Legal information

Privacy Notice

Last updated: 12 November 2026

This Privacy Notice explains how Ashbourne Gallery handles personal data in connection with its website, artist submissions, gallery enquiries and professional relationships. We aim to collect only information that is relevant and necessary, use it fairly and transparently, and keep it secure.

1. Data controller

Data Controller: Kameliya Orlinova
Trading name: Ashbourne Gallery
Operating model: Independent online gallery
Location: Marbella, Málaga, Spain
Primary email: office@ashbournegallery.com
Additional privacy contact: ashbournegallery_Ops@proton.me
Website: www.ashbournegallery.com

2. Personal data we may process

Depending on how you interact with the Gallery, we may process:

• Identity and contact details, such as your name, email address, telephone number and professional or postal address.
• Artist and professional information, such as biographies, portfolio links, social media links, professional history and correspondence.
• Artwork information supplied for consideration or representation, including titles, descriptions, dimensions, medium, provenance or authenticity information, condition reports, asking prices and availability.
• Images and supporting materials you provide, including photographs of artwork, certificates and related documentation.
• Contractual, transaction, invoicing and payment information where a professional relationship or sale proceeds.
• Technical information generated when you visit the website, which may include IP address, browser and device information, approximate usage data and security logs, depending on the services and settings used by the website host.

Please do not send identity documents, financial details or other sensitive information unless the Gallery has explained why they are needed and provided an appropriate secure method.

3. Why we use personal data

We may use relevant information to respond to enquiries; review artists and artwork for possible inclusion; communicate about submissions, representation and exhibitions; prepare and administer agreements; coordinate artwork presentation, delivery or sales; maintain accounting and business records; protect the website and prevent misuse; and comply with legal obligations.

4. Legal bases for processing

Under the General Data Protection Regulation (GDPR), the legal basis will depend on the activity. It may include taking steps at your request before entering into a contract, performing a contract, complying with a legal obligation, pursuing legitimate interests such as operating and protecting the Gallery, or your consent where consent is specifically requested. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out lawfully.

5. Artist submissions and gallery relationships

Information and artwork materials submitted by artists or photographers are used to assess and, where agreed, administer a possible or established relationship with Ashbourne Gallery. A submission alone does not create a representation agreement or authorise the Gallery to offer an artwork for sale. Any representation, listing, exclusivity, pricing, commission or sale arrangements are governed by separate written terms agreed with the creator.

We aim to limit collection to information reasonably needed at each stage. Additional identity, tax, banking or delivery information may be requested only where it is necessary for a specific legal, contractual, accounting or operational purpose.

6. Sharing and service providers

We do not sell personal data. Where necessary, information may be shared with service providers who support the Gallery, such as website hosting, email, secure storage, professional advisers, payment or delivery providers, and public authorities where disclosure is legally required. Providers should process information only for the relevant purpose and under appropriate contractual and security safeguards.

7. International transfers

Some service providers may process information outside the European Economic Area. Where personal data is transferred internationally, we will rely on an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate safeguards, where required.

8. Data retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including managing an enquiry or professional relationship, meeting accounting and legal obligations, resolving disputes and establishing or defending legal claims. Retention periods vary according to the type of information and the applicable legal requirements. Information that is no longer needed will be securely deleted or anonymised where appropriate.

9. Security

We use reasonable technical and organisational measures designed to protect personal data against accidental loss, unauthorised access, alteration or disclosure. No method of transmission or storage is completely secure, and you should avoid sending confidential documents through ordinary email unless necessary.

10. Your data protection rights

Subject to applicable law, you may have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, data portability, or to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

To exercise a right, contact us using the details below. We may need to verify your identity before responding.

11. Cookies and similar technologies

The website may use strictly necessary technologies for its operation, security and delivery, and may use additional cookies or similar technologies depending on the features enabled by the website host or third-party services. The specific technologies in use can change with site configuration. Where consent is legally required for non-essential cookies, they should not be activated before the relevant choice is made. You can also manage cookies through your browser settings.

12. Links to other websites

Our website may contain links to third-party websites. Those websites operate under their own privacy notices and practices. We are not responsible for their content or data handling.

13. Children

The Gallery's services are intended for adults and professional contacts. We do not knowingly seek to collect personal data from children.

14. Changes to this notice

We may update this Privacy Notice from time to time to reflect changes in our activities, services or legal requirements. The latest version will be made available on this page with its revision date.