ArtPass Privacy Policy

Last updated: 27 Aug 2026

1. About this Privacy Policy

ArtPass is operated by Art Galleria Limited (NZBN 9429050261260) and its Related Companies (“Art Galleria”, “ArtPass”, “we”, “us” or “our”).

This Privacy Policy explains how we collect, use, store and disclose personal information when you use ArtPass, including its websites, applications, public exhibition catalogues, QR-code pages, visitor accounts, exhibitor administration portal, APIs, communications and related services (“ArtPass Services”).

This Policy applies to:

  • visitors and collectors browsing ArtPass;
  • people who create an ArtPass visitor account;
  • people who enquire about, make an offer on, request a hold on, or purchase an artwork;
  • exhibitors and their personnel;
  • event organisers and their personnel;
  • artists and other people whose information is published through ArtPass; and
  • people who contact ArtPass directly.

“Personal information” means information about an identifiable individual and includes personal data, personally identifiable information and equivalent information under applicable privacy and data-protection laws.

We process personal information in accordance with applicable privacy laws. These may include the New Zealand Privacy Act 2020, applicable Australian privacy laws, the General Data Protection Regulation of the European Union (“GDPR”) and the equivalent laws of the United Kingdom (“UK GDPR”).

Nothing in this Policy limits any rights that cannot lawfully be limited.

2. The different privacy roles within ArtPass

ArtPass connects visitors, exhibitors and event organisers. Different parties may be responsible for personal information in different circumstances.

2.1 Art Galleria

Art Galleria generally determines how personal information is processed for:

  • ArtPass visitor and staff accounts;
  • operation, security and administration of ArtPass;
  • saves, favourites and follows;
  • platform browsing and engagement activity;
  • enquiries, offers and hold requests while they are processed through ArtPass;
  • the technical creation and recording of orders;
  • aggregated exhibition and event analytics;
  • communications from ArtPass;
  • support requests; and
  • fraud prevention, security monitoring and legal compliance.

For these activities, Art Galleria generally acts as the relevant data controller or equivalent responsible organisation.

2.2 Exhibitors

When you enquire, make an offer, request a hold, submit a purchase request or place an order, the contact and transaction information you provide is shared with the relevant exhibitor.

The exhibitor then independently determines how it uses that information to:

  • respond to your enquiry;
  • consider your offer or hold request;
  • confirm or decline an order;
  • arrange collection, packing, shipping or insurance;
  • provide invoices and transaction records;
  • manage the sale;
  • meet legal, accounting and tax obligations; and
  • handle any cancellation, return, refund, chargeback or dispute.

For those activities, the exhibitor acts as an independent data controller or equivalent responsible organisation. Its handling of your information is also governed by its own privacy practices.

Exhibitors must not use enquiry or order contact details for unrelated marketing unless you have given a separate marketing opt-in or the use is otherwise expressly permitted by law.

2.3 Event organisers

An event organiser may receive aggregated analytics for exhibitions participating in its event.

An event organiser does not, merely because it operates the event, receive:

  • a named list of people who browsed an exhibition;
  • the identity of people who saved or followed an artwork, artist or exhibitor;
  • an exhibitor’s enquiry threads; or
  • an exhibitor’s buyer and order information.

Where you contact an event organiser directly through an organiser-owned enquiry form, the organiser will receive the information you submit and will independently determine how it handles that information.

2.4 Exhibitor content

Exhibitors may provide ArtPass with artwork, artist, exhibition, staff and business information for publication or administration.

The exhibitor is responsible for ensuring that it has the authority and any necessary consent to provide that information to ArtPass.

We process and publish that information as necessary to provide the ArtPass Services and may separately process related technical and administrative information for security, support, analytics and legal compliance.

3. Personal information we collect

The information we collect depends on how you use ArtPass.

3.1 Visitor account information

When you create or use an ArtPass visitor account, we may collect:

  • your name;
  • email address;
  • account identifier;
  • authentication information;
  • account preferences;
  • saved artworks;
  • followed artists, exhibitors and events;
  • account-linked enquiries and conversations; and
  • information relating to the administration and security of your account.

Authentication credentials may be managed by an external identity provider. We do not ordinarily receive your identity-provider password.

3.2 Exhibitor and event-organiser account information

When an organisation or its personnel use the ArtPass administration portal, we may collect:

  • names and contact details;
  • organisation names and roles;
  • membership and permission information;
  • billing and commercial information;
  • Stripe connected-account identifiers and status;
  • account activity;
  • security and login information; and
  • communications with ArtPass.

