Privacy Policy
Last updated: 27 September 2026
1. Who we are and what this policy covers
Petra Gut Contemporary AG, Nüschelerstrasse 31, 8001 Zürich, Switzerland ("PGC", "we", "us") is the controller responsible for the personal data described in this policy. We operate the website petragut.com, which presents our artists' works and takes inquiries (there is no online checkout; every sale is concluded by individual quote), our galleries in Zürich and St. Moritz, and related services such as newsletters, invoicing and customer support (together the "Services").
This policy explains what personal data we collect, why, who we share it with, where it is processed, how long we keep it, and what rights you have. It applies to everyone who visits our website, contacts us, buys from us, or otherwise communicates with us.
Applicable law. As a Swiss company, we process personal data under the Swiss Federal Act on Data Protection (FADP / DSG) of 25 September 2020 and its ordinance. If you are in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR also applies to our processing of your data, and you have the additional rights set out in section 7.
Contact for data protection matters: gallery@petragut.com, +41 44 422 40 69, or by post to the address above. We have not appointed a formal data protection officer, as we are not required to do so.
2. Personal data we collect
We collect personal data directly from you, automatically when you use the website, and from our service providers. Depending on how you interact with us, this includes:
- Contact details: name, salutation, postal address, billing and shipping address, email address, phone number.
- Inquiry details: the artwork, edition or size you ask about, your message, and the page you sent the inquiry from.
- Purchase and invoicing data: works you asked about or bought; quotes, prices, discounts, VAT, payment method and payment confirmation; invoice and delivery records. Most works are paid by invoice and bank transfer; in the gallery you can also pay by card via SumUp. We never see or store full card numbers.
- Account and newsletter data: login details, preferences, newsletter subscription status and your responses to our emails.
- Communications: emails, WhatsApp or phone messages you exchange with us, and notes we make about your interests as a collector.
- Device and usage data: IP address, browser and device type, pages visited, referring site, and cookie identifiers.
We do not knowingly collect data from children under 16, and we do not collect sensitive personal data (health, religion, political views and the like) unless you volunteer it in a message.
3. Why we use your data and on what legal basis
| Purpose | Data used | Legal basis (GDPR / DSG) |
|---|---|---|
| Answering artwork inquiries and contact requests | Contact and inquiry details | Your consent (checkbox on the form) and pre-contractual steps at your request |
| Selling, invoicing and delivering artworks | Contact, purchase and invoicing data | Performance of a contract; legal obligation to keep accounting records |
| Customer relationship: following up on your interests, invitations to exhibitions | Contact details, communications, interests | Our legitimate interest in maintaining collector relationships; you may object at any time |
| Newsletter and marketing emails | Email address, name, email responses | Your consent; you can unsubscribe in every email |
| Running and securing the website, preventing fraud | Device and usage data | Our legitimate interest in a secure, working website |
| Complying with law (tax, accounting, anti-money-laundering checks for high-value sales) | Contact, purchase and invoicing data | Legal obligation |
Under Swiss law, processing does not require a specific legal basis unless it violates your personality rights; the table above nevertheless shows the basis we rely on for all visitors.
Ticking the privacy checkbox on our forms confirms that you have read this policy and agree to us handling your inquiry. It is not consent to marketing or to any other processing; sending an artwork inquiry does not subscribe you to our newsletter.
4. Who we share your data with, and transfers to the USA
We do not sell your personal data. We share it only with the service providers below, who process it on our instructions under a data processing agreement, and with authorities where the law requires it.
