Privacy Policy

The joint controllers responsible for the processing of personal data on this website are:

Ivan Pogodin and Giulia Quaini

Roccia Art Gallery

Leebgasse 14/10

1100 Vienna

Austria

Email: [email protected]

Phone: +43 664 3485727

We take the protection of personal data seriously. This Privacy Policy explains which personal data may be processed when you visit this website, contact us, or voluntarily submit information or materials to Roccia Art Gallery.

Personal data means any information relating to an identified or identifiable natural person, for example name, email address, phone number, IP address, message content, artist biography, portrait image, or other information connected to an identifiable person.

When you visit this website, technical data may be processed automatically, in particular:

• IP address
• date and time of access
• page or file requested
• browser type and browser version
• operating system used
• referrer URL
• amount of data transferred
• access status message

These data are processed to provide the website, ensure technical stability and security, detect abuse, and analyse technical errors.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR.

This website is hosted using Cloudflare Pages, a service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Cloudflare may process technical access data and security-related data to deliver the website, improve loading speed, ensure technical security, prevent abuse, and analyse errors.

Where personal data are transferred to the United States or other third countries, this takes place on the basis of appropriate safeguards under the GDPR, such as Cloudflare's Data Processing Addendum, applicable standard contractual clauses, or other legally recognised transfer mechanisms.

Further information can be found in Cloudflare's privacy documentation and Cloudflare's data processing terms.

If you contact us by email, phone, or through a contact function on the website, we process the data you provide, such as your name, email address, phone number, message content, time of contact, and any voluntary information.

These data are used to answer your request and communicate with you.

At present, the contact form does not use a configured secure backend endpoint. Instead, it opens the visitor's email application with a prepared message. In this case, the message is sent through the visitor's own email provider and received through our email provider.

Our receiving address is a Gmail account. For accounts in the European Economic Area, Google identifies Google Ireland Limited as the provider of its consumer services. Gmail may process and store message content, sender and recipient addresses, timestamps, attachments, and technical or security data to transmit, store, and protect the communication.

Google operates servers worldwide. Google states that international transfers are based, where applicable, on adequacy decisions, the EU-U.S. Data Privacy Framework, standard contractual clauses, or other legally recognised safeguards.

Google Privacy Policy

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in responding to inquiries and maintaining communication. Where communication relates to a possible agreement or collaboration, the legal basis may also be Art. 6(1)(b) GDPR.

If a secure form endpoint, CRM system, newsletter tool, or other communication provider is added later, this Privacy Policy will be updated with the relevant provider and processing details.

If artists, photographers, authors, curators, or other persons voluntarily send us information, images, biographies, portfolios, statements, CVs, contact details, or other materials, we may process such data for review, communication, documentation, presentation, or possible collaboration within Roccia Art Gallery.

Publication of artist profiles, portraits, biographies, artworks, photographs, or other submitted materials takes place only where we have appropriate permission or another valid legal basis.

The legal basis may be consent under Art. 6(1)(a) GDPR, pre-contractual or contractual communication under Art. 6(1)(b) GDPR, or our legitimate interest under Art. 6(1)(f) GDPR in reviewing and documenting submitted materials.

Consent can be withdrawn with effect for the future.

This website uses Cloudflare Web Analytics to measure basic traffic and page-performance data. Cloudflare Web Analytics is provided by Cloudflare, Inc. and uses a lightweight analytics beacon.

Cloudflare states that Web Analytics collects a minimum amount of information for performance metrics and does not track individual end users across customers' internet properties. Cloudflare also states that Web Analytics does not use cookies or localStorage to collect usage metrics and does not fingerprint individuals for analytics purposes.

The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in understanding whether the website works reliably, loads correctly, and is useful to visitors, without using marketing tracking.

Apart from third-party content deliberately activated by the visitor as described below, this website does not use Google Analytics, Meta Pixel, advertising trackers, retargeting pixels, or marketing-tracking cookies.