3.3 Public browsing and usage information

When you browse ArtPass, we may collect information such as:

  • pages, exhibitions, exhibitors, artists and artworks viewed;
  • searches, filters and sorting choices;
  • QR-code scans;
  • artwork image interactions;
  • referral source;
  • date and time of access;
  • device, browser and operating-system information;
  • approximate location derived from network information;
  • IP address or a hashed or pseudonymous identifier derived from it;
  • session and visitor identifiers;
  • reliability and performance information; and
  • augmented-reality usage events.

You do not need an account merely to browse public ArtPass content.

3.4 Saves, favourites and follows

An ArtPass account is required to save an artwork or follow an artist, exhibitor or event.

These actions are linked to your ArtPass account so that we can provide your saved and followed content.

Exhibitors and event organisers may receive aggregated counts showing that an artwork was saved or an entity was followed, but they do not receive a named list identifying who performed those actions.

Signing into ArtPass does not, by itself, identify you to an exhibitor.

3.5 Enquiries, offers and hold requests

When you enquire, make an offer or request a hold, we may collect:

  • your name;
  • email address;
  • phone number, if provided;
  • country or location information, if provided;
  • preferred contact method;
  • message contents;
  • the relevant artwork, exhibition, exhibitor or event;
  • offer amount or hold reason;
  • privacy acknowledgement;
  • account identifier, if you are signed in;
  • date and time information; and
  • security and abuse-prevention information, including IP address and user-agent information.

The contact information and contents of the request are shared with the relevant exhibitor or, for an organiser-owned enquiry, the relevant event organiser.

Security information such as IP address and user-agent details is not ordinarily included in the exhibitor-facing enquiry record.

3.6 Orders and purchase requests

When you place an order or submit a purchase request, we may collect:

  • buyer first and last name;
  • email address;
  • phone number, if provided;
  • billing or delivery information, where required;
  • the artwork and exhibitor involved;
  • order amount and currency;
  • order type;
  • order and payment identifiers;
  • payment, confirmation and fulfilment status;
  • transaction timestamps; and
  • communications relating to the order.

This information is shared with the exhibitor so it can consider, confirm and fulfil the order.

ArtPass does not currently require a visitor account to submit an order or purchase request.

3.7 Payment information

Artwork payments are processed through the relevant exhibitor’s connected Stripe account or another payment integration selected by the exhibitor.

We do not ordinarily receive or store your complete payment-card number, card security code or online-banking credentials.

We may receive limited payment and transaction information from Stripe or another integrated provider, such as:

  • payment and checkout identifiers;
  • buyer email;
  • amount and currency;
  • payment status;
  • refund or chargeback status;
  • connected-account identifier; and
  • processing timestamps.

The exhibitor and Stripe may separately collect and process payment information under their own terms and privacy policies.

3.8 Exhibitor and artwork information

Exhibitors may upload or synchronise:

  • organisation names and contact details;
  • logos and addresses;
  • exhibition information;
  • artist names and biographies;
  • artwork images and descriptions;
  • provenance, condition, edition and dimension information;
  • prices and availability;
  • location and booth information; and
  • other catalogue or promotional content.

Some of this information may be publicly displayed through ArtPass.

3.9 Communications, support and marketing

We may collect information that you provide when you:

  • contact ArtPass;
  • request support;
  • provide feedback;
  • respond to a survey;
  • register interest in ArtPass;
  • communicate with us by email, telephone or form; or
  • separately opt into marketing.

A general ArtPass contact or support form is provided to ArtPass and is not automatically shared with an exhibitor or event organiser unless the form clearly states otherwise.

4. How we collect information

We may collect personal information:

  • directly from you;
  • automatically when you use ArtPass;
  • from an exhibitor or event organiser;
  • from Art Galleria where an exhibitor uses an Art Galleria integration;
  • from Stripe or another payment provider;
  • from our identity, hosting, email and security service providers;
  • from a person authorised to act for you; or
  • where otherwise permitted by law.

We may combine information obtained from these sources where reasonably necessary to provide, secure and improve ArtPass.

5. How we use personal information

We may use personal information to:

  • provide and operate the ArtPass Services;
  • create and administer accounts;
  • present public exhibitions and artwork catalogues;
  • maintain saved artworks and follows;
  • connect visitors with relevant exhibitors or event organisers;
  • facilitate enquiries, offers and hold requests;
  • technically facilitate checkout and record order and payment status;
  • provide exhibitors with the information necessary to consider and fulfil orders;
  • send transactional and service communications;
  • send order and enquiry notifications;
  • provide exhibitor and event analytics;
  • measure and improve ArtPass;
  • identify technical problems;
  • maintain security and prevent misuse, fraud and abuse;
  • administer fees and commercial arrangements with exhibitors;
  • respond to support requests;
  • enforce our Terms of Service;
  • comply with legal obligations;
  • establish, exercise or defend legal claims; and
  • send marketing where you have consented or where otherwise permitted by law.

