Wetterling Gallery has represented artists and placed works with collectors since 1978. Doing so means holding information about the people we deal with: visitors to this website, subscribers to our newsletter, collectors, artists, lenders, and the owners who consign works to us. This policy sets out what we hold, why we hold it, who else sees it, and what you can ask us to do about it.
Who we are
Wetterling Gallery AB is the controller of the personal data described here.
Wetterling Gallery AB Nybrogatan 20, 114 39 Stockholm, Sweden Corporate identity number 556572-1890 · VAT SE556572189001 info@wetterlinggallery.com · +46 8 10 10 09
A gallery of our size is not required to appoint a data protection officer, and we have not appointed one. Data protection questions are handled by the gallery directly and reach us at the address above; marking your message "Data protection" will get it to the right person faster.
What this policy covers
It covers this website, our mailing list, enquiries you send us, your visit to the gallery at Nybrogatan 20, and our work in selling, consigning and advising on works of art.
Our editions shop at shop.wetterlinggallery.com runs on a separate platform provided by Shopify and is governed by its own privacy notice. The section Purchases from our editions shop below explains our part in that.
What we hold, why, and for how long
| What we process | Why | Lawful basis | How long we keep it |
|---|---|---|---|
| Website usage — IP address, browser and device type, pages viewed, referring site, and the cookie identifiers described in our Cookie Policy | To serve the site, to keep it secure, to diagnose faults, and — only if you allow it — to understand which pages are worth keeping | Consent for analytics and any non-essential cookie (Art. 6(1)(a)); our legitimate interest in a site that works and is not abused, for security and error logs (Art. 6(1)(f)) | Google deletes the analytics records for our property on a 14-month schedule. Technical error and security logs are held by our platform provider for no longer than 12 months |
| Enquiries — your name, email address, telephone number, and whatever you write to us, whether through the contact form, by email, or by telephone | To answer you, and to take the steps you have asked for before any agreement between us | Steps taken at your request before entering a contract (Art. 6(1)(b)); otherwise our legitimate interest in responding to people who contact us (Art. 6(1)(f)) | 24 months after our last exchange, unless it becomes part of a client record |
| Newsletter — your first name, last name, email address, the interests you select, and whether our emails were opened or their links followed | To send you news of exhibitions, artists and available works, and to see in the aggregate whether those emails are worth sending | Your consent (Art. 6(1)(a)), as required for electronic direct marketing by section 19 of the Swedish Marketing Act (2008:486). That consent covers the open and click measurement described in The newsletter below | Until you unsubscribe or otherwise withdraw consent, after which we keep a minimal record of the withdrawal so that we do not write to you again by mistake |
| Collector and client records — contact details, the artists and works you have shown an interest in, works viewed or reserved, correspondence, and purchase history | To maintain a working relationship: to offer you works we think you will want to see, and to keep track of what we have discussed | Performance of our contract with you (Art. 6(1)(b)); our legitimate interest in maintaining relationships with the people we do business with (Art. 6(1)(f)) | For as long as the relationship is live, and reviewed every three years of silence. Accounting records within the file follow the seven-year rule below |
| Sales, consignment and delivery — identity and contact details, invoicing and bank details, ownership and provenance information, condition and insurance valuations, shipping, export and customs documentation | To buy, sell, consign, insure, ship and export works of art, and to keep the accounts | Performance of our contract with you (Art. 6(1)(b)); compliance with tax and accounting law (Art. 6(1)(c)) | Until the end of the seventh year after the calendar year in which the financial year ended, as required by chapter 7, section 2 of the Swedish Accounting Act (1999:1078) |
| Identity checks and anti-money-laundering — identity documents, date of birth, nationality, beneficial ownership, source of funds and source of wealth, and the results of sanctions and politically-exposed-person screening | Because the law requires it of us. See Identity checks below | A legal obligation to which we are subject (Art. 6(1)(c)); for screening results touching on criminal matters, processing carried out under Union and Member State law within Art. 9(2)(g) and Art. 10 | Five years from the end of the business relationship or from the date of the transaction, as required by chapter 5, section 3 of the Swedish Money Laundering Act (2017:630) |
| Editions shop orders — name, billing and delivery address, email address, telephone number, order contents and payment confirmation | To take, fulfil and account for your order | Performance of our contract with you (Art. 6(1)(b)); tax and accounting law (Art. 6(1)(c)) | Seven years, as above. Card details are handled by Shopify's payment providers and never reach us |
| Photographs of exhibitions and events — images of the works, the installation and the rooms themselves, in which a visitor may occasionally appear in passing, used on this website, in press material and on our social media accounts | To record what an exhibition looked like and to show the gallery's programme | Our legitimate interest in documenting and communicating our own programme (Art. 6(1)(f)). We photograph the work, not the audience | Indefinitely, as part of the gallery's archive, subject to your right to object below |
| Camera surveillance at Nybrogatan 20 — recorded images of the entrance and the public rooms | To protect the works on display and the people in the building, and to establish what happened if something is damaged or taken | Our legitimate interest in the security of the premises and of the works in our care (Art. 6(1)(f)), carried out in accordance with the Swedish Camera Surveillance Act (2018:1200) | Overwritten on a rolling cycle and in any event within 30 days, unless a particular recording has been secured because of an incident |
Two notes on the last two rows. The cameras are signed at the entrance, as the law requires, and they cover the entrance and the public rooms only — not the office, and not anywhere a visitor would reasonably expect to be unobserved. Recordings are viewed only when there is a reason to, by the gallery's own staff, and are handed to the police only in connection with a reported incident.
