Privacy policy

This English version is provided for convenience. Only the German version is legally binding.

This privacy policy applies to the online shop of ArtGalerie-TC at artgalerie-tc.com. It explains which personal data we process when you visit our website, order a work, request a commissioned work or subscribe to our newsletter. You will also learn what rights you have and how to exercise them.

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

ArtGalerie-TC
Proprietor: Tuncer Cakmakci
Hortensienring 67
65929 Frankfurt am Main
Germany

Telephone: +49 (0) 178 7199695
Email: info@artgalerie-tc.com

We have not appointed a data protection officer. You can contact the proprietor directly with any questions about data protection.

2. Overview

The key points in brief:

  • Visiting the website: Technical access data is generated. In addition, the shop sets cookies that are necessary for the shopping basket and the checkout process.
  • Analytics and marketing: Shopify's analytics and the services of Google, Meta, Pinterest and uptain only start once you give your consent in the cookie banner. You can change your choice at any time.
  • Orders: We process the data that is necessary for the contract, payment, delivery and invoicing. For this purpose, we pass it on to payment service providers and shipping companies.
  • Forms: We use information from the contact form, the commission request form and the withdrawal form only to deal with your request.
  • Newsletter: You will only receive it if you have confirmed your subscription by email. The subscription also includes reminders about a shopping basket that you did not order. You can unsubscribe from the newsletter at any time.
  • Technology: Our shop runs on the Shopify platform. Some service providers are based outside the EU or belong to groups of companies from the USA or Canada. Section 12 sets out the safeguards.

Legal bases

We only process your data if the law permits it. In the following sections, we state the specific legal basis in each case. This refers to:

  • Consent (Art. 6(1)(a) GDPR): You have expressly agreed. You can withdraw your consent at any time.
  • Contract (Art. 6(1)(b) GDPR): The data is necessary to conclude or perform a contract with you or to deal with your request before a contract is concluded.
  • Legal obligation (Art. 6(1)(c) GDPR): A law obliges us to carry out the processing, in particular to retain invoices and business records.
  • Legitimate interest (Art. 6(1)(f) GDPR): We have a legitimate interest, which we specify in each case, and your interests do not override it. You can object to this processing (Section 14).
  • Access to your device (§ 25 TDDDG [German Telecommunications Digital Services Data Protection Act]): We may only use cookies and similar technologies with your consent (§ 25 (1) TDDDG). An exception applies if they are strictly necessary for the shop you have requested to function (§ 25 (2) no. 2 TDDDG).

3. Hosting by Shopify

Our online shop runs on the Shopify platform. The provider for merchants in Europe is Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland (hereinafter ‘Shopify’).

Shopify provides the website, the shopping basket, the checkout process, the customer accounts and the order management. Shopify also delivers pages, images and fonts via its own server network. No connection to Google Fonts is established. All data generated when you visit the website and when you place an order is therefore processed on servers of Shopify and its technical service providers.

  • Purpose: Operation of the online shop.
  • Data: Access data (Section 4), cookie data (Section 5), order and customer data (Section 6), form entries (Section 9) and newsletter data (Section 10).
  • Legal basis: Art. 6(1)(b) GDPR insofar as your order, your customer account or your request is concerned. Otherwise Art. 6(1)(f) GDPR. Our legitimate interest is a secure, fast and reliable shop, which, as a small business, we can only operate with a specialised provider.
  • Role of Shopify: Shopify processes this data on our behalf and in accordance with our instructions (processing on behalf of a controller, Art. 28 GDPR). This is based on Shopify's data processing agreement.
  • Other recipients: Shopify uses sub-processors. According to the published list, these include Amazon Web Services, Inc. (USA) and Google Cloud Canada Corporation (Canada) for hosting and Cloudflare, Inc. (USA) for load balancing and protection against attacks. In addition, there are companies of the Shopify group, for example Shopify Inc. in Canada.
  • Third countries: Data may be transferred to Canada, to the USA and to other countries outside the EU. An adequacy decision of the European Commission applies to Canada (for commercial organisations). For transfers to companies of the Shopify group and to sub-processors in other third countries, Shopify uses the standard contractual clauses of the European Commission. According to the English version of its privacy policy dated 7 July 2026, approved binding internal data protection rules (Binding Corporate Rules) additionally apply within the Shopify group.
  • Storage period: see Section 13.

Further information: Shopify's privacy policy, Shopify's data processing agreement, list of sub-processors.

Shopify as an independent controller

Shopify additionally processes part of the data under its own responsibility. Shopify calls this setting ‘Shopify Network Intelligence’. It is a prerequisite for us being able to send our newsletter with Shopify's email tool.

In doing so, Shopify uses data about your use of our shop together with data from other shops that are operated with Shopify. Shopify uses this to provide, analyse and improve its services. In the process, the data may be transferred to Shopify and to third parties in other countries.

