Privacy Policy

01 · Who we are

Two partners, distinct responsibilities

AGOP MTÜ and Värvikaru OÜ are separate Estonian legal entities working together to present and sell original artworks through this website.

02 · Information we collect

Data connected with your visit or purchase

• Identity and contact data: name, billing and delivery address, country, email address and telephone number.
• Order data: artwork ordered, price, delivery method, order status, correspondence, return, refund or complaint information.
• Payment and accounting data: chosen payment method, payment status, transaction reference, invoice and information required for bookkeeping or tax compliance. We do not receive or store your complete payment-card number.
• Account data: login and account details if you choose to create a customer account.
• Subscription data: your email address, first name (optional), the date and time of subscription and the consent text you accepted, when you subscribe to AGOP exhibition previews.
• Enquiry and communication data: your full name, email address, country, the artwork you ask about and your message when you use the “Ask About an Artwork” form, and any other information you provide when contacting us about an artwork, order, delivery or another request.
• Technical and usage data: IP address, browser and device information, timestamps, requested pages, security logs, cookie identifiers and analytics data.
• Advertising measurement data: if you accept Marketing cookies, the Meta Pixel collects online identifiers, browser and device information, the pages you visit and actions such as viewing an exhibition page, clicking a “View on Artsy” link or successfully submitting a form.
• Cookie choices: the consent or preferences you provide through the Site’s cookie banner and consent settings.

Please do not send payment-card details or other unnecessary sensitive information by email or through the Site’s forms.

03 · Purposes and legal bases

Why we use personal data

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

04 · Sharing personal data

Who may receive your information

We do not sell personal data. We disclose it only where necessary for the purposes described above, including to:

• AGOP MTÜ and Värvikaru OÜ, within their respective roles described in this Policy;
• the relevant artist or fulfilment partner, where needed to confirm the work, prepare documents, pack the artwork or arrange dispatch;
• postal, courier, insurance and customs providers, using the delivery and contact details required to complete the shipment;
• payment providers and banks, including the card-payment or PayPal provider selected at checkout;
• website, hosting, ecommerce, form, security and email service providers, including services used to operate WordPress, WooCommerce and the Site’s forms, and Google (Gmail / Google Workspace) for sending email to enquirers and subscribers;
• Google (Google Analytics), when Analytics consent has been provided;
• Meta Platforms Ireland Limited (Meta Pixel), when Marketing consent has been provided;
• Artsy, when you choose to buy or make an offer on an artwork through Artsy;
• accountants, legal advisers, insurers, courts and public authorities, where reasonably necessary or legally required.

Artists and fulfilment partners receive only the information they need for the relevant order. They may not use buyer information for their own marketing without a separate lawful basis.

05 · Payments

Payment information

Card and PayPal payments are processed through the payment service selected at checkout. Payment providers process information under their own privacy terms and security requirements. Värvikaru OÜ receives the information needed to identify the payment and administer the order, but not your complete payment-card number or security code.

For bank transfers, the payer’s name, account details, payment reference and transaction information are processed by the relevant banks and appear in Värvikaru OÜ’s banking and accounting records.

Payments for artworks bought through Artsy are processed by Artsy and its payment providers.

06 · Cookies, analytics and advertising

How the Site uses cookies

When you first visit the Site, a cookie banner asks for your choice. You can accept all cookies, reject all non-essential cookies, or choose categories under “Manage Preferences”. You can change or withdraw your choice at any time through the “Manage consent” link on the Site.

• Necessary – always active. Used for the shopping cart, checkout, security, load balancing, spam protection of forms and saving your privacy preferences.
• Analytics – Google Analytics 4 (via Google Site Kit). Helps us understand, in aggregated form, how visitors use the Site: pages visited, clicks on “View on Artsy” links and successful form submissions. Loaded only after you accept Analytics cookies.
• Marketing – Meta Pixel. Helps us measure the results of our advertising on Facebook and Instagram and show our exhibitions to people who may be interested. Loaded only after you accept Marketing cookies.

