Who is responsible
Gatula Gallery is operated by Gatula ehf., Bíldshöfði 16, 110 Reykjavík, Iceland. Kennitala: 450526-1850. VAT / VSK: 161431. Gatula ehf. is the controller of the personal information used to operate this gallery. For privacy questions or requests, email support@gatula.com or call +354 765 3610.
This policy covers the gallery website, enquiries, consultant conversations and orders. Processing is subject to Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data and the GDPR as incorporated into Icelandic law. Other Gatula websites have their own notices; following an ecosystem link does not automatically share your conversation or order with that business.
Information we process
- Enquiries and conversations: the name, email address, message contents and correspondence you provide, together with message dates and conversation status. An email address is optional for the live conversation, but required when you ask for a reply through the contact form.
- Shared gallery view: the gallery page, photograph, selected size and finish, room, zoom, rotation and picture-light setting, if you use view sharing. This is selection data from our gallery, not access to your screen, camera, microphone or other tabs.
- Orders: your name, email, optional phone number, selected print, delivery method, shipping address where needed, order amount, currency, payment status, transaction references and the terms accepted with the order.
- Service and security data: a random session identifier, request timestamps, IP-derived abuse-prevention identifiers, and connection information handled by our hosting and security providers. Optional customer sign-in and authorised staff sign-in supply an account identifier and email address. A one-way identifier links signed-in gallery records across devices; an email address alone never grants access to records.
We obtain these details from you, your use of the gallery, the sign-in provider (Google) or the payment provider. Please do not send card details, identity documents or sensitive personal information through chat or the contact form.
Why we use it
| Purpose | Legal basis |
|---|---|
| Provide your requested private gallery; answer a print request; prepare, fulfil and support your order. | Steps you request before a contract, and performance of a contract (6(1)(b)). |
| Answer general correspondence and provide optional contextual help in a conversation. | Our legitimate interest in giving relevant customer service (6(1)(f)), balanced against your privacy and sharing choice. |
| Keep accounting records and respond to binding legal requirements. | Compliance with legal obligations (6(1)(c)). |
| Protect the website, prevent abuse, control customer and staff access and handle or defend claims. | Our legitimate interests in security and protecting legal rights (6(1)(f)); legal obligations where applicable. |
We do not use your gallery conversations for advertising profiles, sell personal data, or operate marketing analytics or advertising trackers in the gallery application. Gallery notes are optional and use your explicit consent (Article 6(1)(a)). You choose the subjects and frequency, verify your email, and can withdraw and delete your preferences at /preferences or by contacting us. Buying or making an enquiry never subscribes you.
Selections, room photographs and wall previews
You can sign in with Google to access My gallery across devices. Guest browsing and buying remain available. Guest records are moved into your signed-in account only when you confirm that they are yours. That move ends guest access to those records, deduplicates saved selections and keeps a minimal import record to prevent another account claiming them. Signing out does not delete your account-linked records. Contact the gallery to request access, correction or erasure, subject to applicable retention duties.
Custom-print and project enquiries record your contact details, requested dimensions, preferences and offer history. Ownership support records the verification needed to link a copy to you; this is not disclosed in the public certificate.
Room-photo placement is processed on your device until you explicitly choose to share the prepared preview with the gallery. Wall AR is optional and may request camera permission through your device’s AR system. The gallery application does not record or upload the AR camera feed.
You can create a private proposal link for another person. Anyone holding that link can see the proposal for up to seven days unless you revoke or replace it sooner. Shared proposals exclude your room photographs and contact details.
You may save works, a shopping bag and a private proposal using your gallery session. A proposal records the configuration and information supplied; it does not reserve a copy or guarantee future price or availability.
A room photograph is optional. The uploader makes a reduced PNG copy and removes embedded location and text metadata. Only the owning browser session or signed-in account and authorised gallery staff can access it. With gallery-view sharing enabled, the photograph is linked to your consultation. It is not published, used for marketing or sent to an AI service for training. You can delete it using the conversation controls. Turning view sharing off removes the shared reference but does not itself delete the uploaded file.
