Privacy Policy
Last updated: January 5, 2025
1. Introduction
BCK Art Gallery ("we," "us," or "our") operates the website bckart.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website and make purchases from our online art gallery.
We are committed to protecting your privacy in compliance with the Swiss Federal Act on Data Protection (FADP) and the European Union's General Data Protection Regulation (GDPR).
Data Controller:
BCK Art Gallery
Email: arts@bckart.com
2. Information We Collect
2.1 Personal Information
When you make a purchase or register on our website, we may collect:
- Identity Data: First name, last name
- Contact Data: Email address, telephone number, billing address, shipping address
- Financial Data: Payment method information (processed securely through our payment processors)
- Transaction Data: Purchase history, order details, artwork preferences
- Account Data: Wishlist items, saved artworks, shopping cart contents
2.2 Automatically Collected Information
When you visit our website, we automatically collect:
- Technical Data: IP address, browser type and version, device type, operating system
- Usage Data: Pages visited, time spent on pages, artworks viewed, search queries, referral source, UTM campaign parameters
- Session Data: Session identifiers, user agent information, landing page, exit page
- Analytics Data: Page view duration, artwork view duration, interaction events (add to cart, add to wishlist)
2.3 Cookies and Tracking Technologies
We use cookies and similar tracking technologies to enhance your browsing experience. See Section 7 for more details.
3. How We Use Your Information
We process your personal data for the following purposes:
3.1 Order Processing and Fulfillment (Legal Basis: Contract Performance)
- Processing and completing your artwork purchases
- Arranging shipping and delivery of artworks
- Sending order confirmations and shipping updates
- Handling returns, refunds, and customer service inquiries
- Processing payments through our payment processors
3.2 Payment Processing (Legal Basis: Contract Performance & Legitimate Interest)
- Processing credit card, Apple Pay, Google Pay payments via Stripe
- Processing cryptocurrency payments (Bitcoin, Ethereum, USDT, USDC) via NOWPayments
- Fraud prevention and payment security
3.3 Communication (Legal Basis: Contract Performance & Consent)
- Responding to your inquiries via our contact form
- Sending transactional emails (order confirmations, shipping notifications)
- Sending marketing communications (with your consent - you can opt-out anytime)
3.4 Website Improvement (Legal Basis: Legitimate Interest)
- Analyzing website usage and user behavior to improve our Service
- Understanding which artworks and artists are most popular
- Optimizing website performance and user experience
- Conducting internal analytics and research
3.5 Legal Compliance (Legal Basis: Legal Obligation)
- Complying with Swiss tax and accounting requirements
- Maintaining transaction records as required by law
- Preventing fraud and illegal activities
4. Data Sharing and Third-Party Services
We share your personal data with the following third parties:
4.1 Payment Processors
4.2 Product Catalog Management
- WooCommerce: Our artwork catalog is managed through WooCommerce's API. Product and order data is synchronized with our WooCommerce store.
4.3 Email Services
- Gmail API: For sending transactional and customer service emails from arts@bckart.com. Google Privacy Policy
4.4 Shipping Carriers
- We share shipping addresses with carriers (Swiss Post, DHL, FedEx, etc.) to deliver your artworks.
4.5 Hosting and Infrastructure
- Replit: Our website is hosted on Replit's infrastructure. Replit Privacy Policy
- PostgreSQL Database: Customer and order data is stored in a secure PostgreSQL database.
- Cloudinary: Artwork images are hosted and delivered via Cloudinary CDN. Cloudinary Privacy Policy
International Data Transfers: Some of our service providers are located outside Switzerland and the European Economic Area (EEA). We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and adequacy decisions, to protect your data.
5. Data Security
We implement appropriate technical and organizational security measures to protect your personal data:
- Encryption: SSL/TLS encryption for all data transmission
- Secure Payment Processing: Payment data is processed through PCI DSS compliant processors (Stripe)
- Access Controls: Restricted access to personal data on a need-to-know basis
- Database Security: Secure PostgreSQL database with access controls and encryption
- Regular Updates: Security patches and updates applied regularly
While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure.
