1. Purpose and definitions
Shift Gallery is committed to protecting your Personal Data and ensuring your privacy when you visit our Website or use our Services. This Privacy Policy informs you on how we process your Personal Data, either when provided directly by you, by third parties and the ones generated or based on your activity on our Website and using our Services, as well as on your legal rights.
Your Personal Data will be processed according to the standards of the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”) on the protection of natural persons and any applicable local law.
In this Policy, aligned with the Purchase Terms and Conditions, and unless the context clearly indicates otherwise, the terms indicated below shall have the meanings that are attributed to them hereunder. Expressions used in the singular include the plural, and vice-versa.
“Personal Data”: any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier, such as a name, electronic identifiers or email of that natural person;
“Processing”: the operation or set of operations carried out on Personal Data, whether by automated or non-automated procedures, such as the collection, registration, organization, structuring, conservation, adaptation or modification, recovery, consultation, use, dissemination by transmission, diffusion or any other form of availability, comparison or interconnection, limitation, erasure or destruction;
“User” or “Data Subject”: the natural person who visits our Website or uses our Services and whose Personal Data, for some reason, we process;
“(Personal) Data Controller”: natural or legal person who, individually or in conjunction with others, determine the purposes and means of processing Personal Data.
“(Personal) Data Processor”: natural or legal person, who processes Personal Data on behalf and in accordance with the instructions of Shift Gallery (e.g. our service providers);
“Personal Data Recipient”: natural or legal person, that may receive Personal Data provided by Shift Gallery;
“Supervisory Authority”: means an independent public authority that is established by a European Union Member State in charge of supervising Personal Data protection compliance, which, in Portugal, shall be the National Commission for Data Protection – CNPD.
“Website”: the website located at www.shiftgallery.online domain and subdomains, managed by Shift Gallery, through GOLAN & CARPINELLI, Lda., a company incorporated and operating in accordance with the laws of Portugal, registered under the corporate registration and taxpayer nr / NIPC: 516746863, with head office at Av. da República, 50, 2 floor 1050-196 Lisbon, Portugal.
“Services”: the services provided by Shift Gallery, namely through the Website, regarding the exhibit of the artworks for sale, including the display, advertisement and promotion of such Works, in accordance with the relevant contracts made in place.
For further information regarding the Services, please consult our Purchase Terms and Conditions available here www.shiftgallery.online/purchase-terms-conditions.
2. Personal Data Controller and contact details
Shift Gallery – managed by Golan & Carpinelli, Lda., a company incorporated and operating in accordance with the laws of Portugal, registered under the corporate registration and taxpayer nr / NIPC: 516746863, with head office at Av. da República, 50, 2 floor 1050-196 Lisbon, Portugal.
E-mail:[email protected]
3. General Principles applicable
Regarding general principles applicable to the processing of Personal Data, Shift Gallery ensures that this Personal Data is:
- Subject to lawful, fair and transparent processing;
- Collected for specific, explicit and legitimate purposes, not being later processed in an incompatible manner with those purposes;
- Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- Accurate and updated whenever necessary, taking all appropriate measures so that the inaccurate Personal Data, taking into account the purposes for which it is processed, is erased or rectified;
- Kept in a way that allows the identification of the User only for the period necessary for the purposes for which the Personal Data is processed; and
- Processed in a way that guarantees Personal Data’s safety, including protection against its unauthorized or unlawful processing and against its accidental loss, destruction or damage, implementing appropriate technical and organizational measures.
4. Data processing activities
a. For the purpose of completing purchases at our Website, Shift Gallery will request you and/or process the following Personal Data:
- Client information, such as the name, email address, country of residence, zip/postal code, location.
- Financial information such as, credit or debit card number, bank account number, and billing address.
- Emails and messages, including receipts and support contact.
This information is processed based on necessity for the performance of a contract with you or as prior steps to entering into such contract.
