Last updated: 27/08/2026

1. Preamble and the gallery’s commitment
This privacy policy describes how the company Galerie JAF, a limited liability company with a share capital of EUR 600,000, registered with the Bordeaux Trade and Companies Register under number 818 122 921, head-office SIRET 818 122 921 00013, VAT number FR85818122921, whose registered office is located at 78 cours Georges Clemenceau, 33000 Bordeaux, processes personal data in connection with its website, its gallery activity and, where applicable, the sale of works of art.
Galerie JAF attaches particular importance to the privacy of visitors to the Site, collectors, artists, partners and anyone who writes to it. Art dealing sometimes involves sensitive exchanges (identity, assets, origin of funds). These exchanges are handled with the same rigour as the legal obligations of the art market.
This policy applies to processing carried out by the Site, by email, by telephone, during a visit to the gallery when data are subsequently recorded in a file, and upon conclusion of a sale. It does not apply to third-party sites accessible via links.
Galerie JAF reserves the right to amend this policy to take account of a legal change, a new technical tool or a new purpose. The update date is authoritative. In the event of a substantial change, information is brought to the attention of the persons concerned by a banner or a message, where the law so requires.

2. Data controller and contact
The data controller is Galerie JAF, represented by its managers, Falck Antony and Falck Jeremy. Any correspondence relating to personal data may be sent to the registered office, 78 cours Georges Clemenceau, 33000 Bordeaux, or to the contact email address published on the Site, with the subject line “Personal data”.
Galerie JAF is not required, given its headcount and the nature of its processing, to appoint a data protection officer with the CNIL, unless its organisation changes. If a DPO is subsequently appointed, their contact details will be added here.
Requests to exercise rights are handled within one month, which may be extended by two months in the event of complexity or a large number of requests, in accordance with Article 12 of the GDPR. Proof of identity may be requested only if the controller has reasonable doubt as to the identity of the requester.
No response is given to a request that is manifestly unfounded, excessive or repetitive, within the limits provided by the regulation. The refusal is then reasoned.

3. Categories of persons concerned
The following in particular are concerned: visitors to the Site; persons who complete a contact form or subscribe to a newsletter; collectors and buyers; sellers or consignors of works; artists and their rights holders; journalists and market professionals; individual service providers; persons photographed at an opening when the image makes it possible to identify them.
A minor under fifteen must not transmit data without the agreement of the holders of parental authority. Galerie JAF does not seek to compile files specifically intended for minors.
Legal persons are not, as such, holders of GDPR rights. Professional contacts who are natural persons (nominative email, mobile phone) remain so.
When a work belongs to a third party and their name appears in a notice, Galerie JAF takes care to publish only the necessary information and, as far as possible, to obtain agreement or to use an appropriate legal basis (documented legitimate interest, contractual obligation, information already made public by the person).

4. Data collected
Galerie JAF may collect identification data (surname, first name, title, company); contact data (postal address, email, telephone); data relating to a request (work concerned, indicative budget, visit dates); transaction data (invoices, means of payment without retention of the full card number, purchase history); data required for due-diligence obligations (identity document, proof of address, origin of funds, where anti-money-laundering regulations so require); browsing data (IP address, logs, pages viewed, cookie identifier); event photographs.
Galerie JAF does not, in principle, collect sensitive data within the meaning of Article 9 of the GDPR (health, political opinions, racial origin, etc.). If such data were communicated spontaneously in a message, they are not used for another purpose and may be deleted.
Card payment data, where applicable, are processed by a PCI-DSS certified provider. The gallery does not store cryptograms or full card numbers.
The gallery does not carry out automated profiling producing legal effects in respect of a person, nor any decision based solely on automated processing.

5. Methods of collection
Data are collected directly from the person (form, email, telephone, visit to the gallery, contract of sale or consignment); automatically during browsing, via cookies or server logs, according to the choices expressed on the banner; indirectly, in a limited way, when an artist, an introducer or a partner communicates a professional contact for an introduction, it being that third party’s responsibility to have informed the person.
No data are purchased from mass prospecting files. Subscription to a newsletter is based on consent or, for existing customers and for similar offers, on legitimate interest framed by e-privacy rules, with a simple right to object.
The fields of a form distinguish between data necessary to handle the request and optional data. Refusal to complete a mandatory field may prevent the message from being sent or the contract from being concluded.
Conversations held in the gallery’s physical space are recorded only on request and with prior information. Unless otherwise posted, there is no video surveillance whose images would be used for purposes other than the security of the premises and the works.