As for exhibition photography, we are photographing the work rather than the audience. If you nonetheless find yourself recognisable in an image we have published, tell us and we will take it down.
Where the information comes from
Most of it comes from you: what you type into a form, write in an email, or tell us across the desk.
Some does not. When we are required to verify who we are dealing with, we consult public and commercial registers, sanctions and politically-exposed-person lists, and company records. When we establish the provenance of a work, we consult auction records, catalogues raisonnés, archives and stolen-art databases, which may name previous owners. And we receive enquiries forwarded to us by the platforms on which we list available works, principally Artsy, which pass on the contact details and message you gave them.
Do you have to give us any of it?
Browsing this site requires nothing of you. Analytics and other non-essential cookies are a choice, and refusing them changes nothing about what you can read or see here.
The forms are different only in the obvious way: we cannot answer an enquiry without a way to reply to it, and we cannot send a newsletter without an email address. The fields marked with an asterisk are the ones we need for that. Our contact form asks you to say yes or no to the newsletter before it will send; either answer is fine, and saying no has no effect on your enquiry.
Where the law requires us to verify who we are dealing with, the position is stricter, and it is set out next.
Identity checks
Trading in works of art at the values we deal in brings the gallery within the Swedish Money Laundering Act (2017:630). Where a transaction, or a series of connected transactions, reaches the equivalent of EUR 10,000, we are required to establish who our client is, to identify any beneficial owner behind a company or trust, to understand the source of the funds, and to screen the parties against sanctions and politically-exposed-person lists.
This is not optional and it is not something we can waive at a client's request. If you decline to provide what the law requires, we cannot complete the transaction.
Two consequences are worth stating plainly. The first is that these records must be kept for five years even if you ask us to erase everything else. The second is that where we are obliged to report a suspicion to the Financial Intelligence Unit of the Swedish Police Authority, the same Act forbids us from telling you that we have done so — so there are, in narrow circumstances, things we may not be able to disclose to you in answer to a request for access.
The newsletter
You join the mailing list by asking to, and you leave it by clicking unsubscribe at the foot of any issue. We do not add people who have merely bought something or walked through the door.
Our newsletter platform records whether an issue was opened and which links were followed. We use that to judge whether an issue was worth sending, and to group subscribers by the interests they have told us about. It is done to see what is read, not to build a picture of you, and no decision about you is taken by machine. If you would rather not be counted, most email programs let you block remote images, which prevents the open from registering.
Separately from the newsletter, if you have bought from us or dealt with us we may write to you individually about works we think you would want to know of. Swedish marketing law allows that between an existing client and a gallery for similar goods, and every such message gives you a plain way to tell us to stop. Tell us and we stop.
Who we share it with
We do not sell personal data, and we do not pass it to anyone for their own marketing.
| Recipient | What they do with it |
|---|---|
| Artlogic Media Limited (United Kingdom) | Hosts this website and the gallery's records system, and provides the error logging behind it. Our principal processor |
| Google Ireland Limited and Google LLC | Google Analytics, used only where you have allowed statistics cookies, and reCAPTCHA, which checks that form submissions come from a person rather than a script |
| Intuit Inc. / The Rocket Science Group LLC (Mailchimp) | Stores our subscriber list and sends the newsletter |
| Datadog, Inc. | Receives technical error and performance logs from the website, through Artlogic |
| Shippers, packers, framers, conservators and insurers | Receive the delivery and valuation details needed to move, treat or insure a work |
| Banks and payment providers | Process payments to and from the gallery |
| Our accountants, auditors and legal advisers | See what they need to see in order to advise us or to sign off the accounts |
| Shopify Inc. (Canada) | Operates the editions shop platform, including checkout and order records, on our behalf — and separately as a controller in its own right for the running of that platform |
| Public authorities | The Swedish Tax Agency, the Swedish Police Authority, customs authorities and the courts, where the law requires it of us |
Artlogic, Google, Mailchimp and Datadog act as our processors, each engaged under a written contract that confines them to acting on our instructions. Google is additionally a controller for its own purposes in operating Analytics and reCAPTCHA. The rest — shippers, insurers, banks, our accountants and advisers, and the authorities — decide for themselves how they handle what we give them, and answer for it under their own privacy notices.
