Privacy Policy
1. Who we are
Ardest Gallery ("we," "us," "our") operates www.ardestgallery.com (the "Site") and sells art and gifts online. This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have.
We are the controller of your personal information. Contact us:
- Email: julieverville@ardestgallery.com
- Mail: Ardest Gallery, 25200 Grogans Park Drive. The Woodlands, TX 77380
Effective date: October, 2026
2. Information we collect
We collect information you give us, information collected automatically when you use the Site, and information from third parties.
| CATEGORY | EXAMPLES | SOURCE |
|---|---|---|
| Identifiers and contact details | Name, email, phone, shipping and billing address | You |
| Account information | Username, password (stored hashed), preferences, order history | You |
| Payment information | Card type, last four digits, billing address. Full card numbers are handled by our payment processor ([Stripe/Shopify Payments/PayPal]); we do not store them | You, payment processor |
| Commercial information | Products purchased or viewed, cart contents, returns | You, the Site |
| Communications | Messages via contact forms, customer support, reviews | You |
| Marketing preferences | Newsletter subscription, consent records | You |
| Device and usage data | IP address, browser, device type, pages viewed, referring URL, clicks, approximate location derived from IP | Automatically, via cookies and similar technologies |
| Inferences | Product interests used to personalize offers and ads | Derived from the above |
| Data from advertising and analytics partners, fraud-prevention services, or social login providers [if used] | Third parties |
We do not knowingly collect sensitive personal information (such as health, biometric or precise geolocation data). Some details may be required to place an order; if you don't provide them, we may be unable to complete your purchase.
3. How we use your information
We use personal information only for the purposes below. If you are in the EU, UK or another jurisdiction that requires a legal basis, the basis we rely on is shown for each.
| PURPOSE | LEGAL BASIS (EU/UK) |
|---|---|
| Process and deliver orders, payments, returns and refunds | Performance of a contract |
| Create and manage your account | Performance of a contract |
| Respond to inquiries and provide customer support | Performance of a contract; legitimate interests |
| Send order and account notices (transactional emails) | Performance of a contract |
| Send marketing emails and newsletters | Consent (you can withdraw at any time) |
| Measure and improve the Site with analytics | Consent (EU/UK); legitimate interests elsewhere |
| Show personalized or targeted ads, including retargeting | Consent |
| Prevent fraud and secure the Site | Legitimate interests; legal obligation |
| Keep tax, accounting and other legally required records | Legal obligation |
| Enforce our terms and defend legal claims | Legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights; you can object (see Section 8). We do not use your information for automated decisions that have legal or similarly significant effects on you.
4. Cookies, analytics and advertising
We and our partners use cookies, pixels and similar technologies.
| TYPE | WHAT IT DOES | EXAMPLES |
|---|---|---|
| Strictly necessary | Runs the cart, checkout, login and security. Always on | Stripe |
| Analytics | Tells us how visitors use the Site | Google Analytics |
| Advertising | Measures ad performance and shows you our ads on other sites | Meta Pixel, Google Ads, Pinterest Pixel |
| Preferences | Remembers settings such as language or currency | N/A |
EU, UK and similar regions: we set non-essential cookies only after you consent through our cookie banner.
Opt-out signals: we honor Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out of the sale or sharing of your personal information and targeted advertising for that browser. We do not otherwise respond to "Do Not Track" signals.
You can also block cookies in your browser settings, opt out of interest-based ads at optout.aboutads.info or youronlinechoices.eu, and control Google ads at adssettings.google.com.
5. How we share information
We share personal information only with:
- Service providers who process it on our behalf under contract: e-commerce platform StripeShipping Providers UPS/USPS/FedEx, email provider Mailchimp, and hosting.
- Advertising and analytics partners such as Google and Meta, through cookies and pixels described in Section 4.
- Authorities and others when required by law, to protect rights and safety, or to prevent fraud.
- A buyer or successor in a merger, acquisition or sale of assets, subject to this Policy.
- Anyone else with your consent or at your direction.
"Sale," "sharing" and targeted advertising (US state laws): we do not sell personal information for money. However, our use of advertising cookies and pixels may count as a "sale" or "sharing" of identifiers, device and usage data, commercial information and inferences to advertising partners, or as "targeted advertising," under California and other state laws. You can opt out at [Do Not Sell or Share My Personal Information link] or by using GPC. We do not knowingly sell or share the personal information of consumers under 16.
6. International transfers
We are based in the United States, and our service providers may process data in the United States and other countries whose laws may differ from yours. When we transfer personal information out of the EU, UK or Switzerland, we use a recognized safeguard, such as an adequacy decision, the EU-U.S. Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses (with the UK Addendum). You can request a copy of the relevant safeguards by contacting us.
7. Retention and security
We keep personal information only as long as needed for the purposes in this Policy:
| DATA | RETENTION |
|---|---|
| Order and transaction records | [7] years, for tax and accounting law |
| Account data | While your account is active, then deleted within [90] days of closure |
| Marketing list | Until you unsubscribe or withdraw consent |
| Support messages | [2] years after the inquiry is resolved |
| Analytics and advertising data | Up to [14/26] months, per our tool settings |
We protect information with safeguards appropriate to the risk, including encryption in transit (TLS), access controls, and payment processing through PCI DSS-compliant providers. No system is completely secure; if a breach affects you, we will notify you and regulators as required by law.
8. Your rights and choices
Depending on where you live, you may have the rights below. We will not discriminate against you for using them.
| RIGHT | EU / UK | US STATES | CANADA |
|---|---|---|---|
| Know / access your data and get a copy | Yes | Yes | Yes |
| Correct inaccurate data | Yes | Yes | Yes |
| Delete your data | Yes | Yes | Limited |
| Data portability | Yes | Yes | Quebec |
| Opt out of sale, sharing and targeted advertising | Object | Yes | Withdraw consent |
| Withdraw consent | Yes | Yes | Yes |
| Object to or restrict processing | Yes | - | - |
| Appeal a denied request | Complain to regulator | Yes | Complain to regulator |
*Including California, Texas, Colorado, Connecticut, Virginia, Oregon and the other states with comprehensive privacy laws. California residents may also limit use of sensitive personal information (we do not collect it) and know the categories of data disclosed in the past 12 months (Sections 2 and 5).
Everyone: unsubscribe from marketing emails using the link in any email, and manage cookies through [Cookie Settings].
Appeals (US): if we decline your request, reply to our decision with "Appeal" in the subject line within [60] days. We will respond within 60 days. If you are unhappy with the outcome, you can contact your state Attorney General.
Complaints: EU/UK residents can complain to their local data protection authority or the UK ICO; Canadian residents to the Office of the Privacy Commissioner of Canada.
9. Children
The Site is not directed to children under 13 (under 16 in the EU/UK), and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
10. Changes to this Policy
We may update this Policy from time to time. We will post the new version here with a new effective date and, for material changes, notify you by email or a notice on the Site.
11. Contact us
Questions or requests: julieverville@ardestgallery.com · Ardest Gallery 25200 Grogans Park Drive, The Woodlands, TX 77380 · 832-296-6723.