1. Who We Are
This Privacy Policy explains how Art Gallery D&F s.r.o. processes personal data collected through the website gallerydelafruz.com, by email, by telephone, and in connection with the sale and delivery of artworks.
Controller of personal data:
Art Gallery D&F s.r.o.
Registered office: Chudenická 1059/30, Hostivař, 102 00 Prague 10, Czech Republic
Company ID No. (IČO): 23148268
Registered in the Commercial Register maintained by the Municipal Court in Prague, Section C, Insert 422202
Contact details:
Email: art@gallerydelafruz.com
Phone: +420 731 224 244
Gallery / correspondence address:
Gallery Delafruz
Žatecká 54/12
110 00 Staré Město
Prague, Czech Republic
2. What Personal Data We Process
We may process the following categories of personal data:
- identification data, such as name and surname,
- contact data, such as email address, telephone number, billing address, shipping address,
- order and transaction data, such as purchased artwork, order history, payment status, delivery details,
- communication data, such as messages sent by email, contact form, or phone inquiries,
- technical and website usage data, such as IP address, cookies, device/browser information, and website interaction data,
- complaint and return-related data, if you contact us regarding a complaint, return, or withdrawal.
We only process personal data to the extent necessary for the relevant purpose.
3. Why We Process Personal Data and on What Legal Basis
We process personal data for these purposes:
a) To process orders and perform the contract
We process personal data to accept and process orders, arrange payment, deliver goods, communicate about the order, and handle returns or complaints.
Legal basis: performance of a contract and steps taken before entering into a contract.
b) To comply with legal obligations
We process personal data to comply with accounting, tax, consumer protection, complaint handling, and other legal obligations.
Legal basis: compliance with legal obligations.
c) To respond to inquiries
If you contact us by email, phone, or contact form, we process your data to answer your message and communicate with you.
Legal basis: our legitimate interest in handling communication, or pre-contractual steps where your inquiry relates to a potential order.
d) To protect our legal claims and prevent abuse
We may process personal data where necessary to protect our rights, resolve disputes, enforce contracts, or prevent fraudulent or abusive conduct.
Legal basis: legitimate interest.
e) To operate, secure and improve the website
We may process technical data and cookie-related data to ensure website functionality, security, traffic measurement, and improvement of user experience.
Legal basis: legitimate interest for essential technical and security functions; consent where required for non-essential cookies or similar technologies. EU guidance treats GDPR and ePrivacy transparency around cookies as material information for users.
f) To send marketing communications
If you subscribe to a newsletter or if the law otherwise allows it, we may send marketing communications about our gallery, artworks, exhibitions, or offers.
Legal basis: consent, or legitimate interest where permitted by applicable law for existing customer relationships.
4. Where We Obtain Personal Data From
We obtain personal data mainly:
- directly from you when you place an order,
- when you contact us by email or phone,
- when you submit a contact form,
- when you browse our website,
- from payment and technical service providers involved in order processing.
5. Recipients of Personal Data
We may share personal data with trusted third parties only where necessary, in particular with:
- payment service providers, including Stripe, for payment processing,
- shipping and delivery providers,
- IT, hosting, website maintenance, and security providers,
- accounting, tax, or legal advisers where necessary,
- public authorities where disclosure is required by law.
These parties process personal data either as independent controllers or as processors acting on our instructions, depending on the service provided.
6. International Transfers
Some of our service providers may process personal data outside the European Economic Area or may use sub-processors located outside the EEA.
Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with applicable data protection law, for example adequacy decisions or standard contractual clauses where required by law. GDPR requires a lawful transfer mechanism for personal data sent outside the EU/EEA.
7. How Long We Keep Personal Data
We retain personal data only for as long as necessary for the relevant purpose:
- order and contract data: for the duration of the contractual relationship and thereafter for the period necessary to protect legal claims and meet legal obligations,
- accounting and tax documents: for the retention period required by law,
- communication data: for as long as necessary to handle the communication and any related follow-up,
- complaint and return records: for the period necessary to handle the matter and meet legal obligations,
- marketing data: until consent is withdrawn or objection is made, or until the data is no longer needed,
- cookie-related data: according to the type of cookie and the settings of the cookie tool used on the website.
8. Cookies and Similar Technologies
Our website may use cookies and similar technologies for:
- essential website functionality,
- security,
- remembering preferences,
- analytics and performance measurement,
- marketing, if enabled.
Essential cookies may be used without consent where strictly necessary for the functioning of the website.
Non-essential cookies, especially analytics or marketing cookies, should only be used on the basis of your consent where required by law.
You can manage cookies through your browser settings and, where implemented, through the cookie banner or preference tool on our website.
9. Your Rights
Under applicable data protection law, you may have the right to:
- request access to your personal data,
- request rectification of inaccurate or incomplete data,
- request erasure of personal data,
- request restriction of processing,
- object to processing based on legitimate interests,
- receive your personal data in a structured, commonly used and machine-readable format where the law provides for portability,
- withdraw consent at any time where processing is based on consent,
- lodge a complaint with a supervisory authority.
GDPR requires that data subjects be informed of these rights in the privacy notice.
10. Right to Lodge a Complaint
If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.
In the Czech Republic, the supervisory authority is:
Office for Personal Data Protection
(Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Prague 7
Czech Republic
The Czech Office for Personal Data Protection is the national supervisory authority responsible for personal data protection matters.
11. Whether Providing Data Is Mandatory
Providing personal data for an order is necessary to conclude and perform the purchase contract and to fulfill related legal obligations. If you do not provide the required data, we may not be able to process your order.
Providing data for general inquiries is voluntary, but without the relevant contact data we may not be able to respond.
12. Automated Decision-Making and Profiling
We do not make decisions based solely on automated processing that would produce legal effects or similarly significantly affect you, unless expressly stated otherwise.
If any profiling or automated tools are used in the future in a legally relevant manner, this Privacy Policy will be updated accordingly.
13. Data Security
We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, destruction, or alteration.
However, no method of internet transmission or electronic storage is completely secure, and therefore absolute security cannot be guaranteed.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
The current version will always be published on gallerydelafruz.com.
15. Contact
If you have any questions about this Privacy Policy or about the processing of your personal data, please contact us at:
art@gallerydelafruz.com
+420 731 224 244
or by post at:
Gallery Delafruz
Žatecká 54/12
110 00 Staré Město
Prague, Czech Republic
