Privacy Policy

This policy explains what personal information De Buck collects through this website, why we collect it, who it is shared with, and the choices you have. It describes this website specifically, rather than our practices in general.

1. Who we are

De Buck Gallery, registered as DE Art International, LLC, is a contemporary gallery and art advisory operating from New York (“De Buck”, “we”, “us”, “our”). We decide why and how the personal information described here is processed, which makes us the controller of it.

You can reach us about anything in this policy at collect@debuckgallery.com.

2. Information you give us

Most of the information we hold is information you chose to send us. Depending on which form you use, that is:

• Enquiries — your name, email address, an optional telephone number, your message, and the artwork you were looking at if you enquired from a specific work.
• Newsletter — your email address, and your name if you gave one.
• Advisory consultations — your name, email address, telephone number and what you are looking for, including any budget range you tell us.
• Saved works — if you send us a shortlist, the works on it together with the contact details you provide.

We keep an enquiry alongside your contact record so we can answer it and remember the conversation. If you write to us again from the same email address, we update the existing record rather than create a second one.

3. Private viewing rooms and the Private Collection

Some works are shown privately rather than published on the site. Two arrangements exist, and both involve information about you.

If we send you a private viewing room link, the link is personal to you. Opening it records that it was opened, which works you viewed, and any enquiry you sent from it, together with the date and time. We use this so that a conversation about a work is informed — it tells us what you have actually seen. It is linked to you by name, not anonymous. If you would rather we did not keep this, tell us and we will stop recording it for your links and delete what we hold.

If we give you an account for the Private Collection, we store your username, the name we display to you, an email address if you gave one, an optional note about why the account exists, and the date and number of your sign-ins. Your password is stored only as a one-way cryptographic hash: we cannot read it, and if it is lost we issue a new one rather than recover the old. Accounts can carry an expiry date, and we can withdraw one at any time.

4. Information we collect from other sources

As a gallery and advisory we also record details about collectors, institutions, advisors and press whom we have not necessarily heard from directly — for example a name, role, organisation, city and country, collecting interests, and an indicative budget range. Where this comes from a public source, such as a published article or a public professional profile, we record where we found it.

We use this to decide who might genuinely want to know about a particular work, and we rank records against criteria such as stated interests and past dealings. This is done by transparent rules, not by an automated decision that produces a legal or similarly significant effect on you.

If we hold information about you that you did not give us, you are entitled to ask what it is and where it came from, and to ask us to delete it. See section 9.

5. Cookies, measurement, and what this site does not do

This site sets cookies only where they are necessary for it to work. There are two, both set by us, both restricted so that scripts cannot read them:

• A staff sign-in cookie, if you are a member of the gallery signed in to the administration console.
• A client sign-in cookie, if you have a Private Collection account, which expires after fourteen days.

If you save works to a shortlist, that list is kept in your own browser's local storage and is not sent to us unless you choose to send it.

We use one measurement tool, Vercel Web Analytics, provided by the company that hosts this site. It counts page views and visits, and records which page was viewed, the site you arrived from, your country, and the general type of device and browser. It sets no cookie and stores nothing on your device. It does not use your network address as an identifier: visits are counted using a value derived from it that is discarded and regenerated daily, so a visitor cannot be recognised from one day to the next, and we cannot trace a visit back to a person. We use it to see which works and exhibitions draw interest, nothing more.

It is worth being equally clear about what this site does not do. Beyond that one tool we run no advertising or conversion tracking, no Google Analytics, no Tag Manager, and no tracking pixels. Nothing follows you to other websites. There are no social media plug-ins: the links to our social accounts are plain links, and open nothing until you click them. We do not build advertising profiles, and we do not sell or rent personal information to anyone. The gated Private Collection and the administrative pages are excluded from measurement altogether — what a client views privately is not reported to anyone.

Something else happens automatically, as it must on any website. To deliver a page to you, our hosting provider handles your device's network address, and keeps short-lived operational records of which pages were requested and whether they loaded, which it uses to run the service and to protect it from attack. Our own systems never store your network address or browser details. The reports we see are counts and totals — most-viewed pages, visits per day, countries — and never a profile of an identifiable person.

6. Why we use it, and on what basis

We use personal information to answer enquiries, arrange viewings and sales, provide advisory services, send our newsletter to those who asked for it, run private viewing rooms and accounts, keep our records of transactions, and meet tax and anti-money-laundering obligations that apply to art dealing.

Where the General Data Protection Regulation applies, we rely on: performance of a contract, for a sale or an advisory engagement; consent, for the newsletter, which you may withdraw at any time; our legitimate interests in operating and promoting a gallery, where we have considered those interests against your rights; and legal obligation, for record-keeping we are required to carry out.

7. Who else sees it

We do not sell personal information. It is shared only with service providers who process it on our instructions, and only so far as they need to:

• Vercel — website hosting and file storage, in the United States.
• Neon — the database, in the United States.
• Resend — sending transactional email, such as an acknowledgement of your enquiry, where configured.

We may also share information with professional advisors, or where the law requires it — for example a regulatory or tax authority, or in connection with a sale of the business.

8. Where it is held, and for how long

Our website, database and files are hosted in the United States. If you are in the United Kingdom or the European Economic Area, this means your information is transferred outside your home jurisdiction. Where that transfer is subject to the GDPR, we rely on the European Commission's standard contractual clauses with the providers concerned.

We keep enquiries and contact records for as long as we have a relationship with you and for a reasonable period afterwards, since a collector's interest in an artist often resurfaces years later. Records of completed sales are kept for as long as tax, title and anti-money-laundering rules require. Newsletter subscriptions are kept until you unsubscribe. Private Collection accounts are removed when they are no longer needed. If you ask us to delete your information, we will do so except where we are required to keep it.

9. Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, ask for it in a portable form, or object to our relying on legitimate interests. Where we rely on consent, you can withdraw it at any time — every newsletter carries an unsubscribe link, and you can also simply write to us.

Write to collect@debuckgallery.com and we will respond within one month. There is no charge. If you are in the UK or EEA and are unhappy with our response, you may complain to your national data protection authority.

10. California residents

If you live in California, you may request the categories and specific pieces of personal information we have collected about you, the sources it came from, the purpose we collected it for, and the categories of third party it was shared with. You may ask us to delete it, and you may ask us to correct it. We will not discriminate against you for exercising these rights.

We have not sold or shared personal information for cross-context behavioural advertising, and we do not do so now. Requests may be sent to collect@debuckgallery.com; we may need to verify your identity before we act, which we will normally do through the email address we already hold.

11. Security

The site is served entirely over an encrypted connection. Sign-in cookies are restricted so that scripts cannot read them. Passwords for Private Collection accounts are stored only as one-way hashes. Documents such as contracts and condition reports are held in private storage that cannot be reached by a public address; access to them is granted for a few minutes at a time to a signed-in member of the gallery. Access to our administration console is limited to gallery staff.

No system is perfectly secure, and we cannot guarantee the security of information while it is in transit to us. If a breach affects your rights, we will tell you and the relevant authority as the law requires.

12. Children

This site is intended for adults and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.

13. Changes

If we change this policy we will update the date shown at the top of this page. Where a change materially affects how we use information you have already given us, we will tell you directly.