Privacy Policy

This Privacy Policy describes how personal data is collected and processed through this website in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable Italian data protection legislation.

1. Data Controller

The Data Controller responsible for the processing of personal data through this Website is:

Clima s.a.s. di Francesco Lecci & C.
Via Lazzaro Palazzi 3
20124 Milan, Italy
Email: info@climagallery.com

Users may contact the Data Controller at any time regarding the processing of their personal data or to exercise their rights under applicable data protection legislation.

2. Types of Personal Data Collected

This Website may collect the following categories of personal data.

Data provided through the contact form

When Users contact the Gallery through the contact form available on this Website, the Gallery may collect:

• name;
• email address;
• company or organisation, if provided;
• any other personal data voluntarily included in the message.

The provision of these data is voluntary. However, certain information, such as an email address and the information necessary to respond to the request, may be required in order for the Gallery to answer the enquiry.

Users are requested not to provide sensitive or special categories of personal data unless strictly necessary.

Newsletter subscription data

When Users subscribe to the Gallery’s mailing list or newsletter, the Gallery collects their:

• email address;
• name, if requested through the subscription form;
• any other information explicitly requested through the subscription form.

These data are used exclusively for sending communications concerning the Gallery, its exhibitions, artists, events, art fairs, projects and related activities.

Users may withdraw their consent and unsubscribe from the newsletter at any time by using the unsubscribe link included in each communication or by contacting the Gallery directly.

Navigation and technical data

During normal operation, the Website and the technical systems used to provide it may automatically collect certain technical information relating to Users’ visits.

Such information may include:

• IP address;
• browser and device information;
• operating system;
• date and time of access;
• pages requested;
• technical information relating to requests made to the Website;
• system and security logs.

These data are primarily processed to ensure the proper functioning, security and technical administration of the Website.

3. Purposes and Legal Bases of Processing

Personal data collected through the Website is processed for the following purposes.

Responding to enquiries

Data submitted through the contact form is processed in order to respond to requests, enquiries or communications sent to the Gallery.

The legal basis for this processing is the performance of pre-contractual measures taken at the request of the User, where applicable, and/or the legitimate interest of the Gallery in responding to communications addressed to it.

Newsletter and Gallery communications

Data provided when subscribing to the newsletter is processed in order to send information about exhibitions, artists, events, art fairs, publications, projects and other activities of the Gallery.

The legal basis for this processing is the User’s consent.

Users may withdraw their consent at any time without affecting the lawfulness of processing carried out before such withdrawal.

Website operation and security

Technical and navigation data may be processed in order to:

• operate and maintain the Website;
• protect the Website against fraud, abuse or security incidents;
• diagnose technical problems;
• ensure network and information security.

The legal basis for this processing is the legitimate interest of the Data Controller in maintaining the security and correct functioning of the Website.

Compliance with legal obligations

Personal data may also be processed where necessary to comply with legal, regulatory, tax, accounting or judicial obligations applicable to the Gallery.

The legal basis for this processing is compliance with a legal obligation to which the Data Controller is subject.

4. Artworks, Artists and Editorial Content

The Website contains images and information relating to artworks, artists, exhibitions, publications and Gallery activities.

Such material is published for artistic, cultural, curatorial, archival and informational purposes.

5. Methods of Processing

Personal data is processed using electronic and, where necessary, manual means.

The Gallery adopts appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal data is limited to persons who need such access for the purposes described in this Privacy Policy.

6. Recipients of Personal Data

Personal data may be accessed by employees, collaborators and authorised persons working with the Gallery where necessary for their duties.

Data may also be processed on behalf of the Gallery by external service providers, including, where applicable:

• website hosting providers;
• website developers and IT service providers;
• email and newsletter service providers;
• cloud storage and data management providers;
• professional advisers where necessary for legal or administrative purposes.

Where required by law, such service providers are appointed as data processors pursuant to Article 28 GDPR.

Personal data may also be disclosed to public authorities where required by law or by a binding request from a competent authority.

Personal data is not sold to third parties.

7. Newsletter Service Provider

The Gallery uses Mailchimp, Artshell and Aruba to manage and distribute its newsletter.

As a result, the email address and other information provided when subscribing to the newsletter may be processed through this service.

Further information concerning the processing carried out by the newsletter provider is available in the provider’s privacy policy.

[This section should be completed once the newsletter platform is confirmed.]

8. Hosting and Technical Service Providers

The Website is hosted and technically operated through Aruba

In providing hosting and technical services, the provider may process technical and navigation data necessary to deliver the Website and ensure its security.

Further information may be found in the privacy documentation of the relevant provider.

9. International Data Transfers

Some technical or communication service providers used by the Gallery may process data outside the European Economic Area.

Where personal data is transferred to a country outside the European Economic Area, the Gallery ensures that such transfers take place in accordance with Chapter V of the GDPR, including, where applicable:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses approved by the European Commission; or
• another valid transfer mechanism provided by applicable data protection legislation.

Further information concerning specific transfers may be requested from the Gallery.

10. Data Retention

Personal data is retained only for as long as necessary for the purposes for which it was collected.

In particular:

Contact requests: personal data contained in enquiries and correspondence is retained for the time necessary to respond to and manage the request.

Newsletter: personal data used for newsletter communications is retained until the User withdraws consent or unsubscribes from the mailing list.

After an unsubscribe request, the Gallery may retain limited information where necessary to document and respect the User’s decision not to receive further marketing communications.

Technical data and logs: these are retained only for the period necessary for Website operation, security and troubleshooting, subject to the retention periods applied by the relevant hosting and technical service providers.

Data may be retained for a longer period where required by applicable law or where necessary for the establishment, exercise or defence of legal claims.

11. Cookies and Similar Technologies

The Website may use technical cookies or similar technologies that are necessary for its proper operation.

Technical cookies may be used, for example, to enable navigation, ensure Website security or maintain technical settings. Such cookies do not require prior consent where they are strictly necessary for the provision of the Website.

If the Website uses analytics, profiling, advertising or other non-essential cookies or tracking technologies, these will only be used in accordance with applicable law and, where required, after obtaining the User’s consent.

Further information regarding the cookies actually used by the Website should be provided in the Website’s Cookie Policy and, where required, through its cookie consent management system.

12. Third-Party Websites and Services

The Website may contain links to external websites, social media platforms or third-party services.

The Gallery does not control the processing of personal data carried out independently by such third parties.

Users are therefore encouraged to review the privacy policies of the relevant third-party services before interacting with them.

13. User Rights

Under the GDPR, Users may, where the relevant conditions are met:

• obtain confirmation as to whether their personal data is being processed;
• access their personal data;
• request correction of inaccurate or incomplete data;
• request deletion of their personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Requests concerning these rights may be submitted to:

info@climagallery.com

Requests will be handled in accordance with the time limits established by applicable data protection legislation.

14. Right to Lodge a Complaint

Users who believe that their personal data has been processed in breach of applicable data protection law have the right to lodge a complaint with the competent supervisory authority.

In Italy, the supervisory authority is: Garante per la protezione dei dati personali

Users may consult the Garante’s official website for information regarding complaints and the exercise of their rights.

This right is without prejudice to any other administrative or judicial remedy available under applicable law.

15. Changes to this Privacy Policy

The Gallery may update this Privacy Policy from time to time in order to reflect changes in the Website, the services offered or applicable legal requirements.

The most recent version will always be made available on this page.

Where required by law, Users will be informed of material changes and new consent will be requested where necessary.

Last updated: 24/09/2026