gelingarcia

Privacy and Cookies Policy

Last updated: 23 July 2026

This Privacy and Cookies Policy explains how personal data is collected, used, stored and shared when you visit www.gelingarcia.com, contact us, subscribe to communications, purchase an artwork or other product, or interact with embedded content.

1. Who is responsible for your data?

The data controller responsible for this website is:

Name or business name: Angel Garcia Trueba
Trading name: Gelingarcia
Postal address: 25 rue du Couvent, L-1363 Howald
Country: Luxembourg
Email for privacy requests: info@gelingarcia.com
Business or VAT number, where applicable: LU36582232

In this policy, “we”, “us” and “our” refer to the controller identified above.

2. Scope of this policy

This policy applies to personal data processed through:

  • the Gelingarcia website;
  • the WooCommerce online shop;
  • artwork and product enquiries;
  • contact forms and direct correspondence;
  • newsletter subscriptions;
  • Google Analytics 4;
  • Stripe and PayPal payments;
  • YouTube and Spotify embedded content;
  • social-media links or integrations;
  • website security, hosting and maintenance; and
  • analytics, statistical modelling or AI-assisted audience analysis.

Third-party websites and services have their own privacy policies. We do not control how those independent providers process personal data outside our website.

3. Personal data we may collect

3.1 Website and technical data

When you visit the website, our hosting provider, WordPress, WooCommerce and security services may process:

  • IP address;
  • date and time of access;
  • requested page or file;
  • referring website;
  • browser type and version;
  • device type and operating system;
  • language and approximate location;
  • server logs;
  • error and security information;
  • cookie or device identifiers;
  • shopping-cart and session information; and
  • your privacy and consent preferences.

Some of this information is required to deliver the website, maintain security, prevent abuse and retain items in a shopping cart.

3.2 Contact and enquiry data

When you contact us, we may collect:

  • your name;
  • email address;
  • telephone number, when provided;
  • organisation, gallery or professional affiliation;
  • country or location;
  • the artwork, exhibition or service you are interested in;
  • the content of your message; and
  • subsequent correspondence.

Please do not submit sensitive personal information unless it is necessary for your request.

3.3 Newsletter data

When you subscribe to a newsletter, we may collect:

  • your email address;
  • your name, when requested;
  • subscription date and time;
  • consent records;
  • newsletter preferences;
  • delivery, opening and link-interaction information, when newsletter analytics are enabled; and
  • unsubscribe information.

Our newsletter provider is MailPoet.

Newsletter subscription is voluntary. You can unsubscribe at any time using the link included in each newsletter.

3.4 Customer and order data

When you place an order through WooCommerce, we may collect:

  • name;
  • billing and delivery address;
  • email address;
  • telephone number;
  • account username and password in encrypted form, when an account is created;
  • order contents;
  • artwork or product details;
  • payment status;
  • delivery and tracking information;
  • tax or VAT information;
  • customer notes;
  • communications relating to the order;
  • refund, cancellation and dispute information; and
  • technical information associated with the transaction.

We use this information to process the transaction, deliver the order, provide customer service, maintain accounting records, prevent fraud and comply with legal obligations.

3.5 Payment information

Payments may be processed through Stripe or PayPal.

Payment providers may collect information such as:

  • cardholder or account-holder name;
  • payment-card or account information;
  • billing address;
  • transaction amount and currency;
  • IP address;
  • device and browser information;
  • authentication information; and
  • fraud and security signals.

We generally do not receive or store your complete payment-card number. We normally receive payment confirmation, transaction identifiers, limited payment details and information required to administer the purchase.

Stripe and PayPal may act as independent controllers for parts of their payment, identity-verification, regulatory and fraud-prevention activities. Their own privacy notices apply to those activities.

3.6 Embedded content

The website may display or link to content provided by:

  • YouTube;
  • Spotify; and
  • social-media platforms.

When you consent to and load embedded content, the relevant provider may receive:

  • your IP address;
  • device and browser information;
  • the page you visited;
  • interaction information;
  • cookie or account identifiers; and
  • information about your use of the embedded player.

