Privacy Policy
Who is responsible for the processing of your data?
In accordance with Regulation (EU) 2016/679 (GDPR) and Organic Law 3/2018 (LOPDGDD), it is informed that the personal data provided through this website will be processed by:
Person in charge: LUMBRE Gallery / Marjorie Colas
Tax ID number: X9769160W
Address: 25 Infantas Street, 28004, Madrid.
Email: info@lumbregallery.com
Website: www.lumbregallery.com
From now on, THE GALLERY.
What personal data is processed through this website?
THE GALLERY may process the following categories of data:
a) Identifying information
first and last name
email address
phone number
company (for B2B)
b) Financial and transactional data
billing information
purchase history
payment-related information (without access to full card details)
LA GALERÍA does not store bank or credit card information.
Payments are handled entirely through Stripe as a certified third-party supplier.
c) Browsing data
IP address
browser type
device
browsing behavior (cookies, if accepted)
d) Communications
applications submitted via forms
email communications
History of Requested Quotes
For what purposes is personal data processed?
Personal data is processed for the following purposes:
Manage requests for information or contact
Manage purchase requests and customized quotes
Manage payments, billing, and contract compliance
Contact the user by email regarding their request
Comply with legal and tax obligations
Improve website performance (analytics, if consent is given)
Send informative or commercial communications, only if the user authorizes it
What is the legal basis for data processing?
Data processing is based on:
Performance of a Contract or Precontractual Measures
Express consent of the data subject
Compliance with Legal Obligations
Legitimate interest, in specific and limited cases (security, fraud prevention)
To whom can personal data be communicated?
Personal data may be disclosed only to:
a) Service providers
Hostinger web hosting
Stripe (online payments)
HubSpot (forms, CRM, or communications, if used)
Logistics providers (shipping data only)
All suppliers act as data processors, with contracts pursuant to Art. 28 GDPR.
b) Public administrations
When required by law (tax, accounting, or judicial).
Are international data transfers carried out?
Some providers (Stripe, Google, HubSpot) may transfer data internationally outside the European Economic Area.
These transfers are made with appropriate safeguards, such as:
Standard Contractual Clauses (SCCs)
Additional Technical Measures in Accordance with the GDPR
For how long is the data retained?
The data will be retained:
as long as a contractual relationship exists
for the required legal periods (tax, accounting)
until the user withdraws their consent
the strictly necessary time for the purpose for which they were collected
What rights can users exercise?
The user may exercise the following rights:
access
rectification
suppression
opposition
limitation of treatment
portability
withdrawal of consent at any time
You can exercise these rights by sending an email to: info@lumbregallery.com
You also have the right to file a complaint with the Spanish Data Protection Agency (AEPD).
What security measures are in place to protect data?
THE GALLERY applies appropriate technical and organizational measures to guarantee the security of personal data, including:
a) Technical measures
secure connection via SSL certificate
secure and up-to-date servers
data encryption in transit
access control systems
regular backups
protection against malware and automated attacks
b) Organizational measures
limited data access to authorized personnel only
basic data protection training
internal confidentiality policies
periodic supplier review
security breach protocols
c) Secure payments
Payments are made exclusively through Stripe, PCI-DSS certified provider
THE GALLERY does not access or store card data
Are commercial communications sent?
The user will only receive commercial communications if they have had a prior business relationship or given their express consent.
You may unsubscribe at any time via:
link included in the communications
direct email request
Informative communications and newsletter
The personal data provided through the subscription form will be processed by LUMBRE Gallery for the purpose of sending information about exhibitions, art fairs, events, artistic news, and activities related to the gallery.
The legal basis for the processing is the consent of the data subject (Article 6.1.a of the General Data Protection Regulation).
Consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Newsletter subscription is not a condition for making purchases or contracting services.
The data will be retained until the data subject revokes their consent.
To guarantee the validity of consent, a double opt-in system may be used, whereby the user must confirm their subscription via a link sent to their email.
No automated profiles with legal effects on the data subject will be created.
What happens if the user provides third-party data?
If the user provides third-party data (for example, for shipments or gifts), they declare that they have their consent and undertake to inform them of the content of this policy.
Are minors' data processed?
This website is not directed at children under 14 years of age.
If improper processing of minors' data is detected, it will be deleted immediately.
Can this Privacy Policy be modified?
THE GALLERY reserves the right to modify this Privacy Policy to adapt it to legal or technical changes.
The user is advised to check it periodically.
What legislation is applicable?
This policy is governed by Spanish and European data protection legislation.
