Galeria MonChic (“Galeria MonChic”, “we”, “us” or “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you visit our website, contact us, purchase from us, or otherwise interact with our gallery, and it sets out your rights in relation to that data.
We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable Portuguese data protection law. Please read this policy carefully to understand our practices regarding your personal data.
Note: This document is a general template intended to reflect common GDPR requirements. It is not legal advice. Before publishing, we recommend having it reviewed by a qualified data protection professional and completing the bracketed placeholders so that it accurately describes your specific tools, service providers, and practices.
1. Who We Are (Data Controller)
For the purposes of applicable data protection law, the data controller responsible for your personal data is:
Galeria MonChic 8550-233 Monchique, Algarve, Portugal Email: [email protected] Telephone: (+351) 967 392 946
If you have any questions about this Privacy Policy or about how we handle your personal data, you can contact us using the details above.
2. The Personal Data We Collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
Information you provide to us directly. This includes information you give us when you contact us by email, telephone or through a contact or enquiry form; when you request information about an artwork, a commission, framing, shipping or a gift; when you subscribe to our newsletter or updates; when you make a purchase; or when you correspond with us in any other way. This may include your name, email address, telephone number, postal or billing address, the content of your message or enquiry, and details of the works or services you are interested in.
Transaction and order information. If you buy from us, we (or our payment providers) collect information necessary to process your order and payment, such as your name, delivery and billing address, contact details, the items purchased, and order value. We do not store full payment card details on our own systems; card payments are handled by our payment service provider (see Section 6).
Information we collect automatically. When you visit our website, we may automatically collect certain technical information about your device and usage, such as your IP address, browser type and version, device type, operating system, the pages you visit, the time and duration of your visit, and the website you came from. This information is collected through cookies and similar technologies (see Section 7).
Information from third parties. We may occasionally receive information about you from third parties, such as social media platforms (if you interact with us there), or our service providers, in accordance with their own privacy policies and your settings.
We do not intentionally collect any special categories of personal data (such as data revealing health, religion, or political opinions) through our website, and we ask that you do not send us such information.
3. How and Why We Use Your Personal Data (Purposes and Legal Bases)
We only process your personal data where we have a lawful basis to do so under the GDPR. The purposes for which we use your data, and the corresponding legal bases, are as follows:
To respond to your enquiries and communicate with you. When you contact us with a question or request, we use your data to reply and to provide the information or assistance you have asked for. Legal basis: our legitimate interests in responding to and managing enquiries, and/or taking steps at your request prior to entering into a contract.
To process and fulfil your orders. We use your data to take payment, arrange delivery or collection, provide receipts and order confirmations, handle returns, and provide customer service. Legal basis: performance of a contract with you, and compliance with our legal obligations (for example, tax and accounting requirements).
To send you marketing communications, such as our newsletter, information about new works, exhibitions and events, where you have asked to receive them. Legal basis: your consent, which you may withdraw at any time.
To operate, maintain, secure and improve our website, including analysing how visitors use the site and ensuring its technical functioning and security. Legal basis: our legitimate interests in running and improving our business and website, and, where required, your consent for non-essential cookies.
To comply with legal and regulatory obligations, including accounting, tax, and record-keeping obligations, and to respond to lawful requests from public authorities. Legal basis: compliance with a legal obligation.
To establish, exercise or defend legal claims where necessary. Legal basis: our legitimate interests in protecting our rights.
Where we rely on legitimate interests, we have carefully considered these against your rights and freedoms and believe our processing is proportionate and does not unduly affect you. You have the right to object to this processing (see Section 9).
4. Marketing Communications
If you have consented to receive marketing from us, we may send you information about our gallery, new artworks, limited editions, exhibitions, events, and offers. You can opt out of marketing communications at any time, free of charge, by clicking the “unsubscribe” link in any marketing email, or by contacting us at [email protected]. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdrew it, and we may still send you non-marketing service messages relating to your orders or enquiries.
5. How We Share Your Personal Data
We do not sell your personal data. We may share your personal data with the following categories of recipients, only where necessary and with appropriate safeguards in place:
Service providers and processors who perform services on our behalf, such as website hosting, IT and technical support, email and newsletter platforms, payment processing, shipping and delivery, and analytics. These providers may only process your data on our instructions and are bound by confidentiality and data protection obligations.
