Last updated: 21 August 2026
Artstac Gallery OÜ (“Artstac”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use and protect information when you visit our website, contact us, subscribe to our newsletter or purchase artworks through our online store.
1. Who We Are
The data controller responsible for your personal data is:
Artstac Gallery OÜ
Rotermanni 14
10111 Tallinn, Estonia
Email: art@artstac.com
2. Information We Collect
Depending on how you interact with Artstac, we may collect information including your name, email address, telephone number, billing and shipping address, order and transaction details, correspondence with us, newsletter preferences, and technical information relating to your use of our website.
Payment information may be processed directly by our payment service providers. We do not store complete payment card details.
3. How We Use Your Information
We may use your personal data to process and fulfil purchases, arrange delivery of artworks, communicate with you about orders or enquiries, provide art consultations and other requested services, manage newsletter subscriptions, improve our website and services, maintain security, comply with legal and accounting obligations, and establish or defend legal claims where necessary.
We process personal data only where we have an appropriate legal basis, including performance of a contract, compliance with a legal obligation, our legitimate interests, or your consent where required.
4. Newsletter and Marketing
If you subscribe to the Artstac newsletter, we use your email address to send you information about new artworks, artists, exhibitions, gallery events and other Artstac news.
Our newsletter service is provided through MailPoet.
Where marketing communications are based on consent, you may withdraw your consent at any time by using the unsubscribe link contained in our emails.
5. Online Store and Payments
Our online store uses WooCommerce to manage products and orders.
When you make a purchase, we process the information necessary to complete the transaction, provide customer service, arrange delivery and comply with our legal obligations.
Payment information may also be processed by third-party payment providers according to their own privacy policies.
6. Cookies and Website Analytics
Our website may use cookies and similar technologies necessary for the operation of the website and online store.
With your consent, where required, we may also use cookies or similar technologies to understand how visitors interact with our website and to improve its performance.
You can manage your cookie preferences through the cookie settings available on our website and through your browser settings.
7. Sharing Your Information
We may share personal data with trusted service providers where necessary to operate our business, including website and hosting providers, payment processors, delivery and logistics providers, email and newsletter providers, professional advisers and other service providers acting on our behalf.
We do not sell your personal data.
Where personal data is transferred outside the European Economic Area, we take appropriate measures required under applicable data protection law to protect that information.
8. How Long We Keep Your Information
We retain personal data only for as long as necessary for the purposes for which it was collected and to comply with applicable legal, tax, accounting and contractual obligations.
Newsletter information is generally retained until you unsubscribe or otherwise withdraw your consent.
9. Your Rights
Under applicable EU data protection law, including the General Data Protection Regulation (GDPR), you may have the right to request access to your personal data, request correction or deletion, request restriction of processing, object to certain processing, request data portability and withdraw consent where processing is based on consent.
To exercise these rights, contact us at art@artstac.com.
You also have the right to lodge a complaint with the competent data protection supervisory authority. In Estonia, this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
10. Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technologies or legal requirements. The latest version will always be published on this page.