Art Stories pages include YouTube videos in privacy-enhanced mode through youtube-nocookie.com. The player is loaded only after a visitor chooses to activate it. At that point, a connection to YouTube/Google may be established and technical data such as the IP address, browser information, referring page, and interaction data may be processed under their policies.

Activation of the YouTube player and any related access to or storage of information on the visitor's device are based on consent under Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. Consent can be withdrawn for the future by reloading the page without activating the player again.

Each article also provides a normal external link to the video. The external link does not connect to YouTube until the visitor chooses to follow it.

The About page offers an optional Ko-fi tip widget provided by Ko-fi Labs Limited, Suite 501, The Nexus Building, Broadway, Letchworth Garden City, Hertfordshire SG6 9BL, United Kingdom.

To protect your privacy, the widget is blocked by default. No connection initiated by the widget is made to Ko-fi until you select ‘Load Ko-fi widget’. Refusing activation has no disadvantage; the rest of the website remains available.

After activation, your browser establishes a direct connection to Ko-fi. Ko-fi may receive and process technical data such as your IP address, browser and device information, time of access, referrer or origin information, and interaction or usage data. Ko-fi states that it may use strictly necessary, performance and analytics, functionality, and advertising or targeting cookies or similar technologies.

The purpose is to display the support interface and enable an interaction requested by you. Activation and any related access to or storage of information on your device are based on your consent under Art. 6(1)(a) GDPR and Section 165(3) TKG 2021. You may withdraw consent at any time by selecting ‘Hide Ko-fi widget’ or reloading the page. Withdrawal does not affect processing already carried out before withdrawal.

Ko-fi Labs Limited acts as an independent controller for processing within Ko-fi. The United Kingdom is currently covered by an adequacy decision of the European Commission under Art. 45 GDPR. Ko-fi states that onward transfers outside the EEA and the United Kingdom are protected by appropriate safeguards, which may include standard contractual clauses.

If you make a tip or other support payment, Ko-fi and the selected payment provider, such as PayPal or Stripe, process the transaction under their own privacy terms. As the supported creator, we may receive your display name or username, email address, optional message, transaction information, and information made available by the payment provider.

We process supporter data only to administer the contribution, respond to related inquiries, prevent abuse, comply with applicable accounting and tax obligations, and establish, exercise, or defend legal claims. The legal bases are Art. 6(1)(b), (c), and (f) GDPR, as applicable.

Supporter and transaction data received by us are retained for the applicable statutory accounting and tax periods or, where no statutory duty applies, only until the support and any related inquiries or claims have been completed. Ko-fi and payment providers determine their own retention periods.

Ko-fi Privacy Policy and Cookie Policy

Personal data are not sold.

Personal data are not disclosed to third parties without a legal basis. Disclosure may occur where necessary for hosting, technical security, communication, legal obligations, rights protection, or legitimate interests.

Personal data are stored only for as long as necessary for the respective purposes.

Data from inquiries are generally deleted once communication has been completed, unless legal retention obligations, documentation needs, rights protection, or legitimate interests require longer storage.

Artist-related materials and permission records may be stored for as long as the relevant content is displayed on the website and, where necessary, for a reasonable period afterwards for documentation and rights-verification purposes.

Subject to the GDPR, you have in particular the following rights:

• right of access to your stored personal data
• right to rectification of inaccurate data
• right to erasure
• right to restriction of processing
• right to data portability
• right to object to processing based on legitimate interests
• right to withdraw consent with effect for the future

To exercise your rights, contact us at:

[email protected]

If you believe that the processing of your personal data violates data protection law, you may lodge a complaint with a data protection supervisory authority.

In Austria, the competent authority is:

Österreichische Datenschutzbehörde

Barichgasse 40-42

1030 Vienna

Austria

Email: [email protected]

No automated decision-making, including profiling, takes place on this website.

This Privacy Policy may be updated if the website, technical services, analytics setup, communication tools, project structure, or legal requirements change.