Privacy Policy
1. Controller
The controller responsible for data processing on this website is:
Galerie Schimming GmbH
Jungfrauenthal 4
20149 Hamburg, Germany
Phone: +49 40 44 15 20
Email: art@galerieschimming.de
Represented by the Managing Directors Birgit Schimming and Holger Schimming.
We have not appointed a data protection officer, as the legal requirements for doing so do not apply to us. For any question concerning data protection, please use the contact details above.
2. Your rights
You have the right at any time to obtain information about the data we hold about you (Art. 15 GDPR), to have inaccurate data corrected (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR) and to data portability (Art. 20 GDPR). You may withdraw any consent you have given at any time with effect for the future (Art. 7 (3) GDPR).
Right to object: Where we process data on the basis of a legitimate interest (Art. 6 (1) (f) GDPR), you may object to the processing on grounds relating to your particular situation (Art. 21 GDPR). You may object to processing for direct marketing purposes at any time without giving reasons.
An informal message to art@galerieschimming.de is sufficient to exercise these rights.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Strasse 22, 20459 Hamburg, Germany.
3. Visiting the website and server log files
When you access our website, your browser automatically transmits data to the server of our hosting provider. This includes the page requested, the date and time of access, the volume of data transferred, the previously visited page, the browser used and its version, the operating system and the IP address.
This data is technically necessary for the operation of the website and serves the security and stability of the system. The legal basis is our legitimate interest in secure and uninterrupted operation (Art. 6 (1) (f) GDPR). Log files are deleted automatically after the period set by our hosting provider. The data is not combined with other sources.
Our website is hosted by goneo Internet GmbH, Dresdener Straße 18, 32423 Minden, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place. The servers are located in Germany.
4. Encryption
This website uses TLS encryption. You can recognise this by the address bar of your browser beginning with https://. Data you transmit to us therefore cannot readily be read by third parties.
5. No third-party resources
All components of this website are delivered from our own server. This applies to scripts, stylesheets, fonts, images, map images and the three-dimensional artwork files used for the AR view. When you open a page, no connection to third-party servers is therefore established and your IP address is not transmitted to any external provider.
Connections to other providers arise only when you initiate them yourself, for example by following a link, starting a video or loading the interactive map. Where this is the case, we point it out at the relevant place; details can be found in sections 13 and 14.
6. Cookies and local storage
We do not use cookies for advertising or tracking purposes. For this reason, no consent banner appears on this website.
We do not store any data in your browser’s local storage either. Your language choice is not stored on your device; it is solely part of the respective web address.
7. Audience measurement
We do not currently use any audience measurement or statistics software. No visitor profiles are created. Should we introduce a data-minimising, cookie-free form of audience measurement in the future, we will amend this policy beforehand.
8. Contacting us
If you contact us by email or telephone, we process your details in order to handle your enquiry and in case of follow-up questions. The legal basis is Art. 6 (1) (b) GDPR where your enquiry relates to the initiation or performance of a contract, and otherwise our legitimate interest in responding to enquiries (Art. 6 (1) (f) GDPR).
We delete this data once your matter has been dealt with conclusively and no statutory retention obligations apply. For business transactions, the commercial and tax retention periods of six and ten years respectively apply.
9. Forms
Several forms are available on our website, including the contact form, the artwork enquiry, enquiries about individual artists, the art advisory and project enquiry, the Kunstclub application and the request for a guest invitation.
We process the details you enter, usually your name, email address, optionally a telephone number, your message and the artwork or project the enquiry relates to. To process your enquiry we usually need your name and email address; all other information is voluntary.
The details are transmitted by email to our gallery mailboxes and processed there. They are not additionally stored in the website’s database. Together with your message, the time of submission and the page from which you sent the form are transmitted. The legal basis is Art. 6 (1) (b) GDPR for enquiries concerning artworks, advice and membership, and otherwise Art. 6 (1) (f) GDPR.
To protect against automated mass submissions, we briefly limit the number of enquiries per sender. For this purpose a non-reversible check value is derived from your IP address and automatically deleted after one hour at the latest. The legal basis is our legitimate interest in trouble-free operation (Art. 6 (1) (f) GDPR).
No purchase can be made via the website and no payment data is collected. Prices are given exclusively on request in personal contact.
