The protection of your personal data is important to us. We process your personal data confidentially and in accordance with the applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (Datenschutzgesetz – DSG) and, where applicable, the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021 – TKG 2021).This Privacy Policy explains what personal data we collect when you visit and use this website, how and why we process such data, and what rights you have in relation to your personal data.Personal data means any information relating to an identified or identifiable natural person, such as a name, email address, IP address or other information that can be associated with an individual.
2. Controller
The controller responsible for the processing of personal data on this website is:Mag. Thomas Baboujian BASE AT4 Kunsthandel St. