Privacy Policy

This privacy policy ('Privacy Policy’ or ‘Policy’) describes the collection, use and storage of personal information by Art Galleria Limited (NZBN 9429050261260) and all Related Companies of Art Galleria Limited (‘Art Galleria’, ‘we’ ‘us’ or ‘our’), from and about visitors to, and users of our applications, websites, content, products and services (‘Services’), including the current version of the ‘Art Galleria’ website www.artgalleria.com (‘Website’), and other persons with whom we deal directly.

We comply with the New Zealand Privacy Act 2020 and the General Data Protection Regulation of the European Union (‘GDPR’) and the equivalent laws of the United Kingdom (‘UK GDPR’) when dealing with personal information.

By using the Services, you consent to Art Galleria collecting, using and storing personal information about you as set out in this Privacy Policy. If you do not agree to the terms in this Privacy Policy, you must immediately stop using our Services.

Personal information means information about an identifiable individual (a natural person), and includes personal data, personally identifiable information and equivalent information under applicable privacy and data protection laws.

Related Company has the meaning given in the New Zealand Companies Act 1993, adapted as required to apply to any company regardless of the jurisdiction of its incorporation.

This Policy does not limit or exclude any of your rights under the New Zealand Privacy Act 2020 or the GDPR or UK GDPR.

This Policy was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of our collection and use of personal information. We are happy to provide any additional information or explanation needed. Any request for further information should be sent to support@artgalleria.com.

