1. Data Controller
The controller of personal data collected via this site is AH — Milans, reachable at: ahmilans.gallery@gmail.com.
2. Data Collected
We collect the following data:
- —Contact form: name, email address and message content. This data is used solely to respond to your enquiry.
- —Newsletter subscription: email address, stored via Brevo (our email provider). You can unsubscribe at any time.
- —Google Analytics (GA4): anonymised navigation data (pages visited, session duration, approximate location) to measure site audience. IP addresses are anonymised. The Google tag is loaded only after you consent via the cookie banner. Analytics also measures visits from our art-card QR links, separately for each artwork (Consent Mode v2).
- —Necessary cookies: a single cookie to remember your consent preference. No personal data is stored.
- —Collector account: if you create an account, we collect your name, email address, and a hashed password (bcrypt). You may also save artworks and artists to your wishlist. Account data and wishlist links are stored in a private Postgres database, not in the public Sanity CMS dataset. The name and email address of an account are also shared with Brevo (our email provider) to maintain the members contact list and personalize the emails we send.
3. Cookies
This site uses the following cookies:
- —ahm-consent (necessary): stores your consent preferences. It is saved in your browser’s local storage, not as a cookie, and contains no personal data.
- —_ga / _ga_* (analytics): set by Google Analytics 4 to distinguish users and throttle request rate. Only set if you consent via the cookie banner.
- —authjs.session-token (necessary): session cookie set when you are signed in to your collector account (prefixed with __Secure- when served over HTTPS). It is strictly functional and does not store personal data.
You can manage your preferences at any time by clicking "Cookie Settings" in the footer.
4. Purpose of Processing
- —Responding to your information or acquisition requests
- —Improving the site experience and content through anonymous audience statistics
- —Managing your collector account, including authentication via email and password
- —Saving and managing your wishlist of artworks and artists
5. Legal Basis
The processing of your data is based on your consent, our legitimate interest in ensuring the security and proper functioning of the site, and the performance of a contract when you create a collector account.
6. Retention Period
Data from the contact form is retained for as long as necessary to process your request, and for a maximum of 3 years from the last contact. Analytics data is retained in aggregated, anonymised form. Account data is retained for as long as your account is active, and for a maximum of 3 years after your last login. You may request deletion of your account at any time.
7. Data Sharing
AH — Milans does not sell your personal data to third parties. Your data may be shared with technical service providers strictly within the scope of their services.
8. Your Rights
Under the GDPR, you have the right of access, rectification, erasure, restriction, portability and objection. Contact us at ahmilans.gallery@gmail.com. You may also lodge a complaint with your national data protection authority.
9. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure. Passwords are hashed using bcrypt and never stored in plain text. Access to account data is restricted via authenticated API routes and a private server-side database connection.
10. Changes
This policy may be updated to reflect changes in the law or our practices. The date of the last update is shown at the top of this page.