6. Data Retention
We retain your personal data for the following periods:
- Transaction Records: 10 years (Swiss tax and accounting requirements)
- Customer Account Data: Until you request account deletion
- Marketing Data: Until you withdraw consent or unsubscribe
- Analytics Data: Session and analytics data are retained for up to 2 years
- Payment Records: 10 years (compliance with financial regulations)
- Email Communications: Customer service emails retained for 3 years
7. Cookies and Tracking Technologies
Our website uses cookies to enhance your browsing experience and analyze website usage.
7.1 Types of Cookies We Use
- Essential Cookies: Required for website functionality (shopping cart, session management, authentication). These cookies are necessary for the Service to function.
- Analytics Cookies: We use our own analytics system to track page views, artwork views, and user interactions. This helps us understand how visitors use our website.
- Preference Cookies: Store your settings such as currency preference.
7.2 Cookie Management
Swiss Residents: Under Swiss law, you can manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing cookies. Please note that disabling essential cookies may affect website functionality.
EU Residents: We obtain your consent before placing non-essential cookies on your device.
Browser Settings:
- Chrome: Settings → Privacy and Security → Cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and Site Permissions
7.3 Session Storage and Local Storage
We use browser local storage to:
- Store session identifiers for tracking your browsing session
- Remember your shopping cart contents
- Store currency preferences
- Maintain wishlist items
8. Your Data Protection Rights
Under the Swiss FADP and EU GDPR, you have the following rights regarding your personal data:
8.1 Right of Access
You have the right to request copies of your personal data. We may charge a small fee for this service.
8.2 Right to Rectification
You have the right to request correction of inaccurate or incomplete personal data.
8.3 Right to Erasure ("Right to be Forgotten")
You have the right to request deletion of your personal data, subject to certain legal exceptions (e.g., tax records we are legally required to maintain).
8.4 Right to Restriction of Processing
You have the right to request that we limit the processing of your personal data in certain circumstances.
8.5 Right to Data Portability
You have the right to request that we transfer your data to another organization or directly to you in a structured, commonly used, machine-readable format.
8.6 Right to Object
You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.
8.7 Right to Withdraw Consent
Where we process your data based on consent (e.g., marketing emails), you have the right to withdraw consent at any time.
8.8 Exercising Your Rights
To exercise any of these rights, please contact us at: arts@bckart.com
We will respond to your request within 30 days. You will not have to pay a fee unless your request is clearly unfounded, repetitive, or excessive.
8.9 Right to Lodge a Complaint
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with:
- Swiss Residents: Federal Data Protection and Information Commissioner (FDPIC) - www.edoeb.admin.ch
- EU Residents: Your local data protection supervisory authority
9. Children's Privacy
Our Service is not directed to individuals under the age of 16 (GDPR) or 13 (Swiss law). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal information, please contact us immediately.
10. Marketing Communications
With your consent, we may send you marketing emails about new artworks, artists, exhibitions, and special offers.
Opt-Out: You can unsubscribe from marketing emails at any time by:
- Clicking the "unsubscribe" link in any marketing email
- Contacting us at arts@bckart.com
Please note: Unsubscribing from marketing emails will not affect transactional emails (order confirmations, shipping notifications).
11. Data Breach Notification
In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay in accordance with FADP and GDPR requirements.
12. Third-Party Links
Our website may contain links to third-party websites (e.g., artist portfolios, social media profiles, payment processors). We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:
- Posting the updated policy on this page with a revised "Last updated" date
- Sending you an email notification (for significant changes)
We encourage you to review this Privacy Policy periodically.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: arts@bckart.com
Contact Form: Contact Page
15. Specific Information for Swiss Residents
This Privacy Policy complies with the Swiss Federal Act on Data Protection (FADP), effective September 1, 2023. As a Swiss-based company, we are committed to protecting the privacy rights of Swiss residents.
16. Specific Information for EU Residents
This Privacy Policy complies with the EU General Data Protection Regulation (GDPR). If you are an EU resident, you benefit from all rights outlined in Section 8 above.