Privacy Policy
Effective Date: 24 August 2026
NADALI Art Expanse GmbH (“NADÁLI”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use and otherwise process personal data when you visit www.nadaliart.com, contact us, submit an enquiry, subscribe to our newsletter or otherwise interact with our website and services.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Austrian Data Protection Act (Datenschutzgesetz, “DSG”), the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021, “TKG 2021”) and other applicable data protection laws.
1. Data Controller
The controller responsible for the processing of personal data through this website is:
NADALI Art Expanse GmbH
Rudolfsplatz 9, 1010 Vienna
Austria
Email: info@nadaliart.com
2. Personal Data We Process
Depending on how you interact with our website and services, we may process the following categories of personal data:
Information you provide to us
This may include:
your name;
email address and other contact details;
information submitted through enquiry or contact forms;
appointment or viewing requests;
communications, messages and correspondence with us; and
any other information you voluntarily provide.
Technical and website data
When you visit our website, certain technical information may be processed automatically. This may include:
IP address;
browser type and version;
device and operating system information;
date and time of access;
referring website or URL;
pages accessed; and
technical information required to deliver and secure the website.
Newsletter information
If you subscribe to our newsletter, we may process:
your email address;
the date and time of your subscription;
your consent status;
technical information necessary to document your consent; and
where applicable, information relating to the delivery and interaction with our newsletters.
3. Purposes and Legal Bases for Processing
We process personal data only where there is a lawful basis under applicable data protection law.
We may process your personal data:
To respond to enquiries and requests
Where you contact us regarding our collections, products, appointments or services, we process the information necessary to respond to your request. The legal basis is Article 6(1)(b) GDPR where the processing relates to steps taken at your request prior to entering into a contract, or Article 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.
To perform contracts and process orders
Where you purchase or commission a product or otherwise enter into a contractual relationship with us, we process personal data as necessary to perform the contract. The legal basis is Article 6(1)(b) GDPR.
To comply with legal obligations
We may process and retain certain personal data where required under applicable tax, accounting, commercial or other laws. The legal basis is Article 6(1)(c) GDPR.
To operate and secure our website
Certain technical processing is necessary to provide, maintain and secure our website. The legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in maintaining a secure and functional online presence.
For analytics and optional website technologies
Where analytics or other non-essential technologies require consent, the legal basis is your consent pursuant to Article 6(1)(a) GDPR and, where applicable, § 165 TKG 2021.
For newsletters and marketing communications
Where you subscribe to our newsletter or otherwise provide marketing consent, processing is based on your consent pursuant to Article 6(1)(a) GDPR and applicable provisions of § 174 TKG 2021.
4. Newsletter and Marketing Communications
You may voluntarily subscribe to the NADÁLI newsletter to receive information including new collections, private releases, events, invitations and other news from NADÁLI.
We process your email address for this purpose on the basis of your consent.
Where appropriate, we may use a double opt-in procedure. This means that after subscribing, you may be asked to confirm your email address before your subscription becomes active.
You may withdraw your consent at any time with effect for the future by clicking the unsubscribe link contained in any newsletter or by contacting us at info@nadaliart.com.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Our newsletter subscription functionality is provided through our website platform, Squarespace. If an additional newsletter or email marketing provider is connected to our website, the relevant provider and processing information will be identified in this Privacy Policy.
5. Website Hosting and Squarespace
Our website is operated using services provided by Squarespace.
Squarespace provides the technical infrastructure necessary to host and deliver our website and may process technical information such as IP addresses, device and browser information, server log data and other information required to provide, maintain and secure the website.
Where Squarespace processes personal data on our behalf, such processing is carried out in accordance with applicable data protection requirements.
Because Squarespace is an international service provider, personal data may in certain circumstances be processed outside the European Economic Area (“EEA”). Where applicable, such transfers must be protected by an appropriate mechanism under Chapter V of the GDPR.
6. Cookies and Similar Technologies
Our website uses cookies and similar technologies to provide essential website functionality, remember user preferences, understand how visitors use our website and, where consent has been provided, support advertising activities.
In accordance with applicable data protection law and § 165 of the Austrian Telecommunications Act 2021 (TKG 2021), cookies and similar technologies that are not strictly necessary are only activated after you have provided your consent.
We use the following categories of cookies:
Necessary Cookies
Always active
These cookies are required to enable core website functionality and to remember certain user preferences and choices, such as language preferences or customised settings.
Because these cookies are necessary for the operation and functionality of the website or to provide functionality expressly requested by you, they do not require your consent where permitted by applicable law.
Performance and Analytics Cookies
Optional
These cookies provide quantitative information about how visitors use our website. They allow us to measure visits and traffic sources, understand how visitors interact with the website and improve its performance.