Shopify only shows advertising based on your activities to visitors from the European Economic Area, the United Kingdom and Switzerland with their consent. You give this consent in our shop's cookie banner. You can withdraw it there at any time (Section 5). If you reject the non-essential cookies in the cookie banner, Shopify states that it does not use your device data for such additional purposes.

  • Legal basis for the disclosure by us: Art. 6(1)(f) GDPR. Our legitimate interest is to use the platform functions that Shopify only offers with this setting, in our case the sending of the newsletter.
  • Shopify's legal bases: According to its own information, Shopify bases personalised advertising on your consent and the other processing on legitimate interests.
  • Your rights against Shopify: You can assert access, erasure, withdrawal of consent and objection directly via Shopify's privacy portal.

Details can be found in Shopify's consumer privacy policy.

4. Access data and protection against misuse

Access data when you visit the website

When you open a page of our shop, your browser transmits data to Shopify's servers for technical reasons. This data is:

  • IP address,
  • date and time of access,
  • page or file accessed,
  • the page from which you came,
  • information about the browser, operating system and device.
  • Purpose: To deliver the pages, operate the shop in a stable and secure manner, ward off attacks and find errors.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a functioning and secure website.
  • Recipients: Shopify and its technical service providers (Section 3).
  • Storage period: The data is deleted as soon as it is no longer required for these purposes. Shopify does not specify a fixed period for individual log data.
  • Necessity: Without this data, the website cannot be displayed for technical reasons.

Protection against spam and automated access (hCaptcha)

Shopify protects the forms and login pages of our shop against automated access with the hCaptcha service. hCaptcha checks in the background whether an entry comes from a human. A challenge only appears if anything unusual is detected.

  • Provider: Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA.
  • Data: According to the provider, signals that can be used to distinguish humans from programs (mouse movements, scroll position, keyboard and touch inputs), as well as the IP address, information about the browser, device and operating system, and the time. hCaptcha may set cookies for this purpose.
  • Purpose: Protection of our forms and the customer accounts against spam and misuse.
  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is this protection. Insofar as hCaptcha stores or reads information on your device for this purpose, we base this on § 25 (2) no. 2 TDDDG, because we cannot offer forms and login securely without protection against automated access.
  • Third country: The data is processed in the USA. The provider states that it participates in the EU-US Data Privacy Framework and additionally uses standard contractual clauses.
  • Storage period: The provider does not specify a fixed period for the verification data. In its privacy policy (in English), it states that it does not store any data about end users in the long term. According to the provider, hCaptcha's cookies expire after 30 days at the most.

5. Cookies and consent

Cookies are small text files that your browser stores. The browser's local storage and session storage work in a similar way. § 25 TDDDG applies to all of these technologies: anything that is not strictly necessary may only be stored or read with your consent.

Necessary cookies

The shop needs these cookies so that the shopping basket, the checkout process, login and your cookie choice work. They are set without consent. Examples:

Cookie Purpose Duration
_shopify_essential Session, checkout process and protection against manipulation 1 year
cart Contents of the shopping basket 2 weeks
cart_currency Currency of the shopping basket 2 weeks
localization Country for which the shopping basket is calculated 1 year

Shopify occasionally changes the names and number of its cookies. You can find the list in Shopify's cookie policy in the section on merchants' shops.

  • Legal basis: § 25 (2) no. 2 TDDDG for access to your device. For the further processing, Art. 6(1)(b) GDPR (shopping basket and order) and Art. 6(1)(f) GDPR. Our legitimate interest is a functional and secure shop.

Cookies and services requiring consent

We only use analytics and marketing if you give your consent in the cookie banner. These include Shopify's analytics and marketing cookies (maximum duration one year) and the services of Google, Meta, Pinterest and uptain. Details can be found in Section 11.

Your consent in the cookie banner also allows Shopify to use your device data for its own purposes, including for advertising based on your activities in our shop and in other Shopify shops. Details can be found in Section 3 under ‘Shopify as an independent controller’.

  • Legal basis: Your consent under § 25 (1) TDDDG and Art. 6(1)(a) GDPR.

Giving, changing and withdrawing consent

On your first visit, Shopify's cookie banner asks you whether you wish to allow non-essential cookies and services. You can accept, reject or specify your choice in detail. As long as you do not give your consent, these services remain switched off. Even if you reject them, you can use the shop in full and place orders.

Your choice is stored in your browser so that we do not ask you again each time you open a page.

You can change or withdraw your consent at any time: To do so, open the cookie settings via the link in the footer of our website. There you can make your choice again. The withdrawal applies for the future. Processing carried out before the withdrawal remains lawful.

In addition, you can delete or block cookies in your browser settings. If you also block necessary cookies, the shopping basket and the checkout process may no longer work.