Room-photo access expires after 30 days; expired files are removed during subsequent automatic cleanup. Saved selections and proposals are removed during cleanup after 90 days. Session access may end sooner when its cookie expires. Public certificate records contain artwork and copy information, without buyer names, contact details or addresses.
Service providers and recipients
Access is limited to authorised gallery staff and providers who need the information for their work. The relevant categories are:
- OVHcloud provides the server infrastructure. Gatula operates the gallery application, database, file storage and access controls on that server.
- Google supplies the verified account identifier and email address when you choose Google sign-in.
- When email is enabled, Resend processes transactional order messages and requested subscription-verification messages. Gallery news requires separate, verified consent.
- Verifone and the relevant payment-service participants for processing and checking payments. Card details are entered on the payment page; our gallery application does not receive or store full card numbers or security codes. See Verifone’s EEA privacy notice.
- Print-production, delivery and professional advisers where necessary to fulfil an order, keep accounts or handle a claim. We limit what is shared to the relevant task.
- Public authorities where disclosure is required by law.
Providers may act as processors under our instructions, or as controllers for their own payment, regulatory or security obligations. The applicable provider notice explains those independent activities.
International processing
Our hosting and payment providers operate internationally. Depending on the service and support location, information may be processed outside Iceland and the European Economic Area, including in the United States.
Where a transfer outside the EEA is subject to GDPR transfer rules, the relevant arrangement must use a recognised safeguard, such as an applicable adequacy decision or European Commission standard contractual clauses, with additional measures where required. Contact us for information about the recipient, location and safeguard applicable to your data, or to request a copy of the relevant safeguards. Provider information is also available in OVHcloud’s data protection information.
How long information is kept
- Enquiries and conversations: for the period needed to answer the matter and handle relevant follow-up, complaints or claims. The need depends on whether the conversation leads to an order, remains open or concerns a dispute. Information no longer needed for those purposes should be deleted or anonymised.
- Accounting and order records: records required by Icelandic accounting law are normally retained for seven years from the end of the relevant accounting year, under Act No. 145/1994. We retain other order details only as needed for fulfilment, after-sales obligations or legal claims.
- Print and project requests: unaccepted requests are removed during cleanup after 90 days without an update. Accepted offers and copy-support records are retained where needed to fulfil the agreement, maintain provenance or address a claim. Unverified subscriptions are removed after 30 days; verified preferences remain until withdrawal.
- Session cookies: guest and signed-in account sessions last up to 30 days; a one-use sign-in security cookie expires after 10 minutes. Cookie expiry does not itself delete the related messages or order records.
- Abuse prevention: gallery rate-limit counters expire after their short request-control window and are cleared during subsequent checks. Gatula operates the gallery server on OVHcloud infrastructure and controls access to its logs and recovery backups. Diagnostic logs are rotated by size. Recovery backups are restricted to server administrators; when restoring one, we must reapply any later deletion requests before resuming normal use. Contact us for the retention arrangements applying to your records.
A legal obligation, active dispute or legal hold can require particular information to be kept longer. Where deletion is requested, we explain any applicable reason for retaining specific records.
Your rights and how to use them
Subject to the conditions in data-protection law, you can ask for access and a copy of your information, correction, deletion, restriction of processing, or a portable copy of data processed automatically on the basis of consent or a contract. You may object to processing based on legitimate interests because of your particular situation. If we rely on consent, you may withdraw it without affecting earlier lawful processing.
Send a request to support@gatula.com. We may ask for proportionate information to verify your identity. We respond without undue delay and normally within one month. If complexity or the number of requests justifies an extension of up to two further months, we explain this within the first month. Requests are normally free; only the limited exceptions allowed by law apply.
You may complain to Persónuvernd, the Icelandic Data Protection Authority, at postur@personuvernd.is, or to another competent supervisory authority. You do not have to contact us before making a complaint.
Required details, decisions and changes
Required fields are needed to answer a request or fulfil an order. Without them we may be unable to provide that service. Optional details and gallery-view sharing are your choice. We do not make decisions about you with legal or similarly significant effects solely through automated processing in the gallery application. Payment providers may carry out their own fraud and payment checks.
We update this policy when relevant processing changes and identify the current version by its date. This version takes effect on 16 September 2026. Material new uses of information will be explained before they begin.