ArtPass does not act as the seller of an artwork and does not use personal information to independently manage, fulfil, cancel or refund an artwork order.

6. Anonymous, pseudonymous and identifiable activity

6.1 Browsing

You may browse public ArtPass content without creating an account.

Exhibitors generally receive browsing information only in aggregated or pseudonymous form, such as:

  • artwork and exhibition views;
  • approximate visitor and session counts;
  • QR scans;
  • device types;
  • traffic sources;
  • search terms;
  • augmented-reality usage; and
  • conversion counts.

These analytics do not ordinarily identify a named visitor to the exhibitor.

6.2 Saves and follows

ArtPass knows which saved artworks and follows belong to an account so that it can provide those features to the account holder.

The relevant exhibitor receives aggregated counts, not the visitor’s name, email address or personal browse history.

6.3 Contact and purchase actions

You become identifiable to the relevant exhibitor when you submit contact or transaction information through:

  • an enquiry;
  • an offer;
  • a hold request;
  • a purchase request; or
  • an order.

The exhibitor receives the information necessary to respond to or administer that request or transaction.

7. Disclosure of personal information

We may disclose personal information as described below.

7.1 To the relevant exhibitor

We disclose information to an exhibitor where you enquire, make an offer, request a hold, submit a purchase request or place an order with that exhibitor.

The information disclosed may include your name, email address, phone number, message, offer or hold details, and order information.

We do not disclose your identity to an exhibitor merely because you browsed, saved or followed its content.

7.2 To an event organiser

We may provide an event organiser with exhibitor-level or event-level aggregated analytics, including views, saves, enquiry counts, sales totals, devices, traffic sources and augmented-reality usage.

We disclose identifiable information to an event organiser where you contact that organiser directly or where disclosure is otherwise clearly explained and legally permitted.

7.3 To payment providers

We disclose order and buyer information to Stripe or another payment provider where necessary to process a payment through the exhibitor’s payment account.

Stripe and the exhibitor may receive buyer and transaction information directly as part of the checkout process.

7.4 To Art Galleria integrations

Where an exhibitor uses an Art Galleria commerce or catalogue integration, we may exchange relevant artwork, exhibitor, buyer and order information with Art Galleria systems to provide that integration.

This technical integration does not make Art Galleria the seller of the artwork or responsible for managing the order or refund.

7.5 To service providers

We may use service providers for functions such as:

  • account authentication;
  • cloud hosting and storage;
  • transactional email;
  • payment processing;
  • application monitoring;
  • security;
  • support; and
  • infrastructure management.

These providers may include Auth0, Stripe, Amazon Web Services and Sentry, together with replacement or additional providers that perform similar functions.

We require service providers to handle personal information consistently with applicable law and their contractual obligations.

7.6 Other permitted disclosures

We may also disclose personal information:

  • to a Related Company;
  • to personnel and contractors who need it to perform their duties;
  • to professional advisers, auditors and insurers;
  • where required by law, court order or a lawful regulatory request;
  • where reasonably necessary to protect the rights, property, security or safety of ArtPass, its users or another person;
  • in connection with a proposed or completed sale, merger, financing or transfer of all or part of our business, subject to appropriate confidentiality protections; or
  • with your authorisation.

We do not sell personal information to third parties for their direct marketing.

We do not provide exhibitors or event organisers with named lists of visitors who merely browsed, saved or followed content.

8. Marketing and transactional communications

ArtPass may send communications necessary to:

  • administer your account;
  • respond to a request;
  • provide security information;
  • notify you about an enquiry or conversation;
  • provide order or payment information; or
  • communicate important changes to ArtPass.

These are service or transactional communications and are not necessarily marketing communications.

We may send marketing communications where you have separately opted in or where otherwise permitted by law. You may unsubscribe using the method provided in the communication.

Providing contact details for an enquiry or order does not, by itself, authorise an exhibitor to add you to a newsletter or use your details for unrelated marketing.

Exhibitors are required to obtain a separate marketing opt-in before using your enquiry or transaction information for unrelated promotional communications, unless another lawful basis clearly applies.

9. Cookies, local storage and analytics

ArtPass may use cookies, local storage and similar technologies to:

  • maintain a session;
  • provide account and security functions;
  • remember preferences;
  • enable saves and follows;
  • measure use of ArtPass;
  • count visitors and sessions;
  • identify returning browsers in a pseudonymous manner;
  • prevent fraud and misuse; and
  • diagnose technical problems.

Some ArtPass analytics are collected directly by ArtPass using visitor, session and device identifiers.

Exhibitors and event organisers receive aggregated analytics rather than a named visitor-level browse history.

Where ArtPass uses non-essential third-party analytics or advertising technologies, we will provide any notice or choice required by applicable law and update this Policy or the relevant cookie notice.