Please note that financial information may be collected and processed by third party payment processor(s), as necessary to complete your purchase. We do not receive your credit card information directly, but we may receive information about the transaction, such as the date and time it occurred.
b. For the purpose of marketing communications (if applicable):
- With your permission, we may send you emails about our store, Website, Services, features, news, products and other updates. If we ask for your personal information for a secondary reason, we will either ask directly for your expressed consent and provide that this consent is as easy to give as to withdraw.
- We may also send you marketing communications promoting our products or Services, similar to those you purchased or accessed in the past.
c. Cookies
- With your consent, when browsing our Website, we (or third parties) may install Cookies on the device you are using which may entail processing of your Personal Data. For more information on our use of Cookies, please check our Cookies Policy at [online/cookies-policy].
5. How will we use User’s Personal Data
Shift Gallery collects Personal Data for the following purposes:
- To provide, administer, and communicate with you about products, Services, offers, programs, and news of Shift Gallery;
- To process sales and purchases, to transfer money, and to provide expected receipts to Artists and Buyers;
- To perform accounting;
- To respond to your inquiries;
- To comply with law enforcement requests and other legal obligations;
- To apply and enforce our Purchase Terms and Conditions and other agreements;
- To protect the rights or safety of Shift Gallery, our employees, our Users, or others, including by taking measures to prevent fraud and reduce credit risk;
- To comply with industry standards and our policies.
Shift gallery does not collect, process, or disclose your Personal Data or information in connection with the Website outside of the terms of this Privacy Policy.
6. Retention Periods
Users’ Personal Data are processed by Shift Gallery in strict compliance with the applicable legislation and stored in specific information systems. Such Personal Data is kept only as long as necessary for the purposes for which they are processed or, where legal obligations apply, for how long as determined by law.
Personal Data storage periods may vary according to the purpose for which such Personal Data was collected.
7. Use of Cookies
In order to understand how Users interact with our Website, Shift Gallery processes browsing information resulting from Cookies. In this respect, the legal basis of this processing is Shift Gallery’s legitimate interest when using essential Cookies. You can find more about our use of cookies in our Cookies Policy www.shiftgallery.online/cookies-policy.
8. Users’ rights regarding Personal Data
Users are informed that, as data subjects, they are entitled to exercise specific rights regarding their Personal Data processed by Shift Gallery as Personal Data Controller.
With regard to their Personal Data, Users have the following rights:
- Right of Access: right to obtain confirmation that Personal Data concerning the User is or is not subject to processing and, if so, the right to access such Personal Data and certain information.
- Right of Rectification: right to rectify inaccurate Personal Data concerning the User or to request incomplete Personal Data to be completed.
- Right to Erasure: right to obtain the erasure of Personal Data, without undue delay as long as there are no valid grounds for its conservation, such as cases in which Personal Data has to be kept in order to comply with a legal obligation or because legal proceedings are underway.
- Right to Restriction of Processing: right to request a limitation on the processing of Personal Data, in the form of suspension of processing or limitation of the scope of processing to certain categories of Personal Data or processing purposes, in accordance with article 18 of the GDPR.
- Right of Portability: right to receive Personal Data that concerns the User in a structured, of common use and automatic reading format and / or the right to transmit this data to another controller.
- Right of Objection: right of the Users to object to the processing of Personal Data at any time, as long as there are no legitimate reasons for such processing that prevail over the interests, rights and freedoms of the Users, or for the purposes of declaration, exercise or defense of a right in a judicial proceeding.
As per processing activities executed by Shift Gallery based on your consent, you are entitled to revoke your consent, but please note that will not invalidate the processing of the Personal Data carried out while the consent was in force.
Finally, please be informed that, if you believe Shift Gallery did not comply with the applicable privacy legislation, you have an additional right to lodge a complaint to the national Supervisory Authority, which in Portugal can be reached at: [email protected].