6. Orders and customer account

Orders in the shop

When you order a work, we process the data that you provide in the checkout process:

  • first name and surname, company if applicable,
  • billing and delivery address,
  • email address and, if you provide it, telephone number,
  • works ordered, prices, selected payment and shipping method, order and payment status,
  • your messages regarding the order,
  • technical information about the order such as time and IP address.
  • Purpose: To conclude and perform the contract of sale. This includes the order confirmation, payment, packaging, delivery, invoicing, customer service and the handling of withdrawals and warranty claims. We send the order confirmation and the shipping notification by email.
  • Legal basis: Art. 6(1)(b) GDPR. For the retention of invoices and business records, Art. 6(1)(c) GDPR in conjunction with § 147 Abgabenordnung (German Fiscal Code) and § 14b Umsatzsteuergesetz (German VAT Act). If you order for a company or have the goods delivered to another person, we process the data of the contact person and of the recipient on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to perform the contract with the person placing the order.
  • Recipients: Shopify (Section 3), the payment service provider you have chosen (Section 7), the shipping company (Section 8), our bank in the case of payment in advance and our tax adviser for accounting. Authorities only receive data if we are legally obliged to provide it, for example the tax office or customs.
  • Storage period: see Section 13.
  • Necessity: Without this information, we cannot accept or deliver your order.

Started but uncompleted orders

If you enter your email address in the checkout process but do not complete the order, Shopify stores the information entered up to that point as an abandoned checkout. Shopify automatically deletes these entries from our shop administration after three months.

  • Legal basis: Art. 6(1)(b) GDPR, because you are preparing a purchase with the checkout process, and Art. 6(1)(f) GDPR. Our legitimate interest is to be able to answer queries about a purchase that has been started and to identify technical errors in the checkout process.

You will only receive an email reminder about this under the conditions described in Section 11 under uptain.

Indications of attempted fraud

For incoming orders, Shopify shows us indications of a possible risk of fraud. These include, for example, the result of the address verification for card payments and the IP address from which the order was placed.

  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is protection against payment fraud.

We ourselves do not have orders automatically rejected or cancelled. The proprietor decides whether we carry out an order, contact you with a query or cancel it.

Customer account

You can order as a guest. A customer account is voluntary. Your name, your email address, your addresses and your orders are stored in the account. You log in with your email address.

  • Purpose: You can view your orders and do not have to enter your address again when you place a further order.
  • Legal basis: Art. 6(1)(b) GDPR (use of the account that you create yourself).
  • Storage period: Until you have the account deleted. A message to us is sufficient for this. Beyond that, we retain data from orders for as long as statutory retention periods are running (Section 13).

7. Payment service providers

For the payment, the payment service provider that you select in the checkout process receives the data necessary for this: the amount, details of the order, your contact and address data and the details of your means of payment. We do not see or store full card numbers.

  • Purpose: Processing of the payment and, if necessary, of the refund.
  • Legal basis: Art. 6(1)(b) GDPR. For the retention of payment records, Art. 6(1)(c) GDPR.
  • Providers' own responsibility: The payment service providers additionally process data under their own responsibility, for example for fraud prevention, risk assessment and compliance with legal obligations. Their own privacy notices apply to this.
  • Necessity: Without this data, the selected payment method is not possible. You can choose a different payment method.

Shopify Payments (credit card, Apple Pay, Google Pay, Klarna)

Payments by credit card, Apple Pay, Google Pay and Klarna are processed via Shopify Payments. Our contractual partner for this is Shopify International Limited (address in Section 3). The actual payment processing is carried out by payment processors commissioned by Shopify. For Germany, Shopify names Stripe Payments Europe, Limited (Ireland), Adyen N.V. (Netherlands) and PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).

These companies process the payment data as sub-processors of Shopify and in part under their own responsibility, for example for fraud detection. In the process, data may be transferred to Canada and to the USA. Stripe states that its parent company Stripe, LLC is certified under the EU-US Data Privacy Framework, and additionally uses standard contractual clauses.

Further information: Stripe's privacy policy, Shopify's list of payment processors with links to their privacy notices (in English).

Apple Pay

If you pay with Apple Pay, the payment is processed via your Apple device. Apple Distribution International Limited, Ireland, is the controller for persons in the European Economic Area. According to Apple, your card number is not passed on to the merchant. We receive the information we need for the order, for example the delivery and billing address and the email address. For transfers to countries outside the EU, Apple uses standard contractual clauses.

Further information: Apple Pay privacy notice, Apple's privacy policy.

Google Pay

If you pay with Google Pay, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is the controller for this. According to its own information, Google records for each payment, among other things, the date, time and amount, the merchant, the payment method used and a description of the purchase. According to Google, Google LLC in the USA is certified under the EU-US Data Privacy Framework. In addition, Google uses standard contractual clauses.

Further information: Google Payments privacy notice.

Klarna

If you choose a Klarna payment method, Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, receives your contact and address data as well as the details of the order and the amount. Klarna is itself the controller for this processing.

According to its own information, Klarna carries out internal and external credit and fraud checks. For credit checks in Germany, Klarna may transmit your name, address, date of birth and telephone number to credit agencies such as SCHUFA. It is Klarna, not us, that decides on the outcome of this check.

According to its own information, Klarna also transfers data to recipients outside the EU, on the basis of adequacy decisions, standard contractual clauses or the EU-US Data Privacy Framework.

