Privacy policy

Privacy Policy

Last updated: July 7th, 2026

At GALLERY WORLD (“Website”, “we”, “us” or “our”), we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and disclose personal information when you visit galleryworld.at, use our services, make a purchase, or otherwise interact with us in connection with the website (collectively, the “Services”).

1. Data Controller

The data controller responsible for processing your personal data on this website in accordance with the General Data Protection Regulation (GDPR) is:

GALLERY WORLD

Leonardo Juric
Schererstraße 27/1, 8052 Graz

Email: sales@galleryworld.at

2. Legal Basis for Data Processing

In accordance with the European General Data Protection Regulation (GDPR), we process your data based on the following legal grounds:

Consent (Art. 6 Abs. 1 lit. a GDPR): For specific processing operations (e.g., newsletter subscriptions or optional marketing cookies) that you have explicitly granted us.
Performance of a Contract (Art. 6 Abs. 1 lit. b GDPR): For the processing of data necessary to fulfill a contract with you (e.g., processing a poster order and shipping).
Legitimate Interests (Art. 6 Abs. 1 lit. f GDPR): For optimizing our website, fraud prevention, and ensuring IT security.

3. Types of Personal Information We Collect

Information You Provide Directly

Contact details: Name, postal address, phone number, and email address.
Order details: Billing and shipping address, payment confirmation, and contact information.
Account information: Username, password, and security-related details.
Purchase and usage data: Viewed products, cart contents, and completed purchases.
Customer support information: Content of messages, inquiries, or feedback sent to us.

Automatically Collected Information

When you use our Website, we automatically collect certain information through cookies and similar technologies, including:

Device and browser data, IP address, and information about how you navigate and interact with the Website.

4. Use of the E-Commerce System Shopify

Our website is hosted on the servers of Shopify International Limited (Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, Ireland). Shopify provides the e-commerce platform that allows us to sell our products to you.

Your data is processed and stored on Shopify’s servers. This may also involve transferring data to the parent company, Shopify Inc., in Canada or the United States. Data transfers are conducted on the basis of the European Commission's Standard Contractual Clauses (SCCs) to ensure a secure level of data protection.

5. Sharing with Payment and Shipping Providers

For the purpose of contract fulfillment (Art. 6 Abs. 1 lit. b GDPR), we transfer your data to transport companies (for shipping your prints) as well as to the payment service providers selected by you during the checkout process (e.g., Stripe, PayPal, Klarna), insofar as this is necessary for payment processing and delivery.

6. Cookies

Our Website uses cookies to ensure proper functionality and improve user experience. Detailed information about the cookies used by Shopify can be found directly in Shopify’s official cookie policy. You can activate or deactivate optional marketing cookies at any time via our cookie banner.

7. Your Rights Under the GDPR

As you are a resident within the EU, you are entitled to the following rights free of charge under the GDPR:

Right of Access (Art. 15 GDPR): You can request information about the personal data we hold about you.
Right to Rectification (Art. 16 GDPR): You can request the correction of inaccurate or incomplete data.
Right to Erasure (Art. 17 GDPR): You can request the deletion of your personal data.
Right to Restriction of Processing (Art. 18 GDPR) and the Right to Object (Art. 21 GDPR): You can object to or restrict certain processing activities.

To exercise these rights, you can contact us at any time at sales@galleryworld.at.

8. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Austria, this is the Österreichische Datenschutzbehörde (DSB) (Barichgasse 40-42, 1030 Vienna).