Skip to main content

Legal

Privacy Policy

Last updated: 22 August 2026

1. Introduction

Welcome to Gastro Gallery ("we", "us", "our"). We are committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Danish Data Protection Act (Databeskyttelsesloven), the California Consumer Privacy Act ("CCPA"), and other applicable data protection legislation.

This Privacy Policy explains how we collect, use, store, and share your personal data when you visit our website gastrogallery.com (the "Website"), place an order, subscribe to our newsletter, or otherwise interact with our services.

By using our Website, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

SimonHolst

CVR: DK35016074

Algade 61A, 2, 5500 Middelfart, Denmark

Email: info@gastrogallery.com

Contact person: Simon Holst

3. Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Data You Provide Directly

  • Name — to process and deliver your orders and personalise communications.
  • Email address — for order confirmations, customer service, and marketing communications (where consent is given).
  • Postal address — for shipping and delivery of orders.
  • Telephone number — for delivery-related communications and customer support.
  • Payment information — processed securely via our payment provider Stripe. We do not store your full card details on our servers.

3.2 Data Collected Automatically

  • IP address — for fraud prevention, security, analytics, and approximate geolocation.
  • Cookies and tracking data — including browsing behaviour, device information, referral source, and pages visited. See Section 8 for full cookie details.
  • Session recordings and heatmaps — anonymised interaction data collected via Microsoft Clarity to improve user experience.

4. Purposes and Legal Basis for Processing

We process your personal data for the following purposes, each with a corresponding legal basis under GDPR Article 6:

4.1 Order Fulfilment and Delivery

Purpose: Processing your order, arranging printing via our production partner Poster & Frame, and delivery by their carriers (GLS within Denmark, FedEx internationally).

Legal basis: Performance of a contract (Art. 6(1)(b)).

4.2 Order Records

Purpose: Keeping a record of your order so that we can answer queries, process returns and refunds, and honour warranty claims. We do not operate customer accounts — orders are placed as a guest and located using your order number and email address.

Legal basis: Performance of a contract (Art. 6(1)(b)) and compliance with a legal obligation (Art. 6(1)(c)).

4.3 Customer Service

Purpose: Responding to enquiries, handling complaints, and providing after-sales support.

Legal basis: Performance of a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)).

4.4 Marketing and Newsletters

Purpose: Sending promotional emails, product recommendations, and offers via Mailchimp.

Legal basis: Your consent (Art. 6(1)(a)). You may withdraw consent at any time by clicking the unsubscribe link in any email or by contacting us.

4.5 Analytics and Website Optimisation

Purpose: Understanding how visitors use our Website to improve performance, layout, and product offerings.

Legal basis: Legitimate interest (Art. 6(1)(f)) for anonymised/aggregated analytics; consent (Art. 6(1)(a)) for non-essential tracking cookies.

4.6 Advertising and Remarketing

Purpose: Displaying relevant advertisements on third-party platforms (Meta, Google, Pinterest, TikTok) to users who have visited our Website.

Legal basis: Your consent (Art. 6(1)(a)), obtained via our cookie consent banner.

4.7 Fraud Prevention and Security

Purpose: Detecting and preventing fraudulent transactions and protecting the security of our Website.

Legal basis: Legitimate interest (Art. 6(1)(f)).

5. Third-Party Recipients and Data Processors

We share your personal data with the following categories of recipients, each acting as a data processor or independent data controller as specified:

  • Stripe (payment processing) — processes payment data as a data controller in its own right. Stripe's privacy policy applies to payment transactions.
  • Posterandframe (print-on-demand production) — receives your name and shipping address as a data processor to fulfil and ship your order.
  • Poster & Frame (printing and fulfilment) and their carriers GLS and FedEx — receive your name, address, and contact details as data processors in order to produce and deliver your order.
  • Mailchimp / Intuit (email marketing) — processes your email address and name as a data processor when you subscribe to our newsletter.
  • Hostinger (website hosting) — hosts our Website and processes data as a data processor.
  • Google (Analytics, Tag Manager, Ads) — collects anonymised browsing data and advertising identifiers via cookies, acting as a data processor and/or joint controller depending on configuration.
  • Meta Platforms (Facebook/Instagram Pixel) — collects browsing and conversion data via cookies for advertising purposes.
  • Microsoft (Clarity) — collects anonymised session recordings and heatmap data as a data processor.
  • Pinterest (Pinterest Tag) — collects browsing and conversion data via cookies for advertising purposes.
  • TikTok (TikTok Pixel) — collects browsing and conversion data via cookies for advertising purposes.

