Privacy notice

Data controller

The data controller is the gallery named in the legal details line at the foot of every page of this website (company name, registered office and VAT number), reachable at the e-mail address shown in the same footer. This notice is provided under Article 13 of Regulation (EU) 2016/679 (GDPR) and concerns the website phoenixartgallery.art.

What data we process, and why

The website requires no registration and can be browsed without providing any data. The only processing of personal data happens when you send a request for information about a work through the "Request information" form. In that case we process:

• your name, your e-mail address and, if you give it, your telephone number;
• the message you write and the work it refers to;
• the language you filled the form in, and the date and time at which you gave your consent;
• a fingerprint (hash) of your IP address, computed with a secret value and not reversible, used solely to limit repeated submissions.

These data are used to read your request and reply to you about the work you are interested in. We do not use them to send you commercial communications, we do not pass them on to third parties and we do not use them to profile you.

Legal basis

The processing of the data you enter in the form rests on your consent, given by ticking the box before sending (Article 6(1)(a) GDPR). You may withdraw it at any time by writing to us; withdrawal does not affect the lawfulness of the processing carried out before it. The computation of the IP-address fingerprint rests on our legitimate interest in protecting the form from automated and abusive submissions (Article 6(1)(f) GDPR).

How long we keep the data

We keep your request for as long as needed to reply to you and handle any follow-up, and we delete it once the exchange is closed and in any case within twelve months of the last contact. Requests are not deleted automatically by the system: deletion is an action of the gallery, which you can ask for at any time.

Where the data are kept and who processes them on our behalf

The data are stored on servers located in the European Union (Stockholm, Sweden). To run the website we rely on providers that process data on our behalf, as processors:

• Vercel Inc., for hosting the website and running the form;
• Turso (ChiselStrike Inc.), for the database in which requests are stored;
• Vercel Blob, for storing the photographs of the works, which contain no personal data.

The providers are based in the United States and process the data on our behalf under data processing agreements and the standard contractual clauses approved by the European Commission; the data nevertheless remain stored on servers in the European Union.

The technical logs of the hosting service contain error codes and technical identifiers, never the content of requests. Within the gallery, requests are read only by the person who manages the catalogue, through a password-protected private area.

Cookies and tracking tools

The website uses no cookies and no other tracking tools for visitors: no technical cookies, no third-party cookies, no traffic analytics, no advertising. The only cookie that exists is the one that keeps the private area's session open, and it is set only on the device of the person who manages the website after signing in with their password.

Your rights

You may at any time ask us to access your data, to correct them, to erase them, to restrict their processing, to receive them in a machine-readable format and to object to the processing, as well as withdraw your consent. To exercise these rights write to the e-mail address shown at the foot of the page. If you believe the processing infringes the law, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Updates

This notice may be updated if the website or the processing change. The version published on this page is the one in force. Last updated: 2 October 2026.