Privacy policy

This is a draft skeleton (GDPR Art. 13). It must be reviewed and completed by a lawyer or a legal-text generator before go-live.

1. Controller

{{OWNER_NAME}}, {{ADDRESS}} — Email: mail@artfork.gallery, Phone: {{PHONE}}.

2. Enquiry form

When you send an enquiry we process your name, email, optional phone number and message to answer you and handle a possible sale. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering and documenting enquiries).

3. Newsletter

If offered, the newsletter uses a double opt-in. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw at any time via the unsubscribe link.

4. Analytics

We use Google Analytics / Google Tag Manager only after your consent (Art. 6(1)(a) GDPR, § 25 (1) TDDDG). No analytics cookies or tags are loaded before you opt in via the consent banner. You can change your choice any time via "Cookie settings" in the footer.

Umami (reach statistics)

This site uses Umami, an open-source web analytics tool that we host ourselves at metrics.dolo.work. Umami does not set cookies. When a page is viewed, the following data is processed: the page URL, the referrer (the page you came from), browser, operating system and device type, and the country, which is derived from your IP address; the IP address itself is not stored. The purpose is anonymous statistics about how often the site and its pages are visited.

Legal basis: [Rechtsgrundlage durch Steffen prüfen]

5. Hosting and CDN

The site is hosted and delivered via Cloudflare (Cloudflare, Inc.), which processes connection data (including your IP address) to deliver the site and protect it. Legal basis: Art. 6(1)(f) GDPR.

6. Email provider

Email to mail@artfork.gallery is processed by our email provider.

Transactional notifications may be sent via a transactional email service (Lettermint). Legal basis: Art. 6(1)(f) GDPR.

7. Spam protection

We may use a spam-protection service (e.g. Cloudflare Turnstile) to protect our forms. Legal basis: Art. 6(1)(f) GDPR.

8. Retention

Enquiry data that does not lead to a sale is deleted after 24 months. Sales and accounting records are kept for the statutory periods (6–10 years, Germany).

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent at any time.

10. Right to complain

You may complain to a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).