This Privacy Policy explains how Gallory (“we”, “us”) processes personal data when you visit gallory.net, use app.gallory.net, or otherwise interact with our services, in accordance with the General Data Protection Regulation (GDPR / AVG).
Who is responsible for your data
Gallory is the data controller for personal data processed through our website and platform. Our registration details are listed on the Colofon page. For any privacy request, contact info@gallory.net.
What data we collect
| Category | Examples | When |
|---|---|---|
| Account data | Name, email, password hash | When you create an account on app.gallory.net |
| Order data | Billing/shipping address, order history | When you purchase artwork |
| Payment data | Handled by our payment providers (see below) — we do not store full card numbers | At checkout |
| Artist payout data | IBAN, payout preferences | If you register as an artist |
| Usage data | Pages visited, device/browser type, aggregated, cookie-free | Automatically, via analytics |
| Communications | Messages you send us | When you contact support |
Why we process your data
- Contract performance — creating your account, processing orders, fulfilling and shipping prints, paying artists.
- Legal obligation — Dutch tax law requires financial records to be retained for 7 years.
- Legitimate interest — securing the platform, preventing fraud, improving the service via aggregated, privacy-respecting analytics.
- Consent — where required, e.g. marketing communications or non-essential cookies (see our Cookie Policy).
Who we share data with
We share personal data only where necessary to run the service, and only with processors bound by a Data Processing Agreement:
- Payment processors — Stripe and/or Mollie, to process your payment. We never see or store your full card details.
- Print fulfillment — our print partner, to produce and ship your print edition. We share only the order and shipping details needed to fulfill it.
- Hosting and infrastructure providers, to run the platform securely.
- Authorities, where required by law.
We do not sell personal data.
International transfers
Where a processor is located outside the EU/EEA, we rely on appropriate safeguards (such as EU Standard Contractual Clauses) to protect your data.
How long we keep your data
We keep personal data only as long as necessary for the purpose it was collected for, and no longer than required by law. Financial records (invoices, order records) are kept for 7 years to meet Dutch tax obligations. Account data is kept until you delete your account, after which it is removed or anonymised except where retention is legally required.
Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data
- Restrict or object to certain processing
- Data portability
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), autoriteitpersoonsgegevens.nl
To exercise any of these rights, contact info@gallory.net.
Cookies
See our Cookie Policy for details on cookies and similar technologies used on this site.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected by an updated “Last updated” date at the top of this page.