Privacy policy

This policy explains what personal data Artshoppy collects, why, who sees it, how long it is kept, and what you can ask the gallery to do with it. It describes what this website actually does.

Who is responsible

Bizarre Mart Private Limited, Kolkata, trading as Artshoppy, decides how your personal data is used. Under India's Digital Personal Data Protection Act, 2023 the company is the data fiduciary.

  • Address: Ground Floor, 34/1G Ballygunge Circular Road, Kolkata 700019, West Bengal, India
  • Privacy contact: support@artshoppy.com; requests are handled by Jishu Bhowmik, the grievance officer.
  • Grievance officer: Jishu Bhowmik, +91 99039 71710, support@artshoppy.com. Complaints are acknowledged within 48 hours and resolved within one month.

When you browse

  • Cookies needed for the site to work. The site sets cookies that keep your session, remember what is in your cart and protect forms against forgery. They are needed to buy anything, and they do not follow you to other websites.
  • The gallery's own visit record. The site keeps its own record of how visitors find and use it: what brought you here (the name of the site that linked to us and any campaign tags in the link, such as those on a link someone shared), the first page you opened, which pages you shared and where, and whether an enquiry, an account or an order followed. A cookie called artshoppy_vid, holding a random number, links these steps on your browser. The record stays on the gallery's own server, is never sent to anyone else, and holds no IP address or browser details. A record that never leads to an enquiry, account or order is deleted after 90 days without a visit.
  • Your display preference. If you choose the light or evening theme, that choice is stored in your browser, not sent to us.
  • Server logs. Like every website, the servers record the IP address, browser and page of each request, to keep the site running and secure. The website is hosted by Cloudways on DigitalOcean servers in Bangalore, India; your data is stored in India. Logs are kept as Indian law requires — see "How long we keep it" below.
  • Google Analytics, only if you agree. On your first visit a banner asks whether the gallery may measure how the site is used. Only if you accept does your browser load Google Analytics 4. It tells the gallery which pages are visited, where visits come from, and when a page is shared, an enquiry is sent or an order is completed. If you decline, nothing is sent to Google and no analytics cookie is set. Your choice is stored in your browser. To change it, use Analytics settings at the foot of any page. The site uses no advertising pixels.

When you open an account

Your name, email address and a password, which is stored only in scrambled (hashed) form. Your account shows your orders, your addresses and the artists you follow. We use this to run your account and let you see your purchases.

When you place an order

Your name, delivery and billing addresses, phone number and email, what you bought and what you paid. Phone numbers are checked for the right format for your country. We use this to take payment, deliver the work, issue the invoice and certificate of authenticity, and meet tax and accounting law.

At present the only payment method is Cash on Delivery, so the website receives no card or bank details.

When you ask about a work

Ask about this work, Make an offer and Commission this artist open a form on this website. When you send it, the gallery stores on its own systems: your name, your email address, your telephone number if you give one (it is optional), your message, the work or artist you asked about, and — where you made an offer — the amount you offered and the asking price at the time. If you are signed in, the enquiry is linked to your account.

We also record the page you wrote from and the network (IP) address the message came from. The address is kept to stop automated abuse of the form and to limit how many enquiries one sender can make in an hour; it is not used to identify you or to build a profile.

We use all of this to reply to you and to arrange a sale if you go ahead. We keep an enquiry for as long as the gallery may need it to answer you and complete a sale — there is no automatic deletion — and you can ask us to delete yours at any time using the contact details above.

Sending an enquiry does not create an account and does not sign you up to anything.

You can still write to the gallery on WhatsApp instead. If you do, what you write goes to the gallery through WhatsApp rather than through this form, and we record only that the WhatsApp button was pressed and which work it was pressed from.

WhatsApp is operated by WhatsApp LLC (part of Meta). Messages you send through it are also subject to WhatsApp's own privacy policy.

When you follow an artist

We record which artists you follow, so that your account can list them and the gallery can tell you about new work by them. You can unfollow at any time.

Artists

If you are an artist with a profile, the gallery holds your name and contact details, and the biography and other details you have agreed to publish. A profile is published only with your consent. For artists the gallery works with, it also holds your PAN and bank details, used to pay you and to keep tax records.

  • To perform a contract with you, for accounts, orders, delivery, and replies to your enquiries.
  • Legal obligation, for invoices, tax and accounting records.
  • Legitimate uses permitted by law, for security and preventing fraud.
  • Your consent, for Google Analytics, which you can withdraw at any time.

Who we share it with

We do not sell personal data, and we do not share it for advertising.

  • Couriers, who need the delivery name, address and phone number: Delhivery for deliveries within India.
  • Customs authorities, in India and in your country, for an export: your name, address and the declared value.
  • Our hosting and email providers, who process data on our behalf. The website is hosted by Cloudways on DigitalOcean servers. Order and account emails are sent through Elastic Email (via Cloudways), which receives your name and email address to deliver them.
  • WhatsApp, if you choose to message us through it.
  • Google, only if you accept analytics. Google Analytics receives the pages you view and the events listed above, together with an identifier kept in a Google Analytics cookie. Google processes this under its own terms, which may involve servers outside India.
  • Authorities, where the law requires us to.

Where it is stored

Your data is stored in India, on Cloudways servers running on DigitalOcean in Bangalore. If you live outside India, your data is transferred to India, where the gallery is, and to wherever its providers are.

How long we keep it

  • Orders, invoices, payments and tax records (including artists' PAN and bank details): kept for as long as the Companies Act, 2013 and India's GST law require.
  • Accounts, enquiries and other personal data: kept only while needed for the purpose they were collected for, then deleted or anonymised, in line with the Digital Personal Data Protection Act, 2023. You can ask for deletion sooner using the contact above, except where the law requires the gallery to keep the record.
  • Server logs: kept as Indian law requires.
  • The visit record: deleted after 90 days without a visit, unless it led to an enquiry, account or order. In that case it is kept for as long as that record is.

No personal data from the gallery's previous website — customers, orders, enquiries or subscribers — was imported into this one.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask the gallery to:

  • tell you what personal data it holds about you and how it is used;
  • correct, complete or update it;
  • erase it, where it is no longer needed for the purpose or the law does not require us to keep it;
  • withdraw a consent you gave;
  • have a grievance about your data dealt with.

You can also nominate someone to exercise these rights for you if you die or cannot act.

If the gallery does not resolve your grievance, you may complain to the Data Protection Board of India.

To use any of these rights, write to the privacy contact above. Requests are acknowledged within 48 hours and completed within one month.

Children

The website is not for children. We do not knowingly collect personal data from anyone under 18, and an account or order should be made by an adult.

Security

Pages are served over an encrypted connection, and passwords are stored hashed. Within the gallery, access to customer data — including artists' PAN and bank details — is limited to the gallery's owner and to Jishu Bhowmik, the grievance officer. The gallery's service providers — Cloudways and DigitalOcean for hosting, Elastic Email for order and account emails, and Delhivery for delivery — also process data on the gallery's behalf, as described above.

Changes

When this policy changes, the new version is published here with its date. If a change affects how we use data you have already given us, we will tell you.

This version is effective from 30 September 2026.