Privacy Policy
1. Controller
The controller responsible for data processing on this website is: AlteKunst Wien, Leon Wilnitsky – Art Dealer, Spiegelgasse 21, 1010 Vienna, Austria, email: leon.wilnitsky@aon.at, phone: +43 664 260 5164, VAT ID: ATU 443 896 02.
2. Data Collected and Purposes
We process personal data you provide via inquiries, the member area (login), orders and payments, or the contact form: name, email address, phone number, billing and shipping address, and details on requested or purchased artworks. Purposes: contract initiation and fulfilment (Art. 6(1)(b) GDPR), compliance with legal obligations such as tax and commercial retention duties (Art. 6(1)(c) GDPR), and legitimate interests in the security and improvement of our services (Art. 6(1)(f) GDPR).
3. Google Sign-In (OAuth)
When signing in via Google, profile data transmitted by Google (name, email address, avatar) is used solely for authentication and account management. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google’s privacy policy additionally applies.
4. Payment Providers
For payment processing we use Stripe (Stripe Payments Europe Ltd., Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). Data required for the payment is transmitted directly to the respective provider; we do not store full payment details. Legal basis: Art. 6(1)(b) GDPR.
5. Cookies
We use strictly necessary cookies (language preference, cart, session/login). Optional cookies are only set with your consent via the cookie banner (Sec. 165 Austrian TKG 2021, Art. 6(1)(a) GDPR). You can withdraw consent at any time via the “Cookie Settings” link in the footer.
6. Bot Protection with Google reCAPTCHA
To protect newsletter registration against abusive automated submissions, we use Google reCAPTCHA, a service provided by Google Ireland Limited, Gordon House, 4 Barrow Street, Dublin, D04 E5W5, Ireland. In particular, IP address, browser and device information, and interaction data may be transmitted to Google and processed to identify automated access. The legal basis is our legitimate interest in protecting our website and forms (Art. 6(1)(f) GDPR). According to Google, transfers to the United States rely on applicable safeguards under Chapter V GDPR.
7. Retention
We retain personal data only as long as necessary for the stated purposes or as required by statutory retention periods (e.g. 7 years under Sec. 132 Austrian Federal Fiscal Code).
8. Your Rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time. You may also lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).