Privacy Policy

Mahanaim Gallery Ltd ("Mahanaim", "the Gallery", "we", "us"), a company registered in England and Wales, is the data controller for personal information you provide to us through our website (mahanaim.gallery), by email, by phone, or in person.

If you have any questions about this policy or the way we handle your information, please contact us at hello@mahanaim.gallery.

We collect personal information in the following situations:

• When you browse the website. Our hosting and analytics services log standard technical information including your IP address, device and browser type, the pages you visit, and the time of your visit. This is used to operate the site, fix issues, and understand traffic patterns. We use minimal, privacy-respecting analytics that do not track you across other websites.
• When you enquire about a work. When you contact us through an "Enquire" link, the contact form, or by email, we collect the information you provide — name, email, phone (if given), and the content of your message.
• When you place an order. We collect your name, email, shipping address, billing address, phone number, and the details of your order. Payment is processed by Stripe; we do not see or store your full card details.
• When you subscribe to updates (if applicable). We collect your email address and any preferences you indicate.
• For anti-money-laundering checks on transactions of €10,000 or more, we collect additional identity and source-of- funds documentation under our AML policy. See our Customer Due Diligence Notice provided at the time of purchase.

• To respond to your enquiries and provide information about works you are interested in.
• To process and fulfil your orders, including taking payment, arranging shipping, issuing invoices, and providing certificates of authenticity.
• To maintain records required for tax, accounting, and anti-money-laundering compliance.
• To improve the website and understand which works and pages our visitors engage with.
• To send you marketing communications, but only where you have asked us to (opt-in) and with a clear way to unsubscribe in every email.
• To comply with our legal obligations and to defend or assert legal claims where necessary.

Under UK and EU data protection law we must have a lawful basis for using your information. We rely on the following:

• Contract — to enter into and fulfil a sale or commission with you.
• Legal obligation — for tax records, accounting, anti-money-laundering, and other legal requirements.
• Legitimate interest — to run our gallery, respond to enquiries, prevent fraud, and improve our website. We have considered our interests against your rights and conclude these uses are proportionate.
• Consent — for marketing emails. You may withdraw consent at any time.

We do not sell your personal information. We share it only with the service providers we need to operate the gallery, and only as necessary:

• Stripe — payment processing.
• Supabase — database and image hosting.
• Vercel — website hosting.
• Shipping partners — couriers and art-shipping specialists, with whom we share the address and contents needed to deliver your purchase.
• Email and CRM tools we may use to respond to you, send invoices, and (with consent) send updates.
• Professional advisers — accountants, lawyers, auditors, where relevant.
• Regulators and law enforcement where legally required, including the National Crime Agency in respect of suspicious activity reports.

Each of our processors is bound by data-processing terms requiring them to handle your information securely and only for the purposes we instruct.

Some of our service providers are based outside the UK. Where this is the case, we rely on transfer mechanisms recognised by UK and EU data protection law — typically Standard Contractual Clauses and the UK International Data Transfer Addendum — to ensure your data receives an equivalent level of protection.

• Enquiry correspondence — 2 years from the last contact, then deleted unless the relationship is active.
• Sales records, invoices, AML / KYC files — 6 years from the date of the transaction, in line with HMRC and MLR 2017 requirements.
• Marketing subscription — until you unsubscribe.
• Website analytics — aggregated form indefinitely; personal identifiers are not retained beyond 26 months.

Under UK and EU data protection law you have the right to:

• Ask us what information we hold about you (right of access).
• Have inaccurate information corrected (right of rectification).
• Ask us to delete information that we no longer need (right of erasure — subject to legal retention rules).
• Object to processing carried out on the basis of legitimate interest.
• Restrict our use of your information in some circumstances.
• Receive a portable copy of information you provided to us (data portability).
• Withdraw consent to marketing at any time.
• Complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to address your concerns first.

To exercise any of these rights, please email hello@mahanaim.gallery with the subject line "Data protection". We respond within one month.

We use only essential cookies needed to operate the website (for example, to keep your cart contents between pages). We do not use advertising cookies or third-party trackers. If we ever introduce non-essential cookies, we will ask for your consent first via a visible cookie banner.

Mahanaim Gallery's services are not directed at children, and we do not knowingly collect information about anyone under 18. If you believe a child has provided information to us, please contact us and we will delete it.

We may update this policy from time to time. The "last updated" date at the top of the page tells you when. Material changes will be highlighted on the homepage or notified by email where you have given consent.

Mahanaim Gallery Ltd
Registered office: pending registration
Email: hello@mahanaim.gallery

Our data protection contact is the gallery director, reachable at the email above. If we appoint a formal Data Protection Officer in future, their contact will be listed here.