Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

As data controller, we determine why and how your personal data is processed. For data protection matters, you may contact us directly at the address above.

2. Data We Collect

2.1 Information You Provide Directly

• Inquiry & contact forms: name, email address, phone number (optional), message content, artwork of interest.
• Purchase transactions: name, billing and shipping address, email, phone, payment information (processed by our payment provider — we do not store card data).
• Newsletter subscription: email address and, optionally, name and preferences.
• Event registrations: name, email, institution or profession (optional).

2.2 Information Collected Automatically

• Usage data: pages visited, time spent, referring URLs, browser type, device type — collected only if you consent to analytics cookies.
• IP address: your IP address may be processed by Google when loading fonts from their CDN (fonts.googleapis.com and fonts.gstatic.com). See Section 5 for details.
• Cookie preferences: we store your cookie consent choice in your browser's local storage (not shared externally).

2.3 Information We Do Not Collect

We do not collect special category data (health, political opinions, religious beliefs, biometric data, etc.), nor do we collect data from individuals we know to be under 16 years of age.

3. Legal Basis for Processing

Under GDPR Article 6, we process your personal data on the following lawful bases:

• Contract (Art. 6(1)(b)): processing necessary to fulfil a purchase or other contractual relationship with you.
• Legitimate interest (Art. 6(1)(f)): responding to enquiries, preventing fraud, ensuring security of our systems, direct marketing to existing clients (with opt-out).
• Consent (Art. 6(1)(a)): newsletter subscriptions, analytics cookies, and any other processing for which we request your explicit agreement. You may withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)): retention of transaction records as required by Romanian fiscal and commercial law.

4. How We Use Your Data

• To respond to enquiries about artworks, exhibitions, and events.
• To process and fulfil artwork purchases and issue invoices.
• To send our newsletter and editorial content (with your consent).
• To send transactional communications (order confirmations, shipping updates).
• To improve our website and services based on aggregate, anonymised analytics.
• To comply with legal, accounting, and regulatory obligations.
• To prevent fraudulent transactions and protect our systems.

We will never sell your personal data to third parties, nor use it for automated decision-making or profiling that produces legal or similarly significant effects.

5. Sharing with Third Parties

We share personal data only where necessary and with appropriate safeguards:

Google LLC (Fonts CDN)

Our website loads typefaces from Google Fonts (fonts.googleapis.com). When your browser requests these files, your IP address is transmitted to Google's servers in the United States. Google states that it does not use this data to build user profiles. However, this constitutes a transfer of personal data to a third country (see Section 6). We are working to self-host these fonts and will update this policy when complete. For more information, see Google's Privacy Policy.

Payment Processors

For artwork purchases, payment data is processed by our certified payment service provider. We do not store, transmit, or have access to full card numbers. The processor acts as a separate data controller for payment processing.

Email & CRM Providers

We may use third-party email platforms to send newsletters and transactional emails. These providers act as data processors under our instruction and are bound by data processing agreements compliant with GDPR Article 28.

Legal & Regulatory Authorities

We may disclose personal data where required by law, court order, or regulatory authority, including Romanian and EU authorities.

6. International Data Transfers

Some of our service providers (including Google) are located outside the European Economic Area. Where personal data is transferred to third countries, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) adopted by the European Commission.
• Adequacy decisions where applicable.
• Your explicit consent where required.

You may request details of the specific safeguards in place for any transfer by contacting us at privacy@altar.gallery.

7. Data Retention

• Enquiries and correspondence: 2 years from last contact.
• Purchase records and invoices: 10 years, as required by Romanian fiscal law (Law 82/1991).
• Newsletter subscribers: until you unsubscribe, then 30 days.
• Analytics data: 14 months (Google Analytics default), or as configured.
• Cookie consent records: 12 months.

After these periods, data is securely deleted or anonymised.

8. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR Articles 15–22. We will respond to all valid requests within 30 days:

To exercise any right, contact us at privacy@altar.gallery with the subject line "Data Subject Request." We may request identity verification before processing your request.

9. Cookies & Tracking Technologies

We use a minimal set of cookies and local storage technologies. See our full Cookie Policy for details. In summary:

• Essential / functional: your cookie consent choice (local storage). No expiry without clearing browser data. Cannot be disabled — without this, the consent mechanism cannot function.
• Analytics cookies: only loaded with your explicit consent. Used to understand aggregate website usage. You may withdraw consent at any time via the Cookie Preferences link in our footer.
• Marketing cookies: none currently deployed.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data in transit (TLS 1.2+).
• HTTP security headers (X-Frame-Options, Content-Security-Policy, HSTS).
• Access controls limiting data access to authorised personnel only.
• Regular security reviews.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ANSPDCP within 72 hours and affected individuals without undue delay, as required by GDPR Article 33–34.

11. Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us immediately at privacy@altar.gallery and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the revised policy on this page with an updated "Last updated" date. For material changes, we will provide more prominent notice (e.g., by email to subscribers or a notice on the site).

We encourage you to review this policy periodically.

13. Contact & Supervisory Authority

For any questions, requests, or concerns regarding this Privacy Policy or your personal data, contact our data protection contact at:

You also have the right to lodge a complaint with the competent supervisory authority. In Romania:

If you are located in another EU member state, you may also contact your local data protection authority.