Further information: Data protection at Klarna, Klarna's full privacy notice. Klarna's data protection contact: datenschutz@klarna.de.

PayPal

If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, processes your data under its own responsibility. This includes your name, address, email address, details of your means of payment, the amount, the shopping basket and the delivery address. This also applies if you pay via PayPal without a PayPal account.

In its privacy notices, PayPal describes its own checks regarding risk, fraud and creditworthiness, which may also be carried out automatically. Within the PayPal group, data is transferred to countries outside the EU on the basis of binding corporate rules, and otherwise on the basis of adequacy decisions or standard contractual clauses. According to its own information, PayPal stores data for the duration of the business relationship and for ten years thereafter.

Further information: PayPal's privacy statement.

Payment in advance (bank transfer)

If you pay in advance, you transfer the amount to our bank account. Your transfer contains your name, your IBAN, the amount and the payment reference. Our bank and we process this data in order to allocate the incoming payment to your order.

  • Legal basis: Art. 6(1)(b) GDPR. For the retention of the bank statements as accounting records, Art. 6(1)(c) GDPR.

8. Shipping

We ship with parcel services and freight forwarders. Which company transports your consignment is not determined in advance. It depends on the individual consignment.

  • Data: Name and delivery address. We only pass on your telephone number or email address if this is necessary for delivery, for example to arrange an appointment for a delivery by a freight forwarder or for customs clearance abroad.
  • Purpose: Delivery of your order.
  • Legal basis: Art. 6(1)(b) GDPR. For a recipient other than the person placing the order, Art. 6(1)(f) GDPR (Section 6).
  • Recipients: The commissioned shipping company. It processes the data for the transport under its own responsibility.

Deliveries to countries outside the EU

In addition to Germany, we deliver to the other EU countries and to countries outside the European Union. Excluded countries are listed on the Shipping and Delivery page. In the case of such a delivery, the shipping company and the customs authorities in the country of destination receive your name, your address, your contact details and information about the contents and value of the consignment.

For some of these countries, the European Commission has determined an adequate level of data protection, for example for Switzerland, the United Kingdom, Japan and New Zealand. For the other countries, there is no such decision. In any case, the transfer is necessary to perform the contract (Art. 49(1)(b) GDPR, and for a recipient other than the person placing the order, Art. 49(1)(c) GDPR).

9. Contact form, commission request and withdrawal form

The three forms on our website use Shopify's form function. Your entries are sent via Shopify as an email to our mailbox. Our email mailbox is provided by an email provider that stores the messages for us. The forms are protected against spam by hCaptcha (Section 4).

Contact form, email and telephone

  • Data: The information you provide in the form, in particular your name, email address and your message. For emails and calls, the information that you give us.
  • Purpose: To answer your enquiry.
  • Legal basis: Art. 6(1)(b) GDPR if the enquiry concerns an order or a quotation. Otherwise Art. 6(1)(f) GDPR. Our legitimate interest is to answer enquiries from prospective customers and customers.
  • Storage period: We delete your enquiry as soon as it has been dealt with and no further queries are to be expected. We retain correspondence relating to an order or a commission for six years (Section 13).
  • Necessity: The information is voluntary. Without a means of contacting you, we cannot reply to you.

Commission request

Using the request form, you can request a painting made to your wishes, as a private individual or on behalf of a company.

  • Data: Name, email address, optionally company and telephone number, desired size, colours, frame, budget range and your message. In addition, photos of your room if you send them to us by email.
  • Purpose: To understand your wishes, advise you and prepare an individual quotation. If you place the commission: to produce, deliver and invoice the work.
  • Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into a contract at your request and subsequently the contract). For requests on behalf of a company, Art. 6(1)(f) GDPR applies to the data of the contact person. Our legitimate interest is to deal with the company's request.
  • Storage period: If a commission is placed, we retain the quotation and correspondence for six years and the invoice for eight years (Section 13). If no commission is placed, we delete your request as soon as this is certain and no further queries are to be expected.
  • Necessity: We need your name and email address in order to send you a quotation. All other information helps us with the planning. Company and telephone number are voluntary.

Personal consultation

For commissioned works, we will advise you personally on request, on site in the Rhine-Main area or by video call.

  • Data: Your contact details, the information from your request and what you tell us during the conversation. For an appointment on site, also the address of the location.
  • Purpose: To arrange the appointment, hold the conversation and prepare a quotation.
  • Legal basis: Art. 6(1)(b) GDPR. For contact persons of companies, Art. 6(1)(f) GDPR.
  • Video call: During a video call, the provider of the video service processes image, sound and technical connection data. We will tell you which service we use with the invitation to the appointment.
  • Storage period: as for the commission request.

Withdrawal form (‘Withdraw from contract’)

Consumers can declare their withdrawal online via the ‘Withdraw from contract’ page.