When you are signed in to a provider account, that provider may associate your interaction with your account.

4. Why we process personal data

We process personal data for the following purposes and legal bases.

Operating and securing the website

We process necessary technical data to provide the website, maintain security, prevent fraud, diagnose errors and protect our rights.

The legal basis is our legitimate interest in operating a secure and functional website and, where applicable, the performance of a contract.

Responding to enquiries

We process messages and contact details to respond to requests concerning artworks, exhibitions, collaborations, sales, press, commissions and other professional matters.

The legal basis is taking steps at your request before entering a contract, performing a contract, or our legitimate interest in responding to relevant correspondence.

Processing orders

We process customer and order data to accept payment, prepare and deliver purchases, communicate about orders, handle returns and provide customer support.

The legal basis is the performance of a contract.

Accounting and legal compliance

We retain invoices, transaction records and related information where required by tax, accounting, anti-fraud or other applicable laws.

The legal basis is compliance with a legal obligation.

Newsletter communications

We use subscriber details to send newsletters, invitations, exhibition announcements, studio news or related communications.

The legal basis is consent. Consent may be withdrawn at any time without affecting processing that took place before withdrawal.

Analytics

We use analytics to understand how visitors find and use the website, identify popular artworks and pages, assess website performance and improve navigation and content.

Non-essential analytics are based on consent.

Embedded media

YouTube, Spotify and other non-essential external media are loaded on the basis of your consent.

Establishing or defending legal claims

Where necessary, we may retain or use information to establish, exercise or defend legal claims.

The legal basis is our legitimate interest in protecting our legal rights.

5. Cookies and similar technologies

Cookies are small files stored on your device. The website may also use browser storage, pixels or comparable technologies.

Strictly necessary technologies are used to provide requested services, maintain security, remember shopping-cart contents and retain your privacy choice. Non-essential analytics and external-media technologies require consent.

Consent preference

The Gelingarcia SEO & Analytics WordPress plugin stores your analytics choice in your browser under:

gsa_consent_v2

This is stored in local browser storage rather than as a traditional cookie. It records whether analytics permission was granted or declined. It remains until you change the setting, clear your browser storage or use a different browser or device.

This preference is necessary to remember and respect your choice. The plugin does not create a central server-side record of this choice.

WordPress and WooCommerce technologies

Depending on the pages and functions used, WordPress and WooCommerce may use technologies including:

  • wordpress_test_cookie — checks whether the browser accepts cookies; normally lasts for the session;
  • wordpress_logged_in_[hash] — maintains an authenticated session for registered users;
  • wp-settings-[user ID] and wp-settings-time-[user ID] — retain administration or interface preferences for logged-in users, normally for up to one year;
  • woocommerce_cart_hash — detects changes to the shopping cart; normally lasts for the session;
  • woocommerce_items_in_cart — records whether the cart contains items; normally lasts for the session; and
  • wp_woocommerce_session_[hash] — links the visitor to the relevant shopping-cart data; normally lasts for two days.

The exact cookies present depend on the website configuration, whether you are logged in and which WooCommerce functions you use.

Google Analytics cookies

When you allow analytics, Google Analytics may set:

  • _ga — distinguishes visitors; default duration of up to two years; and
  • _ga_<container-id> — maintains session state; default duration of up to two years.

Browser restrictions or our configuration may shorten these periods.

Payment technologies

Stripe and PayPal may use necessary cookies or comparable technologies during checkout for authentication, transaction processing, security and fraud prevention.

These technologies may be necessary to provide the payment method you select.

External-media technologies

YouTube and Spotify may use cookies or browser storage when their embedded content is loaded. Because the names and durations of third-party technologies may change, current details are available in the respective providers’ privacy and cookie notices.

You can decline external-media consent and access the relevant content directly through the provider’s website instead.

