Privacy
Last updated: 15 September 2026
Delft Gallery is a private platform. We handle your data with care, not because the GDPR requires it, but because trust is the product.
Data controller
Delft Gallery.
Contact: tim@delftgallery.com
Which data do we collect?
- Name and email address, when you fill in and send one of our forms yourself: interest in a work, contact, the newsletter, art advice, an access request, brokerage, or offering a work of your own.
- The work you expressed interest in, to put you and the artist in touch.
- Access code (session), stored in an HttpOnly cookie on your device so you can keep viewing the gallery.
- Visitor statistics, only if you consent. Google Analytics then places cookies that record which pages are viewed, for how long, and which country the visit comes from. If you decline, Google Analytics is not loaded and nothing is sent to Google.
- Preferences in your browser, such as how large you want the tiles and your choice about visitor statistics. These stay on your own device; we cannot see them.
On what basis?
For the newsletter and for visitor statistics we ask your consent, which you can withdraw at any time. If you fill in a form about a work or a service, we process your data in order to answer your question: in the case of a sale this is performance of the contract, and otherwise our legitimate interest as a gallery in staying in touch with you.
What do we not do?
- No advertising networks. Google signals and ads personalisation are switched off, so your visit does not feed advertising profiles.
- No sale or sharing of data with third parties.
- No profiling or automated decision-making based on your data.
How long do we keep data?
We keep interest requests in our mailbox for a maximum of 24 months for follow-up and administration. After that we delete them. The session cookie expires after 30 days. If you subscribe to the newsletter, we keep your email address in our sending list until you unsubscribe or ask us to remove you.
Processors
- Resend (sending email), based in the EU.
- Vercel (hosting), data is processed in the EU region.
- Vercel Web Analytics (privacy-friendly, cookieless visitor statistics; no personal data and no cross-site tracking).
- Google Ireland Limited (Google Analytics). Google Ireland is our processor, but your data may also be processed by Google LLC in the United States, under the EU-US Data Privacy Framework. We retain it for 14 months; IP addresses are processed in truncated form.
Withdrawing your choice
On your first visit we ask for consent for Google Analytics. To change that choice, clear the site data for delftgallery.com in your browser; you will be asked again on your next visit.
Your rights
You have the right to access, correct and delete your data. Send an email to the address above and we will arrange it within 14 days. You may also file a complaint with the Dutch Data Protection Authority.