  • Data: Your name, the details of the contract from which you are withdrawing, your email address for the acknowledgement of receipt, and the date and time of receipt.
  • Purpose: To receive your withdrawal, confirm its receipt and reverse the purchase.
  • Legal basis: Art. 6(1)(c) GDPR in conjunction with § 356a BGB [German Civil Code] (obligation to provide the withdrawal function and to confirm receipt) and Art. 6(1)(b) GDPR (reversal of the contract).
  • Storage period: Declarations of withdrawal form part of the correspondence relating to the order and are retained for six years. We retain records of the refund for eight years (Section 13).
  • Necessity: You do not have to use the form. You can also withdraw by other means, for example by email or letter.

10. Newsletter

In the footer of the website, you can subscribe to our newsletter with your email address. The newsletter contains information and offers from ArtGalerie-TC, for example about new works.

Shopping basket reminder: Your subscription also includes personal email reminders about works that you have placed in the shopping basket but not purchased. These reminders are sent by uptain GmbH on our behalf. For this purpose, uptain receives your email address and the information that you have confirmed your subscription. Details can be found in Section 11.

Confirmation by email (double opt-in): After subscribing, you will receive an email with a confirmation link. Only when you click this link will we add you to the mailing list. This ensures that nobody can subscribe someone else's email address.

  • Data: Your email address, the status of your subscription, confirmation and unsubscription, and information on whether you have opened a newsletter and which links you have clicked. This information is linked to your email address.
  • Purpose: Sending the newsletter and the shopping basket reminders, improving the newsletter and proving your consent.
  • Legal basis: Your consent under Art. 6(1)(a) GDPR and § 7 (2) no. 2 UWG (German Act against Unfair Competition). We store the status of the subscription on the basis of Art. 6(1)(f) GDPR. Our legitimate interest is to be able to prove your consent (Art. 7(1) GDPR).
  • Sending: We send the newsletter with Shopify's email tool (Shopify Email, now Shopify Messaging). Shopify processes the data for this purpose on our behalf (Section 3). According to its list of sub-processors, Shopify uses Mailgun Technologies, Inc. and Twilio Inc. in the USA for the technical transmission of the emails and agrees standard contractual clauses with them. The shopping basket reminders are sent by uptain (Section 11).
  • Analysis: Our newsletters contain a tracking pixel. Shopify uses it to record whether a newsletter has been opened. Shopify also records whether a newsletter has been delivered and which links have been clicked. We can also see this information for individual recipients. We use it to improve the newsletter. The legal basis is the consent you gave when subscribing (Art. 6(1)(a) GDPR, § 25 (1) TDDDG). This analysis ends when you unsubscribe.
  • Storage period: Until you unsubscribe from the newsletter. After that, your email address remains stored with the note ‘unsubscribed’ so that you do not receive any further newsletters and so that we can prove your earlier consent (Art. 6(1)(f) GDPR). On request, we will delete the entry completely, unless we need it for an order.
  • Necessity: Subscription is voluntary. You can use the shop in full without the newsletter.

Unsubscribing: You can withdraw your consent at any time. To do so, click the unsubscribe link at the end of each newsletter or write to us at info@artgalerie-tc.com. The withdrawal applies for the future.

11. Analytics and marketing

We only use the services of Shopify, Google, Meta, Pinterest and uptain described in this section if you have given your consent in the cookie banner. Without your consent, they remain switched off. The legal basis in each case is your consent under Art. 6(1)(a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time via the cookie settings (Section 5). Consent is voluntary. You will suffer no disadvantages without it.

Google, Meta, Pinterest and uptain are integrated via the providers' official Shopify apps.

Shopify analytics

With your consent, Shopify analyses for us how visitors use the shop.

  • Data: Pages accessed and works viewed, contents of the shopping basket, steps in the checkout process, the page from which you came, information about the browser and device, and the IP address. For this purpose, Shopify sets analytics and marketing cookies that are valid for a maximum of one year.
  • Purpose: We want to understand which pages and works attract interest, and to improve the shop.
  • Recipients: Shopify as processor (Section 3).
  • Storage period: The cookies expire after one year at the most. The analyses are available to us for as long as we operate the shop with Shopify.

Google Analytics 4

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Integrated via the Shopify app ‘Google & YouTube’.
  • Purpose: We want to understand how visitors find us and how they use the shop in order to improve our range and the website.
  • Data: Pages accessed, works viewed, shopping basket and purchase events, information about the browser and device, an approximate location and an identifier that is stored in the cookie _ga (duration two years). Google states that Google Analytics neither logs nor stores the IP addresses of users from the EU. The IP address is only used to derive the approximate location.
  • Role of Google: Google processes the data for Google Analytics on our behalf (processing on behalf of a controller, Art. 28 GDPR).
  • Third country: Data may be transferred to Google LLC in the USA. According to Google, Google LLC is certified under the EU-US Data Privacy Framework. In addition, Google uses standard contractual clauses.
  • Storage period: Google Analytics automatically deletes data linked to cookies or user identifiers after 14 months at the latest.

Further information: Google's privacy policy.