Performance and analytics cookies are only activated after you have provided your consent.
Advertising Cookies
Optional
These cookies may be used by us and advertising service providers to understand your interests, measure advertising activities and deliver advertising that is more relevant to you.
Advertising cookies are only activated after you have provided your consent.
Managing Your Cookie Preferences
When you first visit our website, you can choose whether to accept optional cookies through our cookie consent tool.
Necessary cookies are always active. Performance and Analytics cookies and Advertising cookies remain disabled unless you choose to enable them.
You may change or withdraw your consent at any time through Manage Cookies on our website.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
7. Embedded Content and External Services
Our website may contain links to or content associated with third-party websites and platforms, including social media services such as Instagram.
When you follow a link to an external platform, the relevant third party is responsible for its own processing of personal data. Its privacy policy and terms will apply.
Where third-party content is embedded directly into our website and its loading would result in personal data being transmitted to the third party, such content will, where legally required, only be activated after you have provided the appropriate consent.
8. Enquiries, Appointments and Communications
If you contact NADÁLI by email, through our website or to arrange a private viewing or other appointment, we process the information you provide for the purpose of handling and responding to your request.
Depending on the nature of your enquiry, processing is based on Article 6(1)(b) GDPR where it relates to a potential or existing contractual relationship, or Article 6(1)(f) GDPR based on our legitimate interest in communicating with customers, prospective customers and other interested parties.
9. Recipients and Service Providers
We do not sell or rent your personal data.
Where necessary, personal data may be disclosed or made accessible to:
website hosting and technology providers;
email and newsletter service providers;
IT and technical service providers;
analytics providers, where applicable and subject to consent where required;
professional advisers such as accountants, lawyers or tax advisers;
payment or financial service providers where required for a transaction; and
public authorities or other recipients where disclosure is required by law.
Service providers acting as processors on our behalf are required to process personal data in accordance with applicable data protection requirements.
10. International Data Transfers
Some service providers used in connection with our website and business operations may be located outside Austria or the European Economic Area.
Where personal data is transferred to a country outside the EEA, we take appropriate measures as required by Chapter V of the GDPR to ensure an adequate level of protection.
Depending on the recipient and destination country, these measures may include an adequacy decision by the European Commission, the EU-US Data Privacy Framework where applicable, or Standard Contractual Clauses approved by the European Commission together with any supplementary safeguards considered necessary.
11. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected or where retention is required by law.
The applicable retention period depends on the nature of the data, the purpose for which it is processed and any applicable statutory retention requirements.
Enquiry and correspondence data is retained for as long as reasonably necessary to deal with the relevant communication and any resulting relationship.
Contractual, transaction, accounting and tax-related information may be retained for the periods required under applicable Austrian law.
Newsletter information is generally processed until you unsubscribe or withdraw your consent. We may retain limited information regarding a withdrawal of consent where necessary to ensure that no further marketing communications are sent and to demonstrate compliance with our legal obligations.
12. Your Data Protection Rights
Subject to the requirements and limitations provided by applicable law, you have the right to:
Access your personal data pursuant to Article 15 GDPR;
Rectification of inaccurate personal data pursuant to Article 16 GDPR;
Erasure of personal data pursuant to Article 17 GDPR;
Restriction of processing pursuant to Article 18 GDPR;
Data portability pursuant to Article 20 GDPR;
Object to processing pursuant to Article 21 GDPR; and
Withdraw consent at any time where processing is based on consent pursuant to Article 7(3) GDPR.
Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time.
To exercise your rights, please contact:
We may request information necessary to verify your identity before responding to a request.
13. Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with a competent supervisory authority.
In Austria, the competent supervisory authority is:
Österreichische Datenschutzbehörde Austrian Data Protection Authority Barichgasse 40–42 1030 Vienna Austria
You may also have the right to contact another competent supervisory authority within the European Union where applicable.
14. Data Security
We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures are reviewed and adapted where appropriate having regard to the nature of the processing, available technology and associated risks.
No internet-based system can guarantee absolute security.
15. Third-Party Websites
Our website may contain links to websites operated by third parties.
Once you leave our website, the processing of personal data by the relevant third party is outside our control. We recommend reviewing the privacy information of any external website or service you use.
16. Changes to this Privacy Policy
We may amend this Privacy Policy where necessary to reflect changes to our website, services, technologies, service providers or applicable law.
The current version will be published on this website. The effective date shown at the top of this Privacy Policy indicates when it was last updated.
17. Contact
For questions about this Privacy Policy or the processing of your personal data, or to exercise your data protection rights, please contact:
NADALI Art Expanse GmbH
Rudolfsplatz 9, 1010 Vienna
Austria
Email:info@nadaliart.com