Privacy policy

The data controller is Tumo galerija, UAB:

• company code 304793498, VAT code LT100013620118;
• registered office Turgelių g. 1, LT-02103 Vilnius, Lithuania;
• email info@tumogalerija.lt, phone +370 699 64555.

For any questions about your data, email info@tumogalerija.lt.

The inquiry form (“My selection”):

• the location or address of the works, company, contact person's name, phone, email;
• preferred start or date, ceiling height, how often the works are swapped, comments;
• the works you selected and their monthly rent.

The inquiry form doesn't accept photos or other files.

The “Rent out your artwork” form:

• your first and last name, email, phone, city or location of the work, company name and code;
• details of the work: artist, title, year, medium, dimensions, framing, condition, provenance, desired rent;
• photos of the work (up to 15) and provenance documents (up to 5).

Photos and documents may contain other data too, such as names in inscriptions or on purchase documents. Please send only what we need to assess the work.

Artists. When a work's owner submits it, we use the artist's name they give, together with the work's details, to assess the work and prepare the rental offer. The basis is our legitimate interest in establishing the work's authorship and provenance (Article 6(1)(f) GDPR); we keep this data for the same periods as other details of submitted works. If you are the artist, you can exercise your rights by emailing info@tumogalerija.lt.

On an artwork page you can see the work on a photo of your own wall (“See it on your wall”). The photo is processed only in your browser: it isn't uploaded or sent to us, and the resulting image is downloaded only to your device.

When you browse the site, the hosting provider technically processes your IP address and browser requests – a page can't be shown without them. We collect visit statistics only if you agree (see “Visit statistics”).

To keep bots from abusing the forms, your browser runs an invisible check when you send a form (Vercel BotID): Vercel assesses technical characteristics of the browser and the request and only tells us whether a person or a bot is sending it. For the same reason we check how many forms were recently sent from the same email address.

• To prepare a quote and contact you about the rental – the inquiry form data. Basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• To assess a submitted work and discuss the rental terms – the “Rent out your artwork” form data. Same basis (Article 6(1)(b) GDPR).
• If you send an inquiry on behalf of a company, we process the contact person's details on the basis of our legitimate interest in responding to the company you represent (Article 6(1)(f) GDPR).
• For the artist's name – our legitimate interest in establishing the work's authorship and provenance (Article 6(1)(f) GDPR).
• To run and protect the site – our legitimate interest in a working site whose forms aren't abused (Article 6(1)(f) GDPR).
• For visit statistics – only your consent (Article 73(4) of the Lithuanian Law on Electronic Communications; Article 6(1)(a) GDPR).

You don't have to provide your data, but without the required fields we can't prepare a quote or assess a work. We don't make automated decisions or build profiles. We don't sell your data or use it for advertising.

Only gallery staff have access to your data. To run the site we use the following service providers, who process data on our behalf:

• Supabase – the database and file storage that hold inquiries, submitted works and uploaded files. Data is stored in the EU (Ireland).
• Vercel – website hosting and backup storage. The server functions that process the forms run in the EU (Dublin, Ireland), where the backups are also kept. If you agree, visit statistics are also collected through Vercel.
• Resend – email delivery. When an inquiry or a work is submitted, the form data (without photos and documents) is forwarded to the gallery by email.
• The gallery's email provider – the emails with form data are delivered to and kept in the gallery mailbox info@tumogalerija.lt.
• Shopify – some artwork images load from Shopify's content delivery network, so your browser connects to Shopify's servers and they see your IP address. Shopify doesn't receive any form data.

Some of these providers or their sub-processors may process data outside the EU, for example in the USA. In that case the transfer relies on the European Commission's standard contractual clauses or other safeguards under the GDPR.

We only disclose data to public authorities when the law requires it.

• Uploaded files (photos of works and documents from the “Rent out your artwork” form, and wall photos previously received with inquiries) – only as long as we need them to assess the work or prepare the quote. We delete them no later than 3 months after receipt.
• Inquiries and details of submitted works (including the notification emails about them in the gallery mailbox) – until we've answered and finished the correspondence, but no longer than 12 months after receipt.
• Daily backup copies of inquiries and details of submitted works (without uploaded files) – in a protected private store (Vercel, Dublin, EU) for no longer than 30 days, after which they are deleted automatically.
• If we enter into a contract, the related data is kept for the term of the contract and as long as accounting and tax laws require.
• Visit statistics (only if you agree) – Vercel discards the visitor hash after 24 hours. Vercel shows us statistics for the last 12 months but doesn't publish how long it keeps the page-view data.

The site doesn't use cookies.

Your browser's storage (localStorage) keeps only two things:

• your “My selection” list (the works you picked), so that it doesn't disappear as you move between pages. This is strictly necessary for the site to work. The list isn't sent to us until you send the inquiry form.
• your answer about visit statistics (“I agree” or “I don't agree”), so that we don't ask again on every page. It isn't sent to us.

You can delete the selection list by removing the works from your selection, and both by clearing your browser's site data.

We'd like to know how many people visit and which pages interest them most. For this we use Vercel Web Analytics, but only if you click “I agree” in the notice at the bottom of the page. The basis is your consent (Article 73(4) of the Lithuanian Law on Electronic Communications; Article 6(1)(a) GDPR). Until you answer, or if you click “I don't agree”, the statistics script isn't loaded and no statistics data is sent.

If you agree, with every page view Vercel receives your IP address and browser data, and stores:

• the time;
• the address of the page you opened;
• the page you came from;
• your approximate location – country, region, city;
• your operating system, browser and device type.

So that the same visitor isn't counted several times, Vercel creates a hash (a one-way identifier) from the request and discards it after 24 hours. No cookies are used, visitors aren't recognised across different days and no personal profiles are built. We only see aggregated numbers, such as how many times a page was viewed, from which country and on what type of device; Vercel shows them for the last 12 months.

The statistics are processed by Vercel Inc. (USA) on our behalf. Data may be transferred to the USA: Vercel participates in the EU-U.S. Data Privacy Framework, and the European Commission's standard contractual clauses also apply.

You can withdraw or change your consent at any time – click “Analytics settings” at the bottom of any page. Withdrawing doesn't affect the lawfulness of statistics collected before. If you don't agree, you can use the site in exactly the same way.

You have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• have the processing restricted;
• object to processing based on legitimate interest;
• withdraw your consent at any time (for visit statistics – “Analytics settings” at the bottom of the page);
• receive the data you provided in a common machine-readable format and transfer it to another controller.

To use these rights, email info@tumogalerija.lt. We'll respond within the period set by the GDPR – no later than one month.

If you believe your data is processed unlawfully, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

We'll update this policy when the site or our service providers change. The current version is always published on this page, with its date shown at the top.