Google Ads (conversion measurement)

  • Provider: Google Ireland Limited (address as above). Integrated via the Shopify app ‘Google & YouTube’.
  • Purpose: We measure whether a click on one of our ads on Google leads to a purchase. This allows us to assess which ads are worthwhile.
  • Data: An identifier of the ad click, which is stored in a cookie (cookies whose names begin with _gcl_, duration 90 days), the time, the purchase event and the order value, as well as technical information such as IP address and browser. Purchase events are additionally transmitted directly from Shopify's servers to Google (server-to-server transmission). We ourselves only receive aggregated statistics from Google.
  • Role of Google: For Google Ads, Google processes the data as an independent controller.
  • Passing on your choice: If you give your consent, your choice from the cookie banner is passed on to Google so that Google respects it (Google Consent Mode).
  • Third country: as for Google Analytics.
  • Storage period: The cookie expires after 90 days. How long Google stores the data beyond this is governed by Google's privacy policy.

Further information: Google's privacy policy. If you have a Google account, you can change your advertising settings in Google's My Ad Center.

Meta Pixel and Conversions API (Facebook and Instagram)

  • Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter ‘Meta’). Integrated via the Shopify app ‘Facebook & Instagram’.
  • Purpose: We measure how effective our ads on Facebook and Instagram are. In addition, our ads are intended to reach people who might be interested in our works, for example previous visitors to the shop.
  • Data: Events in the shop (pages accessed, works viewed, shopping basket, checkout started, purchase with order value) and technical information such as IP address, browser and Meta cookie identifiers. The Meta Pixel collects this data in your browser. Via the Conversions API, such events are additionally transmitted to Meta directly from server to server.
  • Storage in your browser: The Meta Pixel sets cookies on our domain, in particular _fbp (identifier of your browser) and _fbc (identifier of a click on an ad from Meta). These cookies remain stored beyond your visit. The Meta Pixel transmits the identifiers to Meta.
  • Matching with Meta accounts: So that Meta can assign the events to a Facebook or Instagram account, contact data is also transmitted, insofar as it is available to us: name, email address, telephone number and town or city. The Meta Pixel converts such information into hash values before transmission. According to its own information, Meta only uses them for matching and deletes them afterwards.
  • Third country: Data may be transferred to Meta Platforms, Inc. in the USA. Meta bases this on the EU-US Data Privacy Framework, under which, according to Meta, Meta Platforms, Inc. is certified, and alternatively on standard contractual clauses.
  • Storage period: Under its terms of use, Meta may retain the event data for a maximum of two years. Audiences that we create from it remain in place until we delete them.

Joint controllership: We are jointly responsible with Meta for the collection of the event data in our shop and its transmission to Meta (Art. 26 GDPR). For this purpose, we have concluded an agreement with Meta, the Controller Addendum. Its key points:

  • We inform you about the joint processing with this policy and obtain your consent.
  • Meta is responsible for fulfilling your rights under Art. 15 to 20 GDPR with regard to the data that Meta stores after the joint processing.
  • You can assert your rights directly with Meta. We forward any requests on this matter that reach us to Meta.

Meta is solely responsible for the processing after the transmission. Insofar as Meta matches contact data and produces analyses of our ads for us, Meta acts as our processor.

The information under Art. 13(1)(a) and (b) GDPR about Meta, Meta's legal bases and the ways in which you can exercise your rights against Meta can be found in Meta's privacy policy.

Pinterest Tag

  • Provider: Pinterest Europe Limited, 3rd Floor, Waterloo Exchange, Waterloo Road, Dublin 4, Ireland (hereinafter ‘Pinterest’). Integrated via the Pinterest app for Shopify. The app sets up the Pinterest Tag and Pinterest's conversions interface.
  • Purpose: We measure how effective our ads and Pins on Pinterest are, and we want to show ads to suitable people.
  • Data: Your visits to our shop and purchases, technical information such as IP address, browser and operating system, and identifiers in Pinterest cookies (for example _pin_unauth and _epik). According to Pinterest, these cookies remain for one year. Via the conversions interface, events such as purchases are additionally transmitted to Pinterest directly from server to server.
  • Contact data: According to Pinterest, the Pinterest app also receives access to contact data from orders (name, email address, telephone number, address). Pinterest may use the email address as a hash value in order to assign an event to a Pinterest account.
  • Third country: Data may be transferred to Pinterest, Inc. in the USA. According to Pinterest, Pinterest, Inc. is certified under the EU-US Data Privacy Framework. Otherwise, Pinterest uses adequacy decisions and standard contractual clauses.
  • Storage period: The cookies expire after one year. Pinterest states that it generally stores log data for 25 months.

Joint controllership: We are jointly responsible with Pinterest for the collection of the data via the Pinterest Tag and its transmission to Pinterest (Art. 26 GDPR). This is based on the joint controllership agreement in Pinterest's advertising agreement. We inform you about this processing and obtain your consent. You can assert your rights under Art. 15 to 21 GDPR directly with Pinterest. We forward any requests on this matter that reach us to Pinterest. Pinterest is solely responsible for the processing after the transmission.