You may be able to restrict cookies through your browser or device settings, although doing so may prevent some ArtPass features from working correctly.

10. Augmented-reality features

ArtPass may provide a feature that allows you to preview an artwork in your space using your device camera.

The ArtPass API does not receive or store camera frames, room scans, environment meshes or spatial maps from this feature.

ArtPass may record usage events such as whether an augmented-reality preview:

  • was started;
  • loaded successfully;
  • failed;
  • resulted in a screenshot; or
  • was shared.

These events do not include the camera image itself.

If you choose to capture or share a screenshot, that action is initiated by you and may be handled by your device, operating system or the application through which you share it.

11. Aggregated and de-identified information

We may combine information and produce statistical, aggregated or de-identified information that does not reasonably identify an individual.

We may use and disclose this information to:

  • provide analytics to exhibitors and event organisers;
  • understand engagement with exhibitions and artworks;
  • improve ArtPass;
  • conduct research and product development;
  • monitor performance; and
  • identify industry or usage trends.

We may retain aggregated or de-identified information for longer than identifiable personal information.

We will not attempt to re-identify properly de-identified information except where necessary to test the effectiveness of de-identification or where otherwise permitted by law.

12. International storage and transfers

Art Galleria and its service providers may process or store personal information in New Zealand, Australia, the United States and other countries in which they operate.

Where privacy law requires safeguards for an international transfer, we will use an appropriate transfer mechanism. This may include:

  • transferring information to a country recognised as providing adequate protection;
  • contractual privacy and security obligations;
  • standard contractual clauses;
  • an international data-transfer agreement or addendum; or
  • another lawful transfer mechanism.

You may contact us for further information about the safeguards used for an international transfer.

13. Security

We use reasonable technical, organisational and administrative safeguards designed to protect personal information from:

  • unauthorised access;
  • misuse;
  • interference;
  • loss;
  • alteration; and
  • unauthorised disclosure.

These safeguards may include encryption in transit, access controls, authentication, monitoring, secure hosting and limits on personnel access.

No internet-based system can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and should notify us promptly if you believe your account or information has been compromised.

14. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as required or permitted by law.

The applicable period depends on the type of information and may take into account:

  • the duration of an account or commercial relationship;
  • the need to provide saved and followed content;
  • legal, accounting and tax requirements;
  • fraud prevention and security;
  • payment-network and chargeback periods;
  • actual or potential disputes;
  • enforcement of agreements; and
  • backup and system-integrity requirements.

Saved artworks and follows may remain associated with an account until they are removed, the account is deleted, or retention is no longer reasonably necessary.

A saved artwork may cease to appear in the normal visitor view if the exhibitor withdraws the listing or the exhibition is no longer publicly available, even if an underlying record is retained temporarily.

Enquiry, offer, hold and transaction records may be retained after an exhibition ends where reasonably necessary for legal, accounting, security or dispute-related purposes.

Aggregated or de-identified information may be retained for a longer period.

15. Children and legal capacity

ArtPass accounts are not intended for children under 16.

We do not knowingly seek to create accounts for children under 16. If you believe that a child under 16 has created an account or provided personal information without appropriate authority, please contact us.

A person placing an artwork order must have the legal capacity to enter into the transaction or must act with the authority of a parent, guardian or other person legally able to enter into it.

16. Your privacy rights

Depending on where you are located, you may have rights to:

  • request access to personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • request deletion of personal information;
  • withdraw consent where processing is based on consent;
  • object to or restrict certain processing;
  • request a portable copy of certain information;
  • object to direct marketing;
  • complain to a privacy or data-protection authority; and
  • receive information about international transfers.

These rights may be subject to exceptions under applicable law, including where information must be retained for legal, transaction, fraud-prevention or dispute-related purposes.

We may require information to verify your identity before responding to a request.

Where a request relates to information independently held or controlled by an exhibitor or event organiser, we may direct you to that organisation or forward the request where appropriate.

17. Privacy questions and complaints

Questions, requests and complaints may be sent to our Privacy Officer at:

Email: support@artgalleria.com

We will consider and respond to privacy requests and complaints in accordance with applicable law.

If you are not satisfied with our response, you may have the right to complain to the relevant privacy or data-protection authority in your jurisdiction.

18. Changes to this Privacy Policy

We may update this Policy from time to time to reflect changes to:

  • ArtPass;
  • our processing practices;
  • service providers;
  • legal requirements; or
  • organisational arrangements.

The updated Policy will take effect when it is published or on a later date stated in the Policy.

Where required, we will provide additional notice of a material change.

Continued use of ArtPass after the effective date of an updated Policy is subject to the updated Policy, but we will seek consent where applicable law requires it.