The Site uses Google Consent Mode v2 to pass your choices (analytics_storage, ad_storage, ad_user_data, ad_personalization) to Google services. If you reject Analytics or Marketing cookies, the corresponding tags are not loaded.

You can also delete cookies through your browser settings. Blocking necessary cookies may prevent the cart, checkout or forms from working correctly.

07 · Exhibition previews

Our mailing list

If you subscribe through the “Stay Close to New Art” form, we use your email address and, if provided, your first name to send occasional previews of new exhibitions, available original artworks and stories about AGOP artists. Your subscription data is stored in the Site’s database (WordPress, SureForms) and in AGOP’s internal mailing list, and emails are sent through Google (Gmail / Google Workspace) using Gmail Mail Merge.

Every mailing includes an automatically added Unsubscribe link, which you can use at any time. You can also ask us to remove your address by writing to agop@globalpainters.net. We do not share the mailing list with artists or third parties for their own marketing.

08 · Forms

Form submissions

Submissions of the Site’s forms are stored as entries in the Site’s WordPress database (SureForms plugin) on our hosting provider’s servers and are also sent by email to agop@globalpainters.net. Access is limited to AGOP administrators. Forms are protected against spam by technical measures that do not require marketing cookies.

09 · Retention

How long we keep data

• Order, invoice, payment, refund and accounting records: seven years from the end of the financial year in which the transaction was recorded, or longer if required for an active dispute or another legal obligation.
• Customer account data: while the account remains active or until deletion is requested, except for information that must be retained with transaction records.
• Artwork and order enquiries (including “Ask About an Artwork” form entries): normally up to two years after the enquiry is resolved, unless the information becomes part of an order or is needed for a legal claim.
• Mailing-list data: until you unsubscribe; after that, we keep only a record of the unsubscription and of the consent previously given, for as long as needed to demonstrate compliance.
• Cookie choices: stored in a cookie in your browser for twelve months, after which you will be asked again.
• Security and technical logs: normally up to twelve months, unless a longer period is necessary to investigate an incident.
• Google Analytics data: for the retention period configured in the relevant Analytics property, normally no longer than fourteen months.
• Meta Pixel data: processed by Meta in accordance with Meta’s terms and privacy policy.

Data may be deleted or anonymised earlier where it is no longer needed. Back-up copies may remain for a limited period until they are securely overwritten.

10 · International transfers

Processing outside the EEA

Some technology, analytics, advertising, payment or delivery providers (including Google, Meta and Artsy) may process personal data outside the European Economic Area. Where this occurs, the responsible controller relies on a lawful transfer mechanism, such as an adequacy decision (including the EU–US Data Privacy Framework), the European Commission’s Standard Contractual Clauses, or another safeguard permitted by the GDPR.

11 · Your rights

Control over your personal data

Subject to the conditions and limits in applicable law, you may:

• request access to your personal data and a copy of it;
• ask us to correct inaccurate or incomplete information;
• request erasure or restriction of processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain data in a portable, machine-readable format;
• withdraw consent at any time where processing is based on consent (including by changing your cookie settings or using the Unsubscribe link in our emails);
• lodge a complaint with a data-protection supervisory authority.

To exercise a right, email agop@globalpainters.net. We may request reasonable information to verify your identity. We normally respond within one month, as required by the GDPR.

The Site does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

12 · Security

Protecting your information

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. No internet service is completely secure, but access to personal data is limited to those who need it for the purposes described in this Policy.

13 · Children

Age of visitors

The Site is intended for adults and is not directed at children. We do not knowingly collect personal data from children through the online shop. If you believe a child has provided personal data to us, please contact us so that we can review and delete it where appropriate.

14 · Contact and complaints

How to reach us

Questions and requests concerning this Policy or the use of personal data can be sent to agop@globalpainters.net.

You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, email info@aki.ee, website aki.ee, or to the competent supervisory authority in your country of residence.

15 · Changes

Updates to this Policy

We may update this Privacy Policy when the Site, our services, providers or legal requirements change. The current version will be published on this page with its revision date.