10. Newsletter
Our newsletter informs you about exhibitions, new works and events. Invitations to our openings are also sent by this route.
To sign up, we need your email address. Further details such as your interest in particular locations or artists are voluntary and serve to send you more relevant information.
Registration uses the double opt-in procedure. After signing up you will receive an email containing a confirmation link. Only when you open this link does your registration reach us by email, and we then add you to the mailing list. Nothing is stored on the website itself. As evidence of consent we keep this email with your address, any voluntary details and the time of registration and confirmation.
The legal basis is your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time, either via the unsubscribe link at the end of every message or informally by email. After unsubscribing we delete your data from the mailing list. We retain the records documenting consent for up to three years in order to be able to prove the consent originally given in the event of a dispute. The legal basis for this is our legitimate interest in defending against claims (Art. 6 (1) (f) GDPR).
We use Mailchimp, a service of The Rocket Science Group LLC, Atlanta, USA, for distribution. A data processing agreement pursuant to Art. 28 GDPR is in place. Mailchimp also processes data in the USA. The legal basis for this is the European Commission’s adequacy decision on the EU-US Data Privacy Framework, under which the provider is certified.
11. „On your wall“ function
For many works we offer the option of viewing the work true to scale in sample rooms and, via AR, in your own room. The preview in the sample rooms is calculated entirely in your browser; no data is transmitted to us.
AR view on a smartphone: To display the work in your space, your device accesses the camera. The camera images are processed exclusively locally by your operating system, that is, by your device’s AR function, and are not transmitted to us. When the AR view starts, your operating system may establish its own connection to its manufacturer, for example to Apple or Google; we have no influence over this. The privacy terms of the respective manufacturer apply to processing by your device’s operating system.
The program components and three-dimensional artwork files required for both functions are held on our own server. No connection to an external provider is established and your IP address is not passed on.
The legal basis for providing these functions is our legitimate interest in presenting our works vividly (Art. 6 (1) (f) GDPR).
12. Artwork finder
The artwork finder works entirely in your browser. Your selection of size, orientation and colour range is reflected in the address bar so that you can share the result and return to it. No personal data is processed in this. Section 9 applies only once you submit the form for a personal selection.
13. Directions and maps
On our location pages we show the location as a static map image delivered from our own server. When the page is opened, no connection to a mapping service is established.
Only when you activate the „Load interactive map“ button is a map from Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) embedded. Your IP address is then transmitted to Google. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you give by activating the map. Google may also transfer data to the USA; this is based on the European Commission’s adequacy decision regarding the EU-US Data Privacy Framework.
The „Plan your route“ link opens your device’s mapping service, to which the privacy terms of the respective provider apply.
14. Embedded videos
On individual pages we embed videos. When the page is opened, only a preview image is loaded from our own server. Only when you expressly start a video is it retrieved from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode or from Vimeo (Vimeo.com, Inc., 555 West 18th Street, New York, NY 10011, USA) with the „Do Not Track“ setting enabled. Your IP address is then transmitted to the respective provider; in the case of Vimeo, processing may take place in the USA, based on the European Commission’s adequacy decision regarding the EU-US Data Privacy Framework.
The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you give by starting the video.
15. Links to other websites
Our website links to external offerings, for example to Instagram, to Artnet and to pages of partners and artists. As soon as you follow such a link you leave our website. The operators of the linked pages are solely responsible for data processing there.
16. Collector and prospect management
If an enquiry leads to an advisory conversation, a purchase or membership of the Kunstclub, we store your contact details and the information required to look after you in our internal gallery administration, for example your interests, works acquired and the course of our correspondence.
The legal basis is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest in reliably looking after our collectors (Art. 6 (1) (f) GDPR). Documents relevant under commercial and tax law are retained for the statutory periods of six and ten years respectively.
17. Recipients and disclosure
We disclose your data only where this is necessary for the provision of our services or where a legal obligation exists. Recipients are our hosting provider, the newsletter distribution service and, in the event of a purchase, shipping companies and our tax advisers. Data processing agreements pursuant to Art. 28 GDPR are in place with all service providers that process data on our behalf. Data is never sold.
18. Changes to this privacy policy
We will amend this policy as soon as the processing or the legal requirements change. The version published on this page applies in each case.
Last updated: November 2026