Privacy Policy

1. Data Protection at a Glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Responsible party” below.

How do we collect your data?

Some data is collected when you provide it to us, for example in a contact form or when you place an order. Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (e.g. browser, operating system, time of access).

What do we use your data for?

Part of the data is collected to ensure the website works without errors. Order data is used to process your order. We do not use any analytics or tracking tools.

What rights do you have?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data, to restrict processing, to data portability, and to revoke any consent you have given with effect for the future. You also have the right to lodge a complaint with a supervisory authority. You can contact us about this at any time.

2. Hosting

This website is hosted by an external service provider: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Personal data collected on this website (e.g. IP addresses, contact requests, contract and contact data, website access data) is stored on the host’s servers.

The host is used to fulfil contracts with our customers (Art. 6(1)(b) GDPR) and in our legitimate interest in a secure, fast and efficient provision of our website (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with our host.

3. General Information and Mandatory Information

Responsible party

Tanja Strass
Holy Art Gallery
Johannes-Haag-Straße 2
86153 Augsburg, Germany
Email: info@holyart.gallery

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing no longer applies. Statutory retention periods (e.g. under tax or commercial law) remain unaffected.

Right to object (Art. 21 GDPR)

If data is processed on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object to the processing of your personal data at any time on grounds relating to your particular situation. You also have the right to object at any time to the processing of your data for direct marketing purposes.

Right to lodge a complaint

In the event of violations of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged violation.

SSL/TLS encryption

This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content such as orders or enquiries. You can recognise an encrypted connection by “https://” and the lock symbol in your browser’s address bar.

4. Data Collection on This Website

Cookies

This website uses cookies. Cookies are small text files stored on your device. We only use technically necessary cookies, e.g. for the shopping cart, the language selection and to save your cookie settings. These cookies are stored on the basis of Art. 6(1)(f) GDPR and § 25(2) TDDDG. If we ask for your consent, cookies are only stored on the basis of that consent (Art. 6(1)(a) GDPR), which you can revoke at any time.

Cookie consent with Borlabs Cookie

This website uses the plugin Borlabs Cookie to obtain and document your consent to certain cookies or the loading of external content. The provider of the plugin is Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany. Borlabs Cookie runs entirely on our own server; no data is transmitted to Borlabs.

Borlabs Cookie stores a cookie (“borlabs-cookie”) in your browser containing your consent choices and a random ID. Your choice is also logged in our database as proof. The data is stored until you ask us to delete it, delete the cookie yourself, or the purpose no longer applies. The legal basis is Art. 6(1)(c) GDPR.

Server log files

The provider of the pages automatically collects and stores information in server log files that your browser transmits to us: browser type and version, operating system, referrer URL, host name of the accessing computer, time of the request and IP address. This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR; we have a legitimate interest in the error-free presentation and optimisation of our website.

Contact form, email and telephone

If you contact us via the contact form, by email or by telephone, your enquiry including the personal data provided (name, contact details, enquiry) will be stored by us to process your request. We do not pass this data on without your consent. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise our legitimate interest in processing enquiries (Art. 6(1)(f) GDPR). The data remains with us until you ask us to delete it or the purpose no longer applies.

5. Plugins and Tools

Locally hosted fonts

This website uses fonts that are stored locally on our own server. No connection to Google or other providers is made.

Videos on this website

The videos on this website are stored on our own server and played directly from there. No video platforms such as YouTube or Vimeo are embedded, and no data is transferred to third parties. When a video is played, only the technical data listed under “Server log files” is processed. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is presenting our work.

6. Online Shop and Payment

Customer and contract data

We collect, process and use personal data only to the extent necessary to establish, carry out or change the contractual relationship (e.g. name, address, email, order details). The legal basis is Art. 6(1)(b) GDPR. Customer data is deleted after the order has been completed, subject to statutory retention periods.

Data transfer for shipping and payment

We only pass on personal data to third parties where this is necessary to process the contract, e.g. to the company delivering the goods (e.g. DHL) or to the payment provider. The legal basis is Art. 6(1)(b) GDPR.

PayPal

If you pay with PayPal, your payment data is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Data may also be transferred to the USA; this is based on the EU standard contractual clauses. For details, see PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Bank transfer

If you pay by bank transfer, we process the details of your transfer (name, amount, reference, bank details) in order to allocate the payment. The legal basis is Art. 6(1)(b) GDPR.

Last updated: November 2026