Please note that, in some cases, the entity defining the means and purposes of the processing activities on your Personal Data, may not be Shift Gallery (e.g advertising partner or a payment processor). In such cases, those entities are the Personal Data Controllers and therefore are the ones responsible to enforce your rights. In case the request is directed to us, Shift Gallery can only take reasonable steps to inform them of your request. For this reason, we recommend you contact these entities directly in accordance with their own privacy policies to ensure your rights lawfully enforced.
Shift Gallery will reply through the same channel by which the User has exercised the right within a maximum period of one month from receipt of the request, except in cases of special complexity, in which this period may be extended up to two months by justification duly substantiated by Shift Gallery.
These rights can be exercised by contacting the Shift Gallery preferably by e-mail to [email protected], or by post to Av. da República, 50, 2 floor 1050-196 Lisbon, Portugal.
9. Data breaches
In case the Shift Gallery suffers a data breach that may result in risks to our Users’ rights and freedoms, we will report these breaches to the relevant Supervisory Authority within 72 hours from the moment we are aware of the occurrence. If the risk is considered high, we will also inform our Users of the data breach and what Shift Gallery has done to mitigate the risks and future similar breaches.
10. Data Disclosure
We may disclose your Personal Data and information if we are required by law or due to violations of our contractual terms. We reserve the right to disclose any information about you to government or law enforcement officials or private parties in order to: (a) to satisfy or comply with any applicable law, regulation or legal process or to respond to lawful requests, including subpoenas, warrants or court orders; (b) to enforce our agreements with you or third parties, to protect our property, rights and safety and the rights, property and safety of third parties or the public in general; and (c) to prevent or stop activity we consider to be illegal or unethical.
11. Third party services
In general, the third-party providers to whom the Shift Gallery resorts to will processes your Personal Data and information to the extent necessary to allow them to perform the services they provide to us. In case they process your Personal Data in our behalf (Personal Data Processors), they’re bound to a series of contractual and legal commitments towards Shift Gallery regarding security and lawfulness of those processing activities.
In case such providers, under the appropriate legal grounds, also process your Personal Data for their own purposes, such processing activities are subject to their own privacy policies. In this case, we recommend that you read the privacy policies of all third-party service providers so you can understand the manner in which your personal information will be handled by them.
- Personal Data processors and data transfers: Our Personal Data Processors may only use other processors upon prior authorization of Shift Gallery, and if providing sufficient guarantees of implementing appropriate technical and organizational measures to ensure the security of Personal Data.To carry out the duties assigned by Shift Gallery, the Personal Data Processor will only be allowed to process Personal Data as needed for the specific purpose of rendering its services to Shift Gallery.Personal Data processed through the Website will only processed within the European Union territory.
- Regarding the supply of NFTs: Shift Gallery provides Users with access to the Versum Marketplace (at https://versum.xyz/), a NFT platform and metaverse on the Tezos blockchain. Versum’s activities are independent from ours and, in case you provide them with your Personal Data, Versum will process them for their own purposes and according to their own means.
12. Security
We take reasonable measures to protect from unauthorized access, use or disclosure the information and Personal Data that we collect.
Shift Gallery endeavors to protect User information to ensure that your Personal Data is kept private. We ensure that our employees and service providers who have access to your Personal Data only process it upon our instructions, unless otherwise required by law and are bound by confidentiality obligations.
13. Links
When you click on links on our Website, they may direct you away from our Website. Shift Gallery is not responsible for the privacy policies and/or practices on other websites. This Privacy Policy only governs information collected by Shift Gallery. The Website may contain links to other websites (“Linked Websites”) operated by Shift Gallery or third parties. Linked Sites may place their own Cookies or other files on your device, collect or request you to provide Personal Data.
Currently Linked Websites are the following:
www.versum.xyz
www.mona.gallery
14. Changes to the privacy policy
We may amend the Privacy Policy from time to time, and we encourage you to consult the Privacy Policy regularly for any changes. For convenience, we identify the last date of update on the top of this Policy.
If you have any questions or comments about this Privacy Policy, please contact us at [email protected].
© 2022