6. Purposes and legal bases
The purposes of the processing are: to respond to information requests and organise a visit; to present the collection and exhibitions; to perform a sale, a consignment, documentary expertise or a delivery; to issue and retain invoices; to comply with the accounting, tax and anti-money-laundering obligations applicable to art-market professionals; to ensure the security of the Site and the defence of the gallery’s rights; to send, with consent or in the context of an existing relationship, information about an exhibition or a work; to measure the Site’s audience in aggregated form; to manage intellectual property rights and image-takedown requests.
The legal bases are, as the case may be: performance of a contract or of pre-contractual measures (Article 6(1)(b) GDPR); a legal obligation (Article 6(1)(c)) — in particular the Commercial Code, the Tax Procedures Book, the Monetary and Financial Code for due diligence; the gallery’s legitimate interest (Article 6(1)(f)) — security, evidence, limited development of the relationship with professionals or clients, presentation of a collection — after balancing against the rights of individuals; consent (Article 6(1)(a)) for non-essential cookies and prospecting mailings where required.
Legitimate interest is never used to circumvent a clear refusal. A person may object to it on grounds relating to their particular situation, except for compelling legitimate grounds or the exercise of legal rights.
A new purpose incompatible with these will give rise to prior information and, if necessary, a new legal basis.

7. Recipients and processors
Data are accessible to the managers and authorised staff of Galerie JAF, within the limits of their duties (reception, administration, accounts).
The following may also receive them, only insofar as necessary for them: the Site host; the email or customer-relationship tool provider; the accounting firm and, where applicable, the chartered accountant or statutory auditor; the bank; the insurer of the works or of the premises; the carrier or packer in the event of a delivery; the photographer or communications provider, for the useful files only; advisers (lawyer, notary) in the context of a matter; administrative or judicial authorities upon requisition; collective management societies where the law so requires (droit de suite, for example).
Each provider acting on behalf of Galerie JAF is a processor within the meaning of Article 28 of the GDPR and is bound by a contract imposing confidentiality, security and the deletion or return of the data at the end of the assignment.
Galerie JAF does not sell files to advertisers. It does not take part in data-brokerage programmes.

8. Transfers outside the European Union
Processing is, in principle, carried out in the European Union or in the European Economic Area. Certain tools (email, cloud, statistics) may nevertheless involve a transfer to a third country, in particular the United States.
In that event, Galerie JAF ensures the existence of an adequacy decision of the European Commission or, failing that, appropriate safeguards: standard contractual clauses, additional measures where the impact assessment so requires, and information of the persons concerned.
No anti-money-laundering due-diligence data are hosted in a haphazard way on an uncontracted consumer service. Identity documents are kept in a restricted space, for the period provided by the texts.
On request, Galerie JAF indicates the categories of providers concerned and the transfer mechanism used, without compromising the security of the systems.

9. Retention periods
Contact messages are kept for the time needed to handle the request, then for up to three years from the last exchange for follow-up of the relationship, unless a longer obligation applies.
Customer data and sale documents are kept for the duration of the contractual relationship, then for the statutory accounting and tax retention periods, i.e. in practice ten years for invoices and supporting documents.
Items collected for anti-money-laundering purposes are kept for five years from the end of the business relationship or of the transaction, in accordance with the Monetary and Financial Code, unless legally extended.
Newsletter subscription data are kept until withdrawal of consent or objection, then for the time needed to evidence that withdrawal.
Connection logs and cookies have a short duration: thirteen months at most for audience trackers according to CNIL recommendations, shorter periods for security logs unless an incident justifies targeted retention.
Thereafter, data are deleted or anonymised, except for intermediate archiving strictly necessary for the establishment, exercise or defence of a legal right.

