Privacy Policy

Michael Gavrieli Studio s.r.o.

Website: https://michaelgavrieli.com

Last updated: 01.10.2026

This Privacy Policy explains how Michael Gavrieli Studio s.r.o. (“we”, “us” or “the Studio”) handles personal data when you visit our website, contact us, subscribe to studio updates, request a private viewing, or discuss or purchase an artwork. It explains what we use the information for, who receives it, how long we keep it and the rights available to you. We process personal data under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Slovak law.

1 Who is responsible for your personal data

The controller responsible for the personal data described in this policy is:

Michael Gavrieli Studio s.r.o.
Company registration number (IČO): 48 187 909
Registered office: Karpatske Namestie 10 A, 831 06 Bratislava, Slovakia
Privacy contact: michael@michaelgavrieli.com

You may use this email address or write to our registered office with questions about privacy or to exercise your data protection rights.

2 Information we collect

The information we process depends on your interaction with the Studio:

Enquiries and private viewings. Your name, email address, any telephone number or business details you provide, the content of your messages, artwork interests and arrangements for a requested appointment.
Purchases and commissions. Contact, billing and delivery details, artwork and order information, invoices, payment references and relevant correspondence, where you enter into a transaction with us. Any additional information required for a particular transaction is explained when requested.
Newsletter subscriptions. Your email address, subscription preferences and records of when and how you subscribed, the information presented when you consented, and any withdrawal of consent.
Website information. Technical information such as your IP address, browser and device information, pages requested, time of access and security or error logs. Where you enable optional website services, this may also include cookie identifiers and information about your interaction with the site, as described in our Cookie Policy.

We usually receive information directly from you or through your use of the website. If an art adviser or another representative provides information on your behalf, we use it to handle the introduction or transaction. We provide the relevant privacy information and identify the source within one month of receiving it, or sooner at our first communication with you or first disclosure to another recipient, unless you already have that information.

Providing information is voluntary, but we need sufficient contact details to answer an enquiry and the relevant billing and delivery information to complete a purchase. Where information is required by law or for a contract, we explain this when collecting it. Newsletter subscriptions and consent to optional cookies are voluntary.

3 Why we use your information

Responding to enquiries. We use your contact details and correspondence to answer questions and handle requests. Our legal basis is our legitimate interest in communicating with people interested in the Studio and managing business relationships (Article 6(1)(f) GDPR).
Arranging viewings and transactions you request. Where processing is necessary to take steps at your request before entering into a contract with you, or to carry out that contract, we rely on Article 6(1)(b) GDPR. This includes requested purchase discussions, commissions, payment administration, delivery and related services. When you act for a company or another buyer, we use your professional contact details on the basis of our legitimate interest in managing that relationship (Article 6(1)(f)).
Sending newsletters and promotional invitations. We use your email address for these communications with your consent (Article 6(1)(a) GDPR), as explained in section 4.
Operating and protecting the website. We process proportionate technical information to deliver the website, investigate faults and prevent misuse. Our legal basis is our legitimate interest in maintaining a reliable and secure service (Article 6(1)(f)). Optional analytics, advertising and other nonessential tracking are subject to consent as explained in section 5.
Keeping required business records. We process information where necessary to comply with applicable accounting, tax and other legal duties (Article 6(1)(c)). We also retain the evidence of marketing consent and withdrawal required by Slovak electronic communications law.
Protecting rights and documenting artworks. Where necessary, we use relevant records to address complaints, prevent fraud, establish or defend legal claims and verify an artwork’s authenticity or provenance. We rely on our legitimate interests in protecting the Studio, its collectors and the integrity of its artworks (Article 6(1)(f)). We limit personal information to what those purposes require.

When relying on legitimate interests, we assess whether the processing is necessary and whether your interests and fundamental rights override those interests. You have a right to object as explained in section 9.

4 Newsletters and your choices

If you subscribe, we send occasional news about artworks, collections, exhibitions and invitations from the Studio. Sending an enquiry or purchasing an artwork does not automatically subscribe you to promotional emails.

You may withdraw your consent at any time, free of charge, using the unsubscribe link in our emails or by contacting michael@michaelgavrieli.com. We stop the marketing when you withdraw consent and send confirmation of your withdrawal within 30 days. Withdrawal does not affect the lawfulness of processing carried out before it.

We keep the limited consent and withdrawal evidence required by law, as described in section 8. Keeping that evidence does not authorise further marketing.

5 Cookies and external website services

Our website uses cookies and similar technologies. Strictly necessary technologies support functions such as delivering a requested service, maintaining security and remembering consent choices. Technologies that are not strictly necessary, including optional statistics or advertising trackers, require your prior consent.

You can accept or reject optional categories and change your choices through the website’s “Manage consent” control. Withdrawing consent is available through the same mechanism. Continuing to browse or closing the banner does not constitute consent.

External video, map, social media or spam-prevention services can receive information such as your IP address and browser details when they load. Services requiring consent are activated only after that consent is given. A provider’s use of information for its own purposes is also described in its privacy notice.

