from the Cloudflare data described above, each handles the information for us under written terms and only to provide its service.
Email provider. InMotion Hosting, Inc., as described above.
Accountants and insurers. Our accountants and professional liability insurers receive what they need for those purposes.
Professional engagements. The recipients named under When you engage us.
Legal process. We may disclose information when required by subpoena, court order, or other legal process, or when we believe in good faith that disclosure is necessary to protect rights, safety, or property. Confidential appraisal information goes only to the recipients named in that section.

How long we keep information

Server logs: 30 days.
Daily backups of the site: deleted 30 days after each backup.
Cloudflare's data: as Cloudflare decides, under its privacy policy.
Emails and notes of calls: as long as it takes to answer you and to deal with whatever follows, and longer only where the law requires it or the matter becomes an engagement.
Appraisal workfiles: USPAP requires us to keep each one for at least five years after it is prepared, or at least two years after the final disposition of any judicial proceeding in which we gave testimony related to the assignment, whichever period expires last.
Other engagement records: as long as the work and applicable tax, insurance, and legal requirements need.
Records of privacy requests: 24 months.

Your rights

The California Consumer Privacy Act (CCPA) applies to larger businesses, and our practice does not meet its thresholds. We offer the following rights voluntarily to anyone, wherever they live.

Know. You may ask what categories and specific pieces of personal information we hold about you, where they came from, why we collected them, and who received them.
Delete. You may ask us to delete personal information we hold about you, unless the law or professional standards require us to keep it, as they do for an appraisal workfile.
Correct. You may ask us to correct inaccurate personal information.
No retaliation. We will not deny services, charge different prices, or give a lower quality of service because you used these rights.

How to ask. Write to us or call us using the contact details below. There is no charge. We will confirm that we received your request within 10 business days and answer within 45 calendar days. If we need longer, we will tell you why and answer within 90 calendar days of your request.

How we confirm who you are. We match at least two details you give us, such as your name, email address, or the date of your message, with what we hold. For a copy of specific information we may ask for a third detail and a signed declaration. We use these details only to confirm your identity.

Asking for someone else. An authorized agent may ask on your behalf. We may ask for proof that you gave signed permission, and we do not require a power of attorney.

What we cannot find. Our server logs hold no name or contact details, so we have no reliable way to connect them to you and cannot retrieve, correct, or delete one person's entries. They are deleted on the schedule above.

We make no automated decisions about you and do no profiling.

California residents

California's "Shine the Light" law (Cal. Civ. Code § 1798.83) concerns disclosures of personal information to third parties for their direct marketing. We make no such disclosures. California customers may still ask us about this once per calendar year, free of charge, and we will answer within 30 days. You can read more about California privacy rights (opens in new tab) at the Attorney General's website.

Where information is processed, and visitors outside the United States

We are based in the United States, and this website is intended for a United States audience, but the information it collects is not held in the United States alone. Our server, with its logs, is in Germany, and so are its backups. Cloudflare handles requests across its worldwide network. SpinupWP and the contractors who host and maintain this website may reach the server from other countries. Our email is in the United States.

We have no establishment in the European Union or the United Kingdom and do not direct our services to people there. Where the GDPR or the UK GDPR applies to you nevertheless, the legal basis for processing is our legitimate interest in running and securing this website and in answering you (Art. 6(1)(f) GDPR), or the steps toward or performance of an agreement with you (Art. 6(1)(b) GDPR). You also have the right to restrict processing, to receive information you gave us in a portable form, to object at any time to processing based on our legitimate interests, and to complain to a supervisory authority, usually where you live or work.

When we read this information from the United States, it is processed there, where authorities may be able to reach it. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss counterparts. Write to us for a copy of the safeguards that apply.

Children

This website is meant for adults and is not directed to children. We do not knowingly collect personal information from children under 13, and we do not sell or share the personal information of anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

Security

Every page of this website is served over HTTPS, so your connection to it is encrypted. We use reasonable administrative, technical, and physical safeguards suited to the information we hold. To slow attacks on the staff sign-in page, we hold a hash of the network address behind failed sign-ins for about ten minutes. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as the law requires.

Links to other websites

This website links to museums, universities, professional associations, and other organizations, and to our Instagram profile. Those sites have their own privacy practices, which we do not control, so please read their policies before giving them information.

Changes to this policy

We review this policy at least once every 12 months and whenever what we do with information changes. The date at the end of this page is the date of the current version. If we make a material change, we will post a notice at the top of this page and, where the change affects information we hold about you and we have your email address, tell you directly. We will not apply a material change to information we already hold without your consent.

Contact us

You can print this policy from your browser. If you need it in another format because of a disability, tell us and we will provide it.

For privacy questions, requests, or complaints, contact us at:

Cecilia Dan Fine Art
P.O. Box 3210, Santa Monica, CA 90403
Email: office@ceciliadan.com (opens email client)
Telephone: +1 (310) 435‑6870

Effective November 5, 2026