If the gallery were ever sold or restructured, client records would pass to the acquirer as part of the business, and we would tell you before that happened.
Transfers outside the EEA
| Recipient | Where | On what basis |
|---|---|---|
| Artlogic Media Limited | United Kingdom | The European Commission's adequacy decision for the United Kingdom, renewed on 19 December 2025 and in force until 27 December 2031 |
| Google LLC | United States | Certification under the EU–U.S. Data Privacy Framework, with the Commission's standard contractual clauses as a fallback |
| Intuit Inc. / Mailchimp | United States | Certification under the EU–U.S. Data Privacy Framework, with the Commission's standard contractual clauses as a fallback |
| Datadog, Inc. | United States | The Commission's standard contractual clauses, through our contract with Artlogic |
| Shopify Inc. | Canada, with processing in the United States | The European Commission's adequacy decision for Canadian commercial organisations subject to PIPEDA, and standard contractual clauses for the United States |
Occasionally a sale sends information further afield — a collector in a third country, a shipping agent, an export licence. Where that happens and no adequacy decision covers the country in question, we rely on standard contractual clauses, or, for a specific transaction you have asked us to carry out, on Art. 49(1)(b) of the GDPR.
Ask us and we will send you a copy of the safeguards we rely on.
Your rights
You can ask us to give you a copy of the personal data we hold about you, to correct it if it is wrong, to complete it if it is partial, to erase it, to restrict what we do with it while a dispute is resolved, or to hand it to you or another controller in a machine-readable form.
You can object to any processing we carry out on the basis of legitimate interest — the exhibition photography and the camera recordings included — and we will stop unless we can show compelling grounds that override your rights. Where you object to direct marketing there is nothing to weigh: we stop.
Where we rely on your consent — for the newsletter, and for non-essential cookies — you can withdraw it whenever you like. Every newsletter carries an unsubscribe link, and cookie choices can be changed at any time through "Manage cookies" in the footer of this site. Withdrawing consent does not make what we did beforehand unlawful.
No decision about you is taken by automated means alone, and nothing we do produces a legal effect on you or anything comparable. We do group subscribers by the interests they have given us, and we do keep a note of the artists a collector follows, so that we write to people about things they care about — but that is a judgement made by the people who work here, not by a machine.
To exercise any of this, write to info@wetterlinggallery.com. We may need to confirm your identity before we act, particularly on a request for a copy of a client file. We will answer within one month, and if the request is complicated we will tell you within that month and take up to two months more. It costs nothing.
One limit is worth repeating. Erasure does not override a legal duty to retain: accounting records stay for seven years and anti-money-laundering records for five, whatever else we delete.
Complaints
If you think we have handled your data badly, tell us first — most things are quicker to fix directly. If that gets you nowhere, you can complain to the Swedish supervisory authority:
Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm imy@imy.se · +46 8 657 61 00 imy.se/en/individuals/forms-and-e-services/file-a-gdpr-complaint/
You may also take the matter to court.
Cookies
This site sets cookies, and asks before setting any that are not strictly necessary. What each category does, and what is actually stored, is set out in our Cookie Policy. You can change your mind at any time through "Manage cookies" in the footer.
Keeping it safe
The website is served over HTTPS. Access to the gallery's records is limited to the people who need it and protected by individual accounts and two-factor authentication. Our processors are contractually bound to appropriate security measures and we take that into account when choosing them. Identity documents collected for anti-money-laundering purposes are held separately from ordinary client records and seen by fewer people.
Nothing on the internet is perfectly secure, and we would rather say so than claim otherwise. If a breach occurred that put your rights at risk, we would tell you and the supervisory authority as the law requires.
Children
This site is meant for adults with an interest in art, and we do not aim any of it at children. Under Swedish law a child of thirteen or over can consent to an information society service in their own right, and below that age consent must come from a parent or guardian (chapter 2, section 4 of the Data Protection Act (2018:218)). If you believe a child has given us personal data, write to us and we will delete it.
Purchases from our editions shop
Our editions shop is hosted by Shopify. When you place an order there, Shopify collects your name, delivery and billing address, contact details and order contents on our behalf, and processes your payment through its own payment providers. Card numbers are handled by those providers and are never visible to the gallery.
We receive the order and the information needed to pack, ship and account for it. Shopify's own use of that data as a controller is described in Shopify's privacy policy.
Order records are kept for seven years under the Accounting Act, as with any other sale.
Changes
We update this policy when what we do changes, or when the law does. The current version is always the one on this page, and the date below tells you when it last moved. If a change materially affects how we use data we already hold, we will say so rather than let you find it.
Last updated: 23 July 2026.