Further information: Pinterest's privacy policy.

uptain (notification window and shopping basket reminder)

  • Provider: uptain GmbH, Obergrünewalder Str. 8A, 42103 Wuppertal, Germany. uptain processes the data on our behalf (processing on behalf of a controller, Art. 28 GDPR).
  • What uptain does: uptain detects when a visitor is likely to be about to leave the shop with a full shopping basket and then displays a notification window. uptain can also send an email reminder about an uncompleted shopping basket.
  • Data: Your usage behaviour in the shop. For this, uptain names the movement of the mouse pointer, the length of stay, links clicked and information that you enter in the shop. In addition, the contents of your shopping basket and randomly generated identifiers. uptain only processes your email address if you have entered it in the shop or if we have it from your newsletter subscription. According to uptain, the IP address is not recorded in the default setting.
  • Storage in your browser: uptain does not use cookies, but entries in your browser's local storage and session storage, for example __up_cid (browser identifier), __up_sid (session identifier) and __up_data (usage data). The entries mentioned are held in local storage. They may remain there beyond your visit, at most until you clear your browser's storage. Entries in session storage, for example __up_tid (browser tab identifier), end with the session.
  • Email reminder: You will only receive a reminder about your shopping basket if you have subscribed to our newsletter and confirmed your subscription (Section 10) and if you have additionally given your consent in the cookie banner. The newsletter subscription expressly includes these reminders. Anyone who has not subscribed will not receive a reminder, not even as a former customer. Each reminder contains an unsubscribe link.
  • Legal basis: Your consent in the cookie banner under Art. 6(1)(a) GDPR and § 25 (1) TDDDG. For the email reminder, additionally your consent when subscribing to the newsletter (Art. 6(1)(a) GDPR, § 7 (2) no. 2 UWG).
  • Place of processing: According to its own information, uptain operates the service on servers in Frankfurt am Main. The hosting service provider is Amazon Web Services. According to its own information, uptain has concluded a data processing agreement with standard contractual clauses with this service provider.
  • Storage period: uptain only uses your email address for the shopping basket reminder. According to its own information, uptain deletes the data as soon as we request deletion, and at the latest when our contract with uptain ends. If you withdraw your consent or request deletion, we will arrange for the deletion at uptain.

Further information: uptain's data protection information.

Link to Instagram

Our website contains a simple link to our Instagram profile. As long as you do not click the link, no data is transmitted to Instagram as a result. If you click the link, you leave our website. Meta's privacy notices then apply.

12. Recipients and transfers to third countries

Your data is only received by the bodies that need it for the purposes described. The table summarises the recipients and shows whether data may reach countries outside the EU and the European Economic Area and how it is protected there.

Recipient Task Registered office Third country and safeguard
Shopify International Limited Shop platform, checkout process, customer accounts, newsletter dispatch Ireland Canada (adequacy decision), USA and other countries (standard contractual clauses, within the Shopify group additionally binding corporate rules)
Intuition Machines, Inc. (hCaptcha) Protection against automated access USA USA (EU-US Data Privacy Framework according to the company's own information, standard contractual clauses)
Stripe Payments Europe, Limited and Adyen N.V. Payment processing for Shopify Payments Ireland, Netherlands For Stripe: USA (EU-US Data Privacy Framework according to the company's own information, standard contractual clauses)
PayPal (Europe) S.à r.l. et Cie, S.C.A. Payment with PayPal Luxembourg Countries outside the EU (binding corporate rules, adequacy decisions, standard contractual clauses)
Klarna Bank AB (publ) Payment with Klarna Sweden Countries outside the EU (adequacy decisions, standard contractual clauses, EU-US Data Privacy Framework)
Apple Distribution International Limited Apple Pay Ireland Countries outside the EU (standard contractual clauses)
Google Ireland Limited Google Pay, Google Analytics, Google Ads Ireland USA (EU-US Data Privacy Framework according to the company's own information, standard contractual clauses)
Meta Platforms Ireland Limited Meta Pixel and Conversions API Ireland USA (EU-US Data Privacy Framework according to the company's own information, standard contractual clauses)
Pinterest Europe Limited Pinterest Tag Ireland USA (EU-US Data Privacy Framework according to the company's own information, standard contractual clauses)
uptain GmbH Notification window and shopping basket reminder Germany No transfer planned. Servers in Frankfurt am Main.
Parcel services, freight forwarders and customs authorities Delivery depending on the consignment Country of destination of the delivery (Art. 49(1)(b) and (c) GDPR)

In addition, the provider of our email mailbox, the provider of the video service in the case of a video call, our bank and our tax adviser receive the data necessary for communication, payment and accounting. The tax adviser is bound by professional secrecy. Authorities only receive data if we are legally obliged to provide it.