Our Cookie Policy at https://michaelgavrieli.com/cookies/ forms part of this notice and identifies the technologies actually used, their providers, purposes, durations and relevant third-party access. The service information in section 7 also applies. Cookie expiry and any separate retention of information by a service provider are identified separately.

6 Who may receive personal data

We disclose information only where needed for the purposes explained in this policy. Depending on the service or transaction, recipients include:

Providers of website hosting, email, newsletter delivery, data storage, website maintenance and technical support.
Banks or payment services involved in a transaction, and delivery companies, insurers or specialist art handlers where needed to arrange delivery or related services.
Accountants, legal advisers and other professional advisers where relevant to our business or legal obligations.
Public authorities, courts or other recipients where disclosure is required by law or necessary to establish, exercise or defend legal claims.

Providers processing information on our behalf must act under appropriate data processing terms and our instructions. Some recipients, such as banks, authorities and professional advisers, act as separate controllers for their own legal or professional purposes.

We limit access to collector enquiries, correspondence and transaction records to authorised people and relevant service providers who need that information for the purposes described above.

7 Service providers and international transfers

The European Economic Area (EEA) comprises the EU, Iceland, Liechtenstein and Norway. A provider’s storage of, or access to, personal data outside the EEA may constitute an international transfer.

Where an international transfer takes place, it must be supported by an applicable European Commission adequacy decision or another permitted arrangement, such as the Commission’s Standard Contractual Clauses with supplementary protections where necessary. You can contact us for information about the applicable arrangements and to request a copy of relevant safeguards, with appropriate redactions to protect confidential information and the rights of others.

8 How long we keep information

We retain personal data for the relevant purpose and applicable legal requirements. The following periods or criteria apply:

Enquiries and viewing arrangements. Until the enquiry or appointment and any related follow-up have been completed. Information that becomes part of a transaction, complaint or legal claim is kept under the relevant category below.
Contracts and transaction records. For the duration of the transaction and related obligations, followed by the applicable legal retention or claims period. Accounting and tax records:
Artwork authenticity and provenance. We retain the minimum information needed to verify an artwork’s identity, origin and authenticity for as long as that purpose remains relevant. We periodically review the need for personal details and remove purchaser contact information that is no longer needed. This does not mean that every part of a collector’s correspondence is kept indefinitely.
Newsletter details. While you remain subscribed and the newsletter service continues. When you withdraw consent, we stop using your details for that marketing. We retain consent evidence and confirmation of withdrawal for four years after withdrawal to meet section 116 of Slovak Act No. 452/2021, unless a specific legal obligation or an actual legal claim requires longer retention. Only the information needed for those purposes is retained.
Website security logs. . Logs relevant to an identified incident may be retained while it is investigated and any related claim is resolved.
Analytics and other optional service data. [. Individual cookie durations are set out in the Cookie Policy.

Where information is needed for a complaint, dispute or legal obligation, we restrict retention to the relevant records and keep them until the matter and any applicable legal period have ended. We then delete the information or anonymise it so that it no longer identifies you.

9 Your data protection rights

Depending on the circumstances and the legal basis for processing, you may:

Request access to your personal data and a copy of it.
Ask us to correct inaccurate information or complete information that is incomplete.
Request deletion or restriction of processing where the legal conditions are met.
Receive data you provided in a structured, commonly used, machine-readable format, and request transfer to another controller where technically feasible, when processing is automated and based on consent or a contract.
Withdraw consent at any time without affecting processing that was lawful before withdrawal.

Right to object: You may object to processing based on legitimate interests for reasons relating to your particular situation. We will stop unless we demonstrate compelling legitimate grounds that override your interests and rights, or the processing is necessary for legal claims. You may object to direct marketing at any time, without giving a reason, and we will stop using your information for that purpose.

Contact michael@michaelgavrieli.com to exercise your rights. We respond without undue delay and normally within one month. If the complexity or number of requests requires an extension, we may take up to two additional months and will explain the reason within the first month. We may request proportionate information to verify your identity where necessary. Requests are normally handled free of charge.

10 Complaints

You may complain directly to a supervisory authority, in particular in the EU or EEA country where you normally live, work or believe an infringement has occurred. You do not have to contact us first.

In Slovakia, the supervisory authority is:

Office for Personal Data Protection of the Slovak Republic
Úrad na ochranu osobných údajov Slovenskej republiky
Galvaniho 7/B, 821 04 Bratislava, Slovakia
https://dataprotection.gov.sk/en/contact/

11 Security and automated decisions

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. Access is limited to people who need the information for their work. No method of internet transmission or storage is entirely risk-free.

We do not use personal data to make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.]

12 Changes to this policy

We update this policy when our activities or legal requirements change and show the current revision date above. If we intend to use your personal data for a new purpose, we provide the required information before doing so and obtain fresh consent where necessary. Continued use of the website does not replace any consent that the law requires.