6. Google Analytics 4

We use Google Analytics 4 with the measurement ID:

G-MW0VSRE32M

The Google Analytics tag is configured through the Gelingarcia SEO & Analytics WordPress plugin.

The plugin does not load Google Analytics unless you select “Allow analytics.” If you decline, the Google Analytics script is not loaded by this plugin.

Advertising-related consent settings are configured as denied:

  • advertising storage;
  • advertising user data; and
  • advertising personalisation.

Google Analytics may process information such as:

  • page views;
  • session statistics;
  • events and interactions;
  • approximate location;
  • browser and device details;
  • referral information; and
  • a client identifier stored in an analytics cookie.

We use this information to produce statistical reports and improve the website. We do not use Google Analytics to identify visitors by name.

Google Analytics user-level and event-level data is retained for 14 months. Aggregated reports may remain available for longer periods.

You can withdraw your analytics consent through the Privacy settings button displayed on the website. Withdrawal prevents further analytics loading on subsequent visits. Existing analytics cookies may remain on your device until they expire or are deleted through your browser settings.

Google’s default Analytics implementation collects user numbers, session statistics, approximate geolocation, browser information and device information. Its _ga cookies have a default duration of up to two years.

7. YouTube, Spotify and social-media services

YouTube and Spotify content should remain blocked until you choose to load external media.

After consent, a direct connection may be established between your browser and the provider. The provider may then process personal data independently and may transfer data outside the European Economic Area.

Our website may also contain ordinary links to social-media pages. Merely displaying a normal link does not necessarily transfer data to that social platform. Data is transferred when you follow the link or interact with a loaded third-party integration.

8. AI-assisted analytics and profiling

We may use analytics services containing statistical, automated or machine-learning functions. These functions may be used to:

  • identify general audience and traffic trends;
  • detect unusual traffic patterns;
  • group website interactions into broad statistical categories;
  • estimate aggregated performance;
  • produce automated insights; or
  • help us understand which pages, artworks or content appear useful to visitors.

We use these outputs for general website and business analysis.

We do not independently use AI analytics to:

  • make decisions producing legal effects about visitors;
  • make decisions that similarly significantly affect visitors;
  • determine whether a person may purchase an artwork;
  • determine individual prices or contractual eligibility;
  • evaluate creditworthiness;
  • infer sensitive personal characteristics;
  • perform biometric identification or categorisation;
  • recognise emotions;
  • create social scores; or
  • intentionally manipulate visitors.

Payment providers may use automated systems for payment security, authentication and fraud prevention under their own legal responsibilities and privacy notices.

Where profiling is based on non-essential analytics information, it is carried out only after consent. You may withdraw that consent through the website’s privacy settings.

We do not submit the contents of private enquiries, complete payment information, order records or newsletter lists to public generative-AI services unless this is separately disclosed and an appropriate legal basis and safeguards are in place.

If we later introduce a customer-facing AI assistant, emotion-recognition tool, biometric system, personalised automated decision system or AI-generated content requiring disclosure, we will provide clear information at the point of interaction and update this policy before using it.

We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

The EU AI Act imposes transparency duties for certain systems that directly interact with people, for some synthetic content, and for emotion-recognition or biometric-categorisation systems. It also prohibits certain manipulative, social-scoring and biometric uses.

9. Who receives personal data?

Depending on how you use the website, personal data may be received by:

  • our website hosting provider: ionos.es;
  • WordPress and WooCommerce service providers;
  • our contact-form provider: MailPoet;
  • our newsletter provider: MailPoet;
  • Google Analytics;
  • Stripe;
  • PayPal;
  • YouTube;
  • Spotify;
  • security, backup and website-maintenance providers;
  • delivery and logistics providers;
  • accountants, professional advisers or insurers;
  • public authorities, courts or regulators where disclosure is legally required; and
  • service providers involved in protecting or enforcing our legal rights.

We share only the information reasonably necessary for the relevant purpose.

10. International data transfers

Some providers operate globally and may process information outside Luxembourg or the European Economic Area.