1. Changes to Privacy Policy
   1. Please be aware we may modify this Policy at any time, in our sole discretion and all modifications will be effective immediately upon our posting of the modifications on our Services and/or the Website.
   2. If we make material changes to this Privacy Policy, we will provide notice through the Services, or by other means so that you may review the changes before you continue to use the Services.
   3. If you object to any changes, you must immediately stop using the Services. Continuing to use the Services after we publish or communicate a notice about any changes to this Privacy Policy means that you are consenting to the changes.
   4. This Policy was last updated on 11 March 2026.
2. When does this Privacy Policy apply
   1. We collect, hold and process two categories of personal information.
   2. ‘Account and Marketing Data’ is personal information that we collect about you:
      1. when you sign up to or access or use the Services
      2. in connection with the administration of a customer or user account
      3. if you ask to receive information about us or the Services or sign up to our newsletter
      4. when you contact us directly (e.g. telephone call, website enquiry form, email or through your user dashboard) or visit the Website
      5. if you participate in customer feedback surveys.
   3. We may also process personal information that forms part of the User Content (as defined in our Terms of Service, available on our website). For the purposes of this Privacy Policy, we refer to this personal information as ‘User Data’.
   4. Our customers determine what and how they collect, use, disclose and transfer User Data. This means that our customers’ collection and use of User Data is governed by their privacy policy and practices, not ours. For the purposes of the GDPR and the UK GDPR, our customers are the data controller when storing or otherwise processing User Data. For Account and Marketing Data, we are the data controller for the purposes of the GDPR and UK GDPR.
   5. We only process User Data as authorised by our customers in our Terms of Use (available on our website) and/or other agreements with our customers that govern the processing of User Data (as applicable). Unless required otherwise under applicable law, if we receive any request or enquiry relating to User Data, we will forward this request to our relevant customer.
   6. The remainder of this Privacy Policy applies to Account and Marketing Data only and does not apply to User Data.
3. Collection of personal information
   1. We do not intend to collect personal information from or about children aged under 16. If you have reason to believe that we have collected personal information from or about a child under the age of 16, please contact us at support@artgalleria.com.
   2. When you use the Services or interact with us, we may collect:
      1. personal information from and/or about you (including your name, phone number, address, email address, user name, password and any personal information comprised in any data) that you input into the Services; and
      2. any personal information that you provide when you interact with us, provide feedback, when you provide information about your personal or business affairs, change your content or email preference, respond to surveys and/or promotions, provide financial or credit card information, or communicate with our customer support; and
      3. information relating to your use of the Services, including (but not limited to) your internet service provider address, the times and dates on which you access and/or use the Services, the details of any referring URL, the Services pages accessed, details of any information downloaded from, and uploaded onto, the Services and information captured by cookies on your device in connection with the collection of the above information.
   3. Some provision of personal information is mandatory and some may be optional. However, where you choose not to provide the information requested, you may be unable to use the Services or enjoy its full functionality, or receive the benefit of using our services.
   4. We use third party service providers to process credit card transactions. We do not have access to your credit card information. The name of this third party provider will generally be displayed when you are requested to enter your credit card information. You can see further information about how they process your credit card information in their privacy policy.
   5. Where possible, we collect personal information from you directly. However, we may collect personal information from third parties. If we do, we will protect it as set out in this Privacy Policy. We may collect:
      1. personal information that is publicly available (e.g. through LinkedIn profiles or public directories)
      2. personal information from third parties where you have authorised this
      We may combine the personal information about you that we receive from third parties with the personal information we collect from you directly or with device and usage data we collect automatically when you visit our website.
4. Purpose of collection and use
   1. Personal information will primarily be collected and used by us so that you may access and use the Services, for example, to bill you and collect money that you owe us, including authorising and processing credit card transactions. Personal information may also be used to administer the Services and to improve the standard of the services offered through the Services and/or our Website.
   2. Art Galleria may also use your personal information to provide you with information and updates related to our Services. We may also make you aware of new and additional products, services and opportunities available to you. We may use your personal information to improve our products and services and better understand your needs.
   3. Art Galleria may contact you by a variety of measures including, but not limited to telephone, email, SMS or mail.
   4. In addition, we may collect information in an aggregated form concerning your usage of the Services for the purpose of general data analysis (for example, comparisons of the use or popularity of the Services amongst different users). You acknowledge that Art Galleria owns and may use and disclose this aggregated data in a de-identified form to our affiliates and to third parties.
   5. We may use personal information to:
      1. protect and/or enforce our legal rights and interests, including defending any claim;
      2. respond to lawful requests by public authorities, including to comply with law enforcement requirements; or
      3. for any other purpose authorised by you or applicable law.
5. Website
   1. When you come to our Website we may collect certain information such as browser type, operating system, your physical location, website visited immediately before coming to our site where a link was followed, etc. This information is used for customer support, platform security, or in an aggregated manner to analyse how people use our site, such that we can improve our service.
   2. We use cookies on our Website. Cookies are very small files which a website uses to identify you when you come back to the site and to store details about your use of the site. Cookies are not malicious programs that access or damage your computer. Most web browsers automatically accept cookies but you can choose to reject cookies by changing your browser settings. However, this may prevent you from taking full advantage of our Website.
   3. Our Website may from time to time use cookies to analyse website traffic and help us provide a better Website visitor experience.
6. Advertising, remarketing and opting out
   1. Art Galleria may use third party advertising tools (including Google marketing and similar advertising). This means that information related to your web browsing behaviour may be collected while visiting our Website, which later can be used by third-party vendors, including Google, for the purpose of showing Art Galleria advertising on sites across the Internet which have been approved in the display network. You have the option to opt out of Google's use of cookies by visiting the Google advertising opt-out page. Alternatively you can opt out of cookies by visiting the Network Advertising Initiative opt out page..
   2. If you no longer wish to receive any communication from us or from our members via the Services, you may unsubscribe at any time using the link provided in the email communication. This can apply to all communication from Art Galleria, or be specific to communications from a particular member.
7. Disclosure of your personal information
   1. Art Galleria is committed to protecting your personal information. We will not disclose personal information about you to third parties without your consent except:
      1. to any of our Related Companies;
      2. to third parties that make a legally-compliant request for the disclosure of personal information (e.g. a law enforcement agency or regulatory authority), or when we, in our reasonable opinion, believe in good faith that such action is necessary to comply with New Zealand law and any other applicable law;
      3. to third parties (for aggregated data analysis in a de-identified form);
      4. where we reasonably believe disclosure is necessary to protect rights, including copyright, trademarks, legal rights, property or safety, of Art Galleria, its customers or third parties;
      5. to our insurers, professional advisers, agents, suppliers, subcontractors, or service providers who assist with managing or supporting the Services, our Website or our business operations;
      6. if the assets that we use to operate our business are acquired by a third party, to that party; or
      7. to any other person authorised by applicable law.
   2. Other than this, we will only disclose your personal information to an unrelated third party after receiving your consent to such disclosure. We do not sell any of your personal information to third parties for direct marketing purposes.
   3. Information that we collect may from time to time be stored, processed in or transferred between parties located in countries outside of New Zealand, Australia and the United States. These may include, but are not limited to the following 3rd parties:
      1. AWS, Inc. (https://aws.amazon.com/)
      2. Intercom (https://intercom.com/)
      3. Stripe, Inc. (https://stripe.com/)
      4. PayPal, Inc. (https://paypal.com)
      5. Xero Ltd (https://xero.com/)
      6. QuickBooks (https://quickbooks.intuit.com/)
      7. Sentry, Inc. (https://sentry.io)
      8. Google, Inc. (https://google.com/)
      9. New Relic, Inc. (https://newrelic.com/)
      10. Zendesk, Inc. (https://zendesk.com/)
   4. If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non-personal information contained in those databases. This information may be disclosed to a potential purchaser under an agreement to maintain confidentiality, which will include privacy clauses, and we will take all reasonable steps to protect personal information.
   5. By providing us with personal information, you consent to the terms of this Privacy Policy and the types of disclosure covered by this Policy. Where we disclose your personal information to third parties, we will request that the third party follow this Privacy Policy regarding handling your information.
8. International storage and transfer of data
   1. Art Galleria and its service providers may, from time to time, locate certain computer databases, which store personal information relating to Art Galleria’s products and services, in countries outside of New Zealand (the country where we are incorporated) and also outside of the country where you are located. This means that the personal information we collect may be transferred to, and stored in, a country outside of New Zealand and the country where you are located.
   2. If you are located in the European Union (‘EU’), your personal information may be transferred outside of the European Economic Area (‘EEA’). Under the GDPR, the transfer of personal information to a country outside the EEA may take place where the European Commission has decided that the country ensures an adequate level of protection. In the absence of an adequacy decision, we may transfer personal information if other appropriate safeguards are in place.
   3. If you are located in the United Kingdom (‘UK’) your personal information may be transferred outside of the UK. Under the UK GDPR, the transfer of personal information to a country outside the UK may take place where that country has been granted adequacy status for the purposes of the UK GDPR. In the absence of an adequacy decision, we may transfer personal information if other appropriate safeguards are in place.
   4. Where we transfer personal information outside the EEA or UK, it will only be transferred to countries that have been identified as providing adequate protection for EU/UK data, or to a third party where approved transfer mechanisms are in place to protect your personal information (e.g. by entering into the European Commission’s Standard Contractual Clauses and/or the UK’s International Data Transfer Agreement or International Data Transfer Addendum to the Standard Contractual Clauses). For further information, please contact us at support@artgalleria.com.
   5. Some of the personal information we collect is processed in New Zealand. New Zealand is recognised by the European Commission and the UK government as a country that has an adequate level of data protection and we rely on this decision in transferring personal information to New Zealand.
9. Security of your personal information
   1. Art Galleria is committed to ensuring that your personal information is secure. As required by applicable law, in order to prevent unauthorised access or disclosure, we have put in place physical, electronic and managerial procedures in accordance with industry standards to safeguard and secure personal information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure. Personal information is stored on a number of secure electronic and hard copy storage systems. Technical and operational measures are used by us to protect the personal information against modification, disclosure, access and misuse by unauthorised third parties, (including encryption of all data when it is transferred to our service providers and limitations on access to personal information within our business).
   2. We regularly monitor our system for possible vulnerabilities and attacks to protect personal information. However, since the Internet is not a secure environment, we cannot ensure or warrant the security of any information that you transmit to us. The transmission and exchange of information is carried out at your own risk. We cannot guarantee the security of any information that you transmit to us, or receive from us. Although we take measures to safeguard against unauthorised disclosures of information, we cannot assure you that personal information that we collect will not be disclosed in a manner that is inconsistent with this Privacy Policy.
   3. You play an important role in keeping your personal information secure. It is your responsibility to protect the security of your login information. Please help keep your account safe by using a strong password and not disclosing your password to third parties. Please notify us immediately if there is any unauthorised use of your account or any other breach of security.
10. Accessing and correcting your personal information
    1. Subject to certain grounds of refusal under applicable law, you can request that personal information we hold about you be provided to you for your review or be corrected. Before you exercise this right, we will need evidence to confirm that you are the individual to whom the personal information relates.
    2. Where you request a correction, if we think the correction is reasonable and we are reasonably able to change your personal information, we will make the correction. In all other cases, we will take reasonable steps to make a note of the personal information that was the subject of your correction request.
    3. If you want to exercise either of the above rights, email our Privacy Officer at support@artgalleria.com. Your email should provide evidence of who you are and set out the details of your request (e.g. the personal information to be corrected and the correction that you are requesting).
    4. Subject to applicable law, a small administrative fee may be payable for the provision of your personal information or correcting that information.
11. Other rights
    1. In addition to the rights to access and correct your personal information, if you are based in the EU or UK, you have the additional rights set out in the GDPR Additional Terms section of this privacy policy below.
12. Data retention policy
    1. The personal information that we collect and use will not be kept longer than necessary for the purposes for which it is collected, or for the duration required for compliance with applicable law, whichever is longer.
13. Complaints about privacy
    1. If you have any questions about this Privacy Policy, or if you wish to make any complaints about our privacy practices, or if you would like to request access to, or correction of, your personal information, please feel free to email us at support@artgalleria.com or by mail to Level 3 Candida Office Complex, 61 Constellation Drive, Rosedale, Auckland, New Zealand 0632. We take complaints very seriously and will respond shortly after receiving written notice of your complaint.

GDPR/UK GDPR Additional Terms

1. Lawful basis for processing personal information
   1. Our lawful basis for processing (as that term is defined in the GDPR and UK GDPR) personal information that we collect, use and disclose depends on the personal information collected and the context in which we collect it. 
   2. Generally, we collect personal information from you where we have your consent, where processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract, or where processing is necessary for the purposes of our legitimate interests (except where such interests are overridden by your interests or fundamental rights and freedoms).
   3. Where we process personal information based on your consent, you may withdraw your consent at any time.
   4. Despite the above, we may process your personal information where such processing is necessary for compliance with applicable laws.
   5. If you have any question about the legal basis on which we process personal information or need further information, please contact us at support@artgalleria.com.
2. Your rights under the GDPR and UK GDPR
   1. If you are located in the European Union or the United Kingdom, your rights in relation to your personal information include:
      1. right of access - if you ask us, we will confirm whether we are processing your personal information and provide you with a copy of that personal information
      2. right to rectification - if the personal information we hold about you is inaccurate or incomplete, you have the right to have it rectified or completed. We will take reasonable steps to ensure inaccurate personal information is rectified. If we have shared your personal information with any third party, we will tell them about the rectification where possible
      3. right to erasure – when your personal information is no longer needed for the purposes for which you provided it, we will delete it. You may request that we delete your personal information and we will do so if deletion does not contravene any applicable law. If we have shared your personal data with any third party, we will take reasonable steps to inform those third parties that they must delete your personal information
      4. right to withdraw consent - if the basis of our processing of your personal information is consent, you can withdraw that consent at any time
      5. right to restrict processing - you may request that we restrict or block the processing of your personal information in certain circumstances. If we have shared your personal information with any third party, we will tell them about this request where possible
      6. right to object to processing - you may request that we stop processing your personal information at any time and we will do so to the extent required by the GDPR and/or UK GDPR (as applicable)
      7. rights related to automated decision-making, including profiling - you have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where such automated decision-making is necessary for entering into, or the performance of, a contract with you, is authorised by applicable laws or is based on your explicit consent. We do not undertake automated individual decision-making
      8. right to data portability - you may obtain your personal information from us that you have consented to give us or that is necessary to perform a contract with you. We will provide this personal information in a commonly used, machine-readable and interoperable format to enable data portability to another data controller. Where technically feasible, and at your request, we will transmit your personal information directly to another data controller
      9. the right to complain to a supervisory authority - you can report any concern you have about our privacy practices to your local data protection authority.
   2. Where personal information is processed for the purposes of direct marketing, you have the right to object to such processing, including profiling related to direct marketing.
   3. If you would like to exercise any of your above rights, please contact us at support@artgalleria.com. If you are not satisfied by the way we deal with your query, you may refer your query to your local data protection authority.