| Provider | What it does for us | Data it holds | Where it is processed |
|---|---|---|---|
| Shopify International Ltd (Ireland) / Shopify Inc. (Canada) | Hosts our website (artwork catalogue, inquiry forms, pages) and stores website customer accounts where used | Contact, purchase, device and usage data | Ireland, Canada, USA |
| HubSpot, Inc. (USA) | Our customer relationship system: stores inquiries, contacts, our email correspondence with you and sales opportunities | Contact, inquiry and communication data | USA and EU data centres |
| Make.com (Celonis Inc., USA / Celonis GmbH, Germany) | Automates data flows between our systems, for example turning an inquiry into a HubSpot record | Contact and inquiry data in transit | EU (Frankfurt) |
| Airtable, Inc. (USA) | Our internal artwork and inventory database, including sales records | Contact and purchase data | USA |
| Bexio AG (Switzerland) | Accounting and invoicing | Contact, purchase and invoicing data | Switzerland |
| Microsoft Ireland Operations Ltd (Microsoft 365) | Internal collaboration and document storage | Communications, documents, contact data | EU |
| SumUp (SumUp Payments Ltd, UK / SumUp EU Payments UAB, Lithuania) | Card terminal in the gallery, used for a minority of sales; most works are paid by invoice and bank transfer | Payment data | EU, UK |
| Mailchimp (Intuit Inc., USA) | Newsletter sending | Email address, name, email responses | USA |
| Google Ireland Ltd (Google Workspace) | Our email accounts (gallery@, customerservice@ and other petragut.com addresses) | Communications, contact data | EU and USA |
| monday.com Ltd (Israel) | Internal task management for customer requests | Name and request details | EU or USA |
| Meta Platforms Ireland Ltd (WhatsApp) | Messages you send us via the WhatsApp links on our site | Phone number, message content | Ireland, USA |
| Pandectes (Greece) | Cookie consent banner and consent log | Consent choices, IP address, device data | EU |
| Lightward, Inc. (Locksmith app, USA) | Restricts access to selected collections on our website | Customer account or access data | USA |
| Boost Commerce (Boost AI Search & Filter) and Globo.io (Smart Filter & Search, Product Options) | Search, filtering and product options on the website | Search terms, session and device data; selected options on orders | USA, EU, Singapore |
| ITissible (Matrixify app) | Bulk import and export of our Shopify data for administration | Order and customer records during an export or import | EU |
| Anthropic, PBC (Claude AI assistant, connected to Shopify and HubSpot) | Assists our staff with administration, drafting replies and maintaining records; does not make decisions about you | Contact, inquiry and order data that staff work on with the assistant | USA |
| DropInBlog | Hosts our blog pages | Device and usage data of blog visitors | USA |
Transfers to the USA and other countries. Several of these providers are based in, or process data in, the United States. The USA does not offer a level of data protection that Switzerland or the EU regard as fully equivalent. Where we transfer your data there, we rely on:
- the Swiss–US Data Privacy Framework and EU–US Data Privacy Framework, where the provider is certified under them; and
- the European Commission's Standard Contractual Clauses, adapted for Switzerland as recommended by the Federal Data Protection and Information Commissioner (FDPIC), for all other cases.
You can ask us for a copy of the relevant safeguards using the contact details in section 1.
5. Artwork inquiries, contact forms and how long we keep your data
When you send an artwork inquiry from a product page or use our contact form, we ask for your name, email address, mobile phone number and message, and you confirm that you have read this policy and agree to us storing your details to respond. The inquiry, together with the artwork you asked about, is stored in HubSpot and may create a sales opportunity record so that we can follow up. We record the date and wording of your consent in HubSpot.
We use your mobile number only to reach you about your inquiry or purchase, for example to arrange a viewing or delivery. We do not use it for marketing unless you separately agree.
Retention. We keep your data only as long as needed for the purpose it was collected for, or as the law requires:
| Data | How long |
|---|---|
| Inquiries that do not lead to a purchase | 3 years after our last contact, then deleted |
| Customer records of collectors who bought from us | For the duration of the relationship and 10 years after the last purchase (Swiss accounting law, Art. 958f Code of Obligations) |
| Invoices and accounting records | 10 years from the end of the financial year |
| Newsletter subscription | Until you unsubscribe |
| Website usage data and cookies | Up to 13 months, or as set out in the cookie banner |
You can withdraw your consent or ask us to delete your inquiry at any time (section 7). Withdrawal does not affect processing that took place before it.
6. Cookies and website analytics
Our website uses cookies and similar technologies for the site to function (language, login where used), for analytics, and, where you agree, for marketing. Shopify sets the essential cookies. You can manage non-essential cookies through the cookie banner and your browser settings. Visitors from the EEA, UK and Switzerland are asked for consent before non-essential cookies are set.
7. Your rights
Everyone may ask us to:
- confirm whether we process your data and receive a copy of it (right of access);
- correct inaccurate or incomplete data;
- delete your data, unless we must keep it by law;
- receive the data you gave us in a common electronic format (portability);
- stop using your data for marketing, at any time.
If you are in Switzerland, these rights follow Art. 25–32 of the Federal Act on Data Protection. You may also object to processing and, if we do not comply, complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch.
If you are in the EEA or the UK, you additionally have the right to restrict processing, to object to processing based on our legitimate interests, to withdraw consent at any time, and to lodge a complaint with your local data protection authority (list of EEA authorities: edpb.europa.eu; UK: ico.org.uk).
To exercise any right, email gallery@petragut.com. We may need to verify your identity. We respond within 30 days.
8. Security
We protect your data with access controls, encrypted connections (TLS) and providers that hold recognised security certifications. No system is completely secure; please do not send us sensitive information by unencrypted email.
9. Changes to this policy
We may update this policy when our practices or the law change. The current version is always at petragut.com/pages/privacy-policy, with the date of the last update at the top.
10. Contact
Petra Gut Contemporary AG, Nüschelerstrasse 31, 8001 Zürich, Switzerland · gallery@petragut.com · +41 44 422 40 69 · Commercial register CHE-176.324.004