We have entered into data processing agreements (DPAs) with our data processors in accordance with GDPR Article 28.

6. International Data Transfers

Some of our data processors are established outside the European Economic Area (EEA). Where personal data is transferred to countries outside the EEA, we ensure appropriate safeguards are in place, including:

  • The European Commission's adequacy decisions (e.g., the EU-US Data Privacy Framework for US-based providers who are certified).
  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Other appropriate safeguards as required under GDPR Chapter V.

In particular, data may be transferred to the United States (Stripe, Google, Meta, Mailchimp, Microsoft, Pinterest, TikTok). We rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses for these transfers.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law:

  • Order data — retained for 5 years after the date of purchase in accordance with the Danish Bookkeeping Act (Bogføringsloven).
  • Newsletter subscriber data — retained until you unsubscribe or withdraw consent.
  • Cookie and analytics data — retained in accordance with the specific retention periods of each tool (see Section 8).
  • Customer service records — retained for up to 3 years to handle potential claims.

8. Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies. A cookie is a small text file stored on your device when you visit our Website. We use the following categories of cookies:

8.1 Strictly Necessary Cookies

These cookies are essential for the Website to function properly (e.g., shopping basket, checkout process, security). They do not require your consent.

8.2 Functional Cookies

These cookies enable enhanced functionality and personalisation, such as remembering your preferences, language settings, and login status.

8.3 Analytics Cookies

These cookies help us understand how visitors interact with our Website by collecting anonymised data. Tools: Google Analytics, Microsoft Clarity.

8.4 Marketing and Advertising Cookies

These cookies are used to deliver relevant advertisements to you on third-party platforms and to measure the effectiveness of our advertising campaigns. Tools: Meta Pixel, Google Ads, Pinterest Tag, TikTok Pixel.

You can manage your cookie preferences at any time via our cookie consent banner. You may also configure your browser to refuse cookies, although this may affect the functionality of our Website.

9. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access (Art. 15) — You may request a copy of the personal data we hold about you.
  • Right to rectification (Art. 16) — You may request correction of inaccurate or incomplete data.
  • Right to erasure (Art. 17) — You may request deletion of your data where there is no compelling reason for its continued processing.
  • Right to restriction of processing (Art. 18) — You may request that we limit the processing of your data in certain circumstances.
  • Right to data portability (Art. 20) — You may request to receive your data in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21) — You may object to processing based on legitimate interests or direct marketing at any time.
  • Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@gastrogallery.com. We will respond within 30 days of receiving your request. We may ask you to verify your identity before processing your request.

10. Additional Rights for California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

  • Right to know — You may request details about the categories and specific pieces of personal information we have collected, the sources of collection, the purposes, and the third parties with whom we share it.
  • Right to delete — You may request deletion of personal information we have collected from you.
  • Right to opt-out of sale — We do not sell your personal information. However, certain uses of cookies for targeted advertising may constitute a "sale" or "sharing" under CCPA. You may opt out via our cookie consent banner.
  • Right to non-discrimination — We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, please contact us at info@gastrogallery.com.

11. Children's Privacy

Our Website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it promptly. If you believe we may have collected data from a minor, please contact us at info@gastrogallery.com.

12. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • SSL/TLS encryption for all data transmitted between your browser and our Website.
  • Secure payment processing via Stripe (PCI DSS compliant).
  • Access controls and authentication for internal systems.
  • Regular review of our data protection practices.

While we take reasonable precautions, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data.

13. Complaints

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

Datatilsynet

Carl Jacobsens Vej 35, 2500 Valby, Denmark

Email: dt@datatilsynet.dk

Website: www.datatilsynet.dk

You may also lodge a complaint with the supervisory authority in your country of residence, if different.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. The updated version will be published on our Website with a revised "Last updated" date. We encourage you to review this page periodically. Material changes will be communicated via email or a prominent notice on our Website.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:

SimonHolst

Algade 61A, 2, 5500 Middelfart, Denmark

Email: info@gastrogallery.com

Contact person: Simon Holst