Payment providers, who process card and other payments securely on our behalf.
Professional advisers, such as accountants, auditors and lawyers, where necessary for the running of our business.
Public authorities, courts or regulators, where we are required to disclose information by law or to protect our legal rights.
In connection with a business transaction, such as a sale, merger or reorganisation of our business, in which case personal data may be transferred to the relevant party subject to appropriate protections.
6. Payments
Payments made through or in connection with our website are processed by third-party payment service providers [insert provider name(s), e.g. Stripe, PayPal, or your bank’s payment gateway]. When you make a payment, your card details are provided directly to the payment provider and are processed under their security standards and privacy policy. We do not store your full card details on our own systems. We recommend you review the privacy policy of the relevant payment provider.
7. Cookies and Similar Technologies
Our website uses cookies and similar technologies to function properly, to remember your preferences, to understand how the site is used, and — where you consent — for analytics and marketing purposes.
Strictly necessary cookies are essential for the website to work and cannot be switched off in our systems. Functional, analytics and marketing cookies are used only where you have given your consent through our cookie banner or your browser settings.
You can manage or withdraw your cookie consent at any time through the cookie settings on our website, and you can control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the site. For full details of the specific cookies we use, their purposes, and their duration, please see our [Cookie Policy / cookie settings].
8. How Long We Keep Your Personal Data
We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, tax or reporting requirements, and to resolve disputes or enforce our agreements. For example, information relating to purchases and invoices is generally retained for the period required by applicable Portuguese tax and accounting law. Enquiry and marketing data is kept for as long as needed to manage our relationship with you or until you ask us to delete it or withdraw your consent. When your data is no longer required, we will securely delete or anonymise it.
9. Your Data Protection Rights
Under the GDPR, you have the following rights in relation to your personal data, which you can exercise free of charge:
- The right to be informed about how we use your personal data (which this policy provides).
- The right of access to the personal data we hold about you.
- The right to rectification of inaccurate or incomplete data.
- The right to erasure (“the right to be forgotten”) in certain circumstances.
- The right to restrict processing in certain circumstances.
- The right to data portability, allowing you to obtain and reuse your data in a structured, commonly used, machine-readable format.
- The right to object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.
- Rights in relation to automated decision-making and profiling — we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
- The right to withdraw consent at any time, where our processing is based on your consent.
To exercise any of these rights, please contact us at [email protected] or by telephone at (+351) 967 392 946. We may need to verify your identity before responding. We will respond to your request within the timeframes required by law (generally within one month).
10. Your Right to Complain
If you have concerns about how we handle your personal data, we would encourage you to contact us first so that we can try to resolve the matter. You also have the right to lodge a complaint with the supervisory authority for data protection in Portugal:
Comissão Nacional de Proteção de Dados (CNPD) Website: www.cnpd.pt
If you are based in another EU/EEA country, you may also contact your local data protection authority.
11. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised or unlawful access, loss, destruction, alteration or disclosure. These measures include, where appropriate, secure hosting, restricted access to personal data, and the use of reputable service providers. However, please be aware that no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.
12. International Transfers
We are based in Portugal and primarily process your personal data within the European Economic Area (EEA). Some of our service providers may process data outside the EEA. Where we transfer personal data outside the EEA, we ensure that appropriate safeguards are in place as required by the GDPR — such as an adequacy decision by the European Commission, or the use of Standard Contractual Clauses — so that your data continues to receive an adequate level of protection.
13. Links to Other Websites
Our website may contain links to third-party websites, plug-ins and applications (for example, social media platforms). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.
14. Children’s Privacy
Our website and services are not directed at children, and we do not knowingly collect personal data from children. If you believe that a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements or for other operational reasons. When we make changes, we will update the “Last updated” date at the top of this page, and, where the changes are significant, we will take reasonable steps to notify you. We encourage you to review this policy periodically.
16. Contact Us
If you have any questions, requests or concerns about this Privacy Policy or about how we handle your personal data, please contact us:
Galeria MonChic 8550-233 Monchique, Algarve, Portugal Email: [email protected] Telephone: (+351) 967 392 946