What the safeguards mean

  • Adequacy decision: The European Commission has determined that a country or a scheme offers a level of data protection that corresponds to that of the EU.
  • EU-US Data Privacy Framework: An adequacy decision for companies in the USA that have been certified under it. You can check whether a company is certified in the official list (in English).
  • Standard contractual clauses: Contract texts specified by the European Commission, with which the recipient undertakes to protect the data. You can find the text in Implementing Decision (EU) 2021/914.
  • Binding corporate rules: Rules approved by data protection authorities that apply within a group of companies.

If you would like to know which safeguard applies to a particular recipient, or would like a copy of it, please write to us.

13. Storage period

We only store your data for as long as we need it for the respective purpose or as the law requires. In detail:

  • Invoices and accounting records (including payment records and records of refunds): eight years (§ 147 (1) no. 4, (3) Abgabenordnung, § 14b (1) Umsatzsteuergesetz).
  • Customs documents for deliveries to countries outside the EU (export declaration and the associated records containing your name, your address and the contents and value of the consignment): ten years (§ 147 (1) no. 4a, (3) Abgabenordnung).
  • Business letters (correspondence relating to orders and commissions, including by email, quotations, declarations of withdrawal): six years (§ 147 (1) nos. 2 and 3, (3) Abgabenordnung).
  • Books, records and annual financial statements: ten years (§ 147 (1) no. 1, (3) Abgabenordnung).
  • Start of the periods: The periods begin at the end of the calendar year in which the record was created or the letter was sent or received. Insofar as the Handelsgesetzbuch (German Commercial Code) applies to us, the same periods result from § 257 HGB.
  • Customer account: until you request deletion.
  • Started but uncompleted orders: three months.
  • Enquiries without a contract: until your enquiry has been dealt with and no further queries are to be expected.
  • Newsletter: until you unsubscribe. The note of your unsubscription remains stored until you request deletion (Section 10).
  • Cookies and marketing services: as stated in Sections 5 and 11.

As long as a statutory retention period is running, we only use the data for this purpose. After the periods have expired, we delete or anonymise it. We only retain data for longer if, in an individual case, we need it to clarify legal claims.

14. Your rights

You have the following rights vis-à-vis us. To exercise them, an informal message to info@artgalerie-tc.com or to our postal address is sufficient. Exercising your rights is free of charge for you. We will respond without undue delay, at the latest within one month.

  • Access (Art. 15 GDPR): You can find out whether we process data about you and which data, and receive a copy.
  • Rectification (Art. 16 GDPR): You can request that we correct inaccurate data and complete incomplete data.
  • Erasure (Art. 17 GDPR): You can request that we delete your data insofar as we no longer need it and there is no obligation to retain it.
  • Restriction of processing (Art. 18 GDPR): In certain cases, you can request that we only store your data and do not use it any further, for example while we check its accuracy.
  • Notification of recipients (Art. 19 GDPR): If we rectify or delete data or restrict its processing, we will inform the recipients of this. On request, we will tell you who these recipients are.
  • Data portability (Art. 20 GDPR): On request, you will receive data that you have provided to us and that we process by automated means on the basis of your consent or a contract in a commonly used, machine-readable format.
  • Withdrawal of consent (Art. 7(3) GDPR): You can withdraw any consent you have given at any time with effect for the future. For cookies and marketing services, use the cookie settings (Section 5); for the newsletter and the shopping basket reminders, use the unsubscribe link (Sections 10 and 11). Processing carried out before the withdrawal remains lawful.

Right to object (Art. 21 GDPR)

Insofar as we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can object to the processing of your data for direct marketing at any time without giving reasons. We will then no longer use your data for this purpose.

We rely on a legitimate interest for the operation and protection of the website (Sections 3 and 4), for the disclosure to Shopify for its own purposes (Section 3), for necessary cookies (Section 5), for started orders and indications of attempted fraud (Section 6), for contact persons of companies and different delivery recipients (Sections 6, 8 and 9), for general enquiries (Section 9) and for proving your newsletter consent and keeping the note of your unsubscription (Section 10). An informal message to info@artgalerie-tc.com is sufficient for an objection.

Complaint to a supervisory authority (Art. 77 GDPR)

If you believe that we are not processing your data lawfully, you can lodge a complaint with a data protection supervisory authority, for example in the place of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Wilhelmstraße 7
65185 Wiesbaden
Postal address: Postfach 3163, 65021 Wiesbaden
Telephone: 0611 1408 0
Email: poststelle@datenschutz.hessen.de
Online complaint form

Do you have to provide us with data?

There is no legal obligation to provide us with data. However, for an order, a quotation for a commissioned work or a reply to your enquiry, we need the information specified in each case. Without it, we cannot conclude the contract or deal with your enquiry. All consents (cookies, marketing services, newsletter) are voluntary.

No automated decisions by us

We do not make any decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The proprietor decides on the acceptance of an order.

The payment service providers, in particular Klarna and PayPal, carry out credit, risk and fraud checks under their own responsibility, which may be automated (Section 7). Details and your rights in this regard can be found in the privacy notices of these providers.

15. Version of this policy

Last updated: October 2026.

We adapt this privacy policy when our shop, the services used or the legal situation change. The version that is published on this page at the time of your visit applies.