Where GDPR-protected personal data is transferred to a country without an adequacy decision, the relevant provider or contractual arrangement may rely on safeguards such as:

  • European Commission Standard Contractual Clauses;
  • approved binding corporate rules;
  • an applicable adequacy decision;
  • the EU–US Data Privacy Framework, where valid and applicable; or
  • another lawful transfer mechanism.

Stripe states that it uses mechanisms including Standard Contractual Clauses for international transfers. PayPal states that it uses mechanisms including adequacy decisions, Standard Contractual Clauses and approved binding corporate rules where applicable.

You may contact us for information about the safeguards relevant to a particular transfer.

11. How long we retain personal data

We retain personal data only for as long as necessary for the relevant purpose, including:

  • contact enquiries: normally up to 24 months after the last meaningful correspondence, unless a longer period is necessary for an ongoing project, contract or legal claim;
  • unsuccessful or inactive sales enquiries: normally up to 24 months;
  • newsletter subscriptions: until you unsubscribe or we discontinue the mailing list, subject to retaining a minimal suppression record to respect an unsubscribe request;
  • newsletter consent records: for as long as reasonably necessary to demonstrate consent;
  • customer accounts: while the account remains active and for a reasonable period afterwards;
  • abandoned shopping-cart data: according to the retention settings configured in WooCommerce;
  • order, invoice, payment-status and accounting records: normally 10 years where Luxembourg accounting or VAT rules require this;
  • security logs: normally 90 days, unless a longer period is required to investigate an incident;
  • contact-form submissions stored in WordPress: 12 months;
  • Google Analytics user-level and event-level data: 14 months;
  • consent preference in local browser storage: until you change it or clear browser storage; and
  • legal-claim information: until the relevant limitation period has expired and any proceedings are complete.

Luxembourg guidance states that applicable accounting records and invoice copies may need to be retained for ten years.

When information is no longer required, it is deleted, anonymised or securely archived where continued storage is legally required.

12. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

  • receive information about how your data is processed;
  • request access to your personal data;
  • correct inaccurate or incomplete data;
  • request deletion of personal data;
  • request restriction of processing;
  • object to processing based on legitimate interests;
  • receive certain data in a structured, commonly used and machine-readable format;
  • withdraw consent at any time;
  • object to direct marketing;
  • request information about relevant international-transfer safeguards; and
  • not be subject to certain solely automated decisions producing legal or similarly significant effects.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact:

info@gelingarcia.com

We may ask for information reasonably necessary to verify your identity. We will normally respond within the period required by applicable law.

You also have the right to lodge a complaint with the:

Commission nationale pour la protection des données — CNPD, Luxembourg

You may also contact the supervisory authority in the EU or EEA country where you live or work.

The GDPR requires controllers to provide information about identity, purposes, legal bases, recipients, transfers, retention and data-subject rights.

13. Security

We use reasonable technical and organisational measures intended to protect personal data against:

  • unauthorised access;
  • accidental loss;
  • alteration;
  • disclosure;
  • destruction; and
  • unlawful use.

Measures may include encrypted connections, access controls, software updates, backups, restricted administrator access and payment processing through specialist providers.

No online service can guarantee absolute security. Visitors should avoid submitting unnecessary sensitive information through ordinary contact forms or email.

14. Children

The website and online shop are not specifically directed at children.

We do not knowingly use analytics or profiling to target children. If you believe that a child has provided personal data without appropriate authorisation, please contact us so that the circumstances can be reviewed.

15. Changes to this policy

We may update this policy when:

  • website functions change;
  • service providers change;
  • legal requirements change;
  • new analytics or AI systems are introduced; or
  • our data-processing practices change.

The most recent revision date will be shown at the beginning of the policy. Material changes may also be communicated through the website or another appropriate channel.

16. Contact

Questions about this policy or our processing of personal data may be sent to:

Angel Garcia Trueba – gelingarcia.com
25 rue du Couvent, L-1363 Howald (Luxembourg)
info@gelingarcia.com