1. Who works with your data
The controller of personal data pursuant to Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: “GDPR”) is ORIGINAL GALLERY Kft., with its registered office at: 2900 Komárom, Kelemen László utca 1., Hungary, company registration number: 11-09-032049, VAT ID: HU33010362, registered in the relevant commercial register of Hungary (hereinafter: “Controller”), and as the controller we will process your personal data under the conditions set out below.
The Controller has not appointed a data protection officer.
2. Which personal data we process
We process only the personal data that you provide to us in connection with the use of our Original Gallery.shop services. This concerns the following data:
Artist (exhibitor, author, seller) and Visitor (buyer, collector)
• e-mail address and telephone number
• first name and surname
• street + house number
• city + postcode
• country
• password in encrypted form
3. Why we process personal data
The legal basis for the processing of personal data is, on the one hand, the performance of a contract between you and the controller pursuant to Article 6(1)(b) GDPR; and, on the other hand, the controller’s legitimate interest in carrying out direct marketing (in particular for sending commercial communications and newsletters) pursuant to Article 6(1)(f) GDPR. The purpose is the processing of your order.
4. Who has access to your data
The Controller declares that it has taken all appropriate technical and organisational measures to secure your personal data. Only authorised persons have access to the personal data.
Third parties that may have access to your personal data to the extent necessary are:
• persons who provide the technical operation and security of our services for us;
• persons to whom we provide data for the purpose of analysing the traffic of our website;
• payment gateways.
All data are stored within the territory of the Czech Republic.
The Controller retains personal data for the period necessary for the exercise of the rights and obligations arising from the contractual relationship between you and the controller and for the assertion of claims arising from these contractual relationships and (in the case of a paid subscription) subsequently for a period of 10 years from the termination of the contractual relationship. You may exercise any of your rights described below at any time. After the expiry of the retention period, the controller will erase the personal data.
5. What are your rights in connection with the protection of personal data
You provide us with your personal data voluntarily. However, without providing them we are unable to deliver our services to you.
Under the GDPR you have the right, with our company:
a) to request access to the personal data we process about you, and you have the right to obtain access to these personal data and to the further information referred to in Article 15 GDPR,
b) to request the rectification of the personal data we process about you if they are inaccurate,
c) to request the erasure of personal data (the right to be “forgotten”) in certain cases,
d) to request the restriction of data processing,
e) to receive the personal data concerning you in a structured, commonly used and machine-readable format, and you have the right to transmit those data to another controller,
f) you have the right to object to, or lodge a complaint against, the processing in certain cases,
g) the right to be informed of a personal data breach in certain cases,
h) other rights laid down in the Personal Data Protection Act and in General Regulation No 2016/679 on the protection of personal data after it takes effect.
You may exercise each of these rights using the contact details given below. If we receive your request, we will inform you of the measures taken without undue delay and in any event within one month of receipt of the request. Where necessary, and taking into account the complexity and number of requests, this period may be extended by a further two months.
If we do not grant your request, we are obliged to inform you without delay, and at the latest within one month of receipt, of the reasons for not taking measures. In certain cases where your request is excessive or unfounded (in particular where the request is unreasonably repetitive), we are not obliged under the GDPR to comply with your request in whole or in part. In such cases we may charge you a reasonable fee taking into account the administrative costs of providing the requested information or communications or of taking the requested actions. As a data subject, you always have the right to contact the supervisory authority directly, which is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů).
If we receive your request but have reasonable doubts about your identity, we may ask you to provide additional information necessary to confirm your identity.
If you believe that our company processes your personal data unlawfully or otherwise violates your rights, you have the right to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), or you have the right to seek judicial protection.
6. How can you contact us?
If you have any questions, or if you wish to exercise your statutory rights or object to the further sending of our commercial communications, you can contact us by e-mail: info@originalgallery.com. Your request can also be dealt with by post: ORIGINAL GALLERY Kft., registered office: 2900 Komárom, Kelemen László utca 1., Hungary
If you just want to unsubscribe from our newsletter, you can easily do so via the web link that you will always find at its end.
So that we can verify your identity, we may ask you to prove your identity in an appropriate manner. This is a preventive security measure to prevent unauthorised persons from gaining access to your personal data.