Privacy Policy
Last updated: 23 June 2026
1. Who is responsible for your data
Composition takes your privacy seriously.
- For your use of this website and any enquiry you send us, the data controller is Composition LLC, Liberty Square 1 (entrance Leonidze 2a, space 7), 0105 Sololaki, Georgia (country), company no. 404619169.
- Where you complete a purchase that is concluded by our affiliate Composition Limited (23 Thomson Road, Unit B, 11/F, Wan Chai, Hong Kong, company no. 77997042), that entity is the controller for the data needed to fulfil and administer your purchase. We will make clear at checkout which entity is your seller.
Together, “Composition”, “we”, “us”. For any privacy question, or to exercise your rights, contact us at [email protected]. This policy covers www.composition.gallery and our dealings with clients and enquirers. It does not cover third-party websites we link to.
2. What data we collect
- Identity and contact data: name, email, postal address, phone number.
- Transaction data: artworks enquired about or purchased, prices, invoices, payment status, and (for compliance) identity-verification documents and source-of-funds information where we are required to collect them.
- Payment data: processed by our payment providers; we do not store full card numbers.
- Communications: your messages, enquiries and our correspondence.
- Technical and usage data: limited, aggregated statistics about how visitors use the Site (such as pages viewed and general location at country level), collected in a privacy-friendly way without cookies or cross-site tracking (clause 9).
- Marketing data: your newsletter subscription and preferences.
We collect this from you directly, and automatically as you use the Site.
3. Why we use it, and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| To process and fulfil your purchase, arrange shipping, and provide support | Performance of a contract |
| To verify identity and meet anti-money- laundering, tax and other legal duties | Legal obligation |
| To prevent fraud, secure the Site, and run our business | Legitimate interests |
| To send newsletters and marketing | Consent (you may withdraw at any time) |
| To handle disputes and enforce our terms | Legitimate interests / establishing legal claims |
Where we rely on consent, you can withdraw it at any time without affecting prior processing. Where we rely on legitimate interests, you can object (clause 7).
4. Who we share it with
We share personal data only as needed, with: fine-art shippers and customs agents (to deliver your purchase); partner galleries/consignors where they are the seller or are shipping to you (limited to what is needed to fulfil and insure the delivery); payment providers; professional advisers (legal, accounting); identity/AML and fraud-prevention services; and public authorities where legally required. We do not sell or rent your personal data.
5. International transfers
We operate from Georgia (country) and Hong Kong, and we work with partners worldwide. This means your data may be transferred outside the EEA/UK, including to countries that have not received an EU/UK “adequacy” decision. Where that happens, we put in place an appropriate safeguard — typically the EU Standard Contractual Clauses (and the UK Addendum) — or rely on another lawful transfer mechanism, such as the transfer being necessary to perform your contract. You can ask us for details of the safeguards used.
6. How long we keep it
We keep personal data only as long as needed for the purposes above: transaction, tax and anti-money-laundering records for as long as applicable Georgian, Hong Kong and other relevant law requires us to retain them; marketing data until you unsubscribe; enquiry data for a reasonable period if no purchase follows. After that we delete or anonymise it, unless a longer period is legally required, in which case the data is restricted from other use.
7. Your rights
Subject to applicable law (including the GDPR for individuals in the EU/UK), you have the right to: access your data; correct it; erase it; restrict or object to processing; data portability; and to withdraw consent to marketing at any time. To exercise any of these, email [email protected]; we may need to verify your identity and will respond within the time the law allows (one month under the GDPR). You also have the right to complain to a supervisory authority — for individuals in the EU, your local data-protection authority; in the UK, the Information Commissioner’s Office (ICO).
8. Marketing
If you subscribe, we send you newsletters and offers. We use Mailchimp as our email- marketing service provider; if you subscribe to our newsletter, your contact details may be processed by Mailchimp on our behalf in accordance with applicable data-protection laws. You can unsubscribe at any time via the link in any email or by contacting us. Unsubscribing from marketing does not stop essential service messages about a purchase.
9. Cookies and analytics
The Site uses essential cookies for core functionality, including security, basic preferences, language selection and currency selection. These cookies are necessary for the Site to work properly and do not require consent. We use Plausible Analytics to understand how visitors use the Site in a privacy-friendly way. Plausible does not use cookies, does not create personal profiles, and does not track visitors across websites. We do not use Google Analytics, advertising cookies, remarketing tools or social-media tracking pixels. Where required, we ask for your consent before setting any non-essential cookies. You can manage or withdraw your preferences through our cookie banner or through your browser settings. The main cookies and similar technologies used are:
| Cookie / technology | Purpose | Type | Typical duration |
|---|---|---|---|
| Session / functional cookie | Keeps the Site working as you browse, including security and basic functionality | Essential | Session – up to 12 months |
| Cookie-consent cookie | Remembers your cookie choices | Essential | Up to 12 months |
| Language preference cookie | Remembers your preferred language | Essential / preference | Up to 12 months |
| Currency preference cookie | Remembers your preferred display currency | Essential / preference | Up to 12 months |
| Plausible Analytics | Provides anonymous, aggregated website statistics without cookies or cross-site tracking | Privacy-friendly analytics | No cookie set |
This cookie list reflects the main cookies used on the Site and may be updated from time to time to reflect changes in our services.
10. Children
The Site and our sales are intended for adults (18+). We do not knowingly collect data from children.
11. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit. No online transmission is ever completely secure, so we cannot guarantee absolute security, but we work to protect your information and to notify you and the authorities of any breach where the law requires.
12. Changes
We may update this policy; the version posted here is the current one, with the “last updated” date shown above. Material changes will be flagged on the Site.
13. Contact
Questions or requests: [email protected], or by post to Composition LLC, Liberty Square 1 (entrance Leonidze 2a, space 7), 0105 Sololaki, Georgia (country).