Last updated: 12 September 2026
1. Controller and contact
This website is operated by Parcus Gallery, Robert Luiz Parcus, Schloss Aistersheim 1/2, 4676 Aistersheim, Austria. Website: https://parcusgallery.com. Privacy enquiries and data-protection requests may be sent to robert@parcusgallery.com. Parcus Gallery is the controller of personal data processed through this website unless another controller is expressly identified.
2. Scope and categories of data
This notice applies to visitors, artists, buyers, bidders, customers and other people who use or contact Parcus Gallery through this website. Depending on the service used, we may process names, contact details, country, account identifiers, access and verification records, correspondence, artist biographies, professional information, artwork descriptions and images, applications, auction registrations, confidential maximum bids, visible bids, watch-list and reminder preferences, purchase and settlement information, invoices, payment references, IP addresses, browser and device information, timestamps, security logs, cookies and similar technical data.
3. Purposes and legal bases
- To provide accounts, Parcus Art ID, artist services, applications, auctions, bidding, purchases, payments and related communications, and to take steps requested before entering into or performing a contract (Article 6(1)(b) GDPR).
- To issue invoices, keep accounting and transaction records, respond to authorities and comply with tax, commercial, anti-fraud and other legal obligations (Article 6(1)(c) GDPR).
- To operate, secure, maintain and improve the website, prevent misuse, establish or defend legal claims and communicate about legitimate gallery activities (Article 6(1)(f) GDPR).
- To send optional auction-ending reminders or use optional technologies where consent is required (Article 6(1)(a) GDPR). Consent may be withdrawn at any time without affecting processing already carried out lawfully.
4. Accounts, access codes and authentication
The website may use passwordless access codes sent by email. We process the email address, code status, timestamps, account role and relevant security information to authenticate users and protect the service. Access codes are temporary and must not be forwarded. Business email and delivery infrastructure may be provided through Microsoft 365 and authorised email-delivery providers.
5. Artist profiles and public material
Invited artists may submit professional information, images, documents and artwork data for review, administration and publication. Information designated for publication may be visible worldwide, shared by visitors and indexed by search engines. Artists must provide only material they are entitled to use and should remove unnecessary embedded metadata, including precise location data, before uploading.
6. Auctions, proxy bidding and notifications
To operate the auction service, we process buyer registration details, eligibility and verification status, bids, confidential maximum-bid instructions, bidding history, lot interests, outcomes and communications. A confidential maximum bid is not displayed publicly. The system may automatically increase the visible bid by the applicable minimum increment, up to the bidder’s confidential maximum, when competing bids are placed. The auction system also determines the leading bidder and outcome according to the published auction rules, including any soft-close extension. Buyers may contact Parcus Gallery to request clarification or human review of an auction outcome.
Registered buyers may receive operational emails when a bid is surpassed, when a proxy bid is automatically increased, or when they win an auction. A buyer may separately choose, through an unchecked checkbox on a lot page, to receive an email approximately 20 minutes before that lot ends, even without placing a bid. This optional reminder can be cancelled by unchecking the option. Operational messages necessary to administer an active bid or transaction are not marketing messages.
7. Payments
Online payments may be processed by SumUp or another payment provider identified at checkout. The payment provider receives the information required to create, authenticate and complete the payment and processes that information under its own privacy terms and legal obligations. Parcus Gallery stores payment status, amount, currency, transaction or checkout reference and settlement information, but does not intentionally store complete payment-card numbers or security codes on this website.
8. Cookies, logs and embedded content
Essential cookies and similar technologies may be used for login sessions, security, fraud prevention, language or display preferences and website administration. Server logs may record IP address, request details, timestamps, browser information and security events. Embedded videos, media or other third-party content may allow those providers to receive technical data and use their own cookies. Optional cookies or technologies are activated only where permitted by applicable consent requirements.
9. Recipients and service providers
Personal data may be accessed by authorised Parcus Gallery personnel and by service providers needed for hosting, website administration, email delivery, security, payments, accounting, transport, customs, insurance or professional advice. Information may also be disclosed to public authorities, courts or other parties where required by law or necessary to establish, exercise or defend legal claims. Providers receive only the data reasonably necessary for their role.
10. International transfers
Public artist and artwork information is accessible internationally. Some service providers may process personal data outside the European Economic Area. Where Chapter V GDPR applies, transfers rely on an adequacy decision, approved contractual safeguards such as Standard Contractual Clauses, or another lawful transfer mechanism.
11. Retention
We retain personal data only for as long as necessary for the relevant purpose. Account, artist-profile and professional-relationship data is generally retained while the account or relationship remains active and for a reasonable period afterwards. Optional lot-reminder preferences are retained only for the relevant auction. Access codes expire after a short period; proportionate security records may be retained longer where necessary to investigate incidents. Austrian accounting records, invoices and relevant transaction documents are generally retained for seven years from the end of the applicable calendar year, and longer where a legal proceeding, audit or another statutory requirement applies.
12. Your rights
Subject to the conditions of applicable law, you may request access to your personal data, correction, deletion, restriction of processing and data portability, and you may object to processing based on legitimate interests. You may withdraw consent at any time. You may also request human review or clarification where automated auction processing materially affects you. To exercise a right, contact robert@parcusgallery.com. We may request reasonable information to verify identity and protect accounts and transactions.
13. Complaints
You may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, or with another competent supervisory authority in the European Economic Area.
14. Security
We apply proportionate technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. No internet service can guarantee absolute security. Users should protect access codes, keep their contact information current and notify us promptly of suspected misuse.
15. Changes to this notice
We may update this notice when the website, services, providers or legal requirements change. The current version is published on this page with its revision date.