10. Security
Galerie JAF implements reasonable organisational and technical measures: access limited to authorised persons, protected workstations and mailboxes, updates, backups, caution in sending artwork files and client lists, awareness-raising of persons required to handle sale files.
No measure eliminates all risk. In the event of a data breach likely to result in a risk to rights and freedoms, Galerie JAF notifies the CNIL within 72 hours if the legal threshold is met and informs the persons concerned when the risk is high, in accordance with Articles 33 and 34 of the GDPR.
Any passwords for a personal area must be personal, strong and not reused. The gallery will never ask for a password by unsolicited email.
Online reproductions of works are often in a resolution suited to consultation, in order to limit misuse, without this constituting an absolute guarantee against copying.

11. Cookies and trackers
On the first visit, a banner makes it possible to accept, refuse or configure trackers. Refusal of non-essential cookies does not prevent reading of informational content.
A distinction is made between: strictly necessary cookies (session, load balancing, remembering the cookie choice); audience-measurement cookies, placed only after consent or in an exempt configuration if all CNIL conditions are met; social-network or third-party player cookies, which are activated only after agreement.
The visitor may also configure their browser to block all or some cookies. A total block may degrade certain functions.
The precise list of trackers (name, purpose, duration, publisher) is kept up to date in the consent manager or in a table published on the Site. Galerie JAF invites users to consult it regularly.

12. Rights of individuals
Every person has a right of access, rectification, erasure (“right to be forgotten”), restriction, objection, and a right to portability for data provided and processed on the basis of consent or of the contract, where the processing is automated.
They may withdraw their consent at any time, without affecting the lawfulness of prior processing. They may set out instructions as to what happens to their data after their death, in accordance with the French Data Protection Act.
The right to erasure is not absolute. It yields in particular to the obligation to retain invoices, due-diligence files or evidence of a transaction relating to a work.
To exercise these rights: write to Galerie JAF, 78 cours Georges Clemenceau, 33000 Bordeaux, or to the Site’s contact email. If the response is unsatisfactory, a complaint may be lodged with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

13. Works, artists, images and image rights
Notices published on the Site may contain an artist’s name, already public biographical elements and the reproduction of a work. These publications form part of the legitimate activity of a gallery. They do not justify the dissemination of private addresses, bank details or a collector’s asset data.
At openings, photographs may be taken. Atmosphere shots of a public event, where persons appear incidentally, are in principle based on legitimate interest. Isolated portraits or shots intended for a campaign require agreement.
Any recognisable person may request the removal or blurring of an image in which they appear as the main subject. The request is examined promptly.
Artists and rights holders also have their moral and economic rights over the works. A request to take down a reproduction is handled separately from this policy, under the Intellectual Property Code, while it may be accompanied by a GDPR request if personal data are involved (name, portrait of the artist).

14. Prospecting, partners and social networks
Sending messages presenting an exhibition, a fair or a work to a person who is not already a customer is based on consent. An unsubscribe link appears in each mailing.
Galerie JAF’s pages on social networks (Instagram, Facebook or others) are governed, for the part processed by the platform, by that platform’s policy. When the gallery and the platform act as joint controllers for page statistics, the essential information is that provided by the network publisher, supplemented by this policy for the part attributable to the gallery.
Galerie JAF recommends not transmitting identity documents or banking information via a social-network private message. Sale files are handled through secure and contractual channels.
Public comments left on a social page are partly outside the gallery’s control. Reported unlawful content is moderated to the extent of the tools available.

15. Minors, accessibility and automated decisions
The Site presents works of art, including representations of the human body in an artistic context. It is not an information-society service specifically directed at children.
No decision producing legal effects is taken in respect of a visitor solely on the basis of an algorithm (no automated exclusion scoring at the entrance to the Site). The assessment of a sale, including for due-diligence purposes, always involves human intervention.
Galerie JAF endeavours to provide clear information. If a wording in this policy remains obscure, the person may request a further explanation from the contact indicated.
The exercise of rights is free of charge, except for manifestly unfounded or repetitive requests which may give rise to reasonable fees.

16. Governing law, amendments and contact
This policy is governed by French law and the GDPR. It supplements the Site’s legal notices and the general terms of sale, without replacing them.
In the event of an occasional contradiction, the rules most protective of the person concerned apply where the law so requires. For the rest, the document most specific to the situation (sale, consignment, cookie) prevails.
Contact: Galerie JAF — 78 cours Georges Clemenceau, 33000 Bordeaux — RCS Bordeaux 818 122 921 — SIRET 818 122 921 00013 — VAT FR85818122921 — managers: Falck Antony and Falck Jeremy.