Data information

Privacy policy.

This English translation is provided for convenience. The Polish version of the privacy policy is binding.

The Gallery’s data controller is KERSTEN GALLERY sp. z o.o., ul. św. Jana 12, 31-018 Kraków, KRS 0000949237, NIP 6762610585. For data enquiries, please email kerstengallery@kerstengallery.com.pl.

Artwork enquiries and contact

The form collects your name, email address, optional phone number, message and the selected artwork if your enquiry concerns a specific work. The general contact form does not require you to select an artwork. You provide your data voluntarily so that the gallery can respond. Consent to contact relates only to your specific enquiry and does not subscribe you to the newsletter.

Buying online

If a work has a ‘Buy now’ button, we collect your full name, email address, phone number and delivery address when you order, along with billing details if you request an invoice. We process these data to enter into and fulfil the sales contract (Article 6(1)(b) GDPR). We retain sales documents for the period required by tax and accounting law (Article 6(1)(c) GDPR). Payments are handled by Stripe Payments Europe, Limited (Dublin, Ireland). We share the data needed for payment with them: your email address, the amount and the order description. The gallery does not receive your card or bank account details. Providing these data is voluntary, but we cannot process an order without them.

Subscription is voluntary and requires separate consent. A new address must be confirmed using the link in the confirmation email. Mailchimp (The Rocket Science Group LLC, USA) processes the email address and, when following an artist, the selected interests. We process these data on the basis of consent until it is withdrawn. You can unsubscribe using the link in a newsletter or by contacting the gallery. Subscription is not required to browse the collection or send an inquiry. The Mailchimp data processing agreement provides EU standard contractual clauses for transfers outside the EEA.

Working with us: designers, hotels, businesses and artists

The forms on the ‘Collaborate with us’ pages collect your full name, email address, optional phone number, company or venue name, city, website or portfolio link, answers about your project and message. We process this data to respond and discuss working together (Article 6(1)(b) of the GDPR, steps taken before entering into a contract, and Article 6(1)(f), the gallery’s legitimate interests). We delete enquiries that do not lead to collaboration no later than 12 months after the last contact. We retain partners’ data for the duration of the collaboration, while settling accounts and for the period required by tax law.

Links from gallery partners and QR code labels beside works displayed at partner venues lead to gallery pages with a partner code in the URL. We count only the number of code scans per day, without collecting IP addresses or device data, and store nothing in your browser. An enquiry sent from a page opened through such a link is attributed to the partner so that we can calculate their commission. We do not share enquiry details with the partner without your consent. Selections of works prepared for clients are available via a private link; we count only how many times a selection has been opened.

Following an artist

You can ask to be notified when new works by a chosen artist arrive. We then store your email address and your chosen artist under the same terms as a newsletter subscription.

AI assistant

Questions submitted to the AI assistant (the ‘Ask the gallery’ button in the website header) are sent, together with the address of the page you are viewing, to Anthropic PBC (USA). Anthropic prepares the response as a data processor under a data processing agreement incorporating EU Standard Contractual Clauses. Anthropic does not use this data to train models. The gallery does not save conversations: they are stored only in your browser until you close the tab, or for up to 24 hours without activity (sessionStorage). The server records only the number of questions and service usage. Your IP address is used briefly to limit the number of questions. The legal basis is the gallery’s legitimate interest in answering questions about the collection (Article 6(1)(f) GDPR). We automatically remove recognised email addresses, numbers and keys before sending messages to the AI. This does not detect every kind of personal data, so please do not share personal data in the conversation. For purchases or reservations, please use the enquiry form. Responses are generated by AI and may contain errors. The gallery confirms the price and availability of each work.

Favourites and browser storage

Your list of favourite works is stored only in your browser (localStorage) and is not sent to the gallery until you submit an enquiry. You can clear the list on the Favourites page.

Data subject rights

You have the right to access, rectify, erase, restrict processing and request portability of your data, withdraw consent and lodge a complaint with the Polish supervisory authority (President of UODO).

The website and its database run on a separate gallery server hosted by webh.pl in Poland. LH.pl provides the gallery email service. Infrastructure providers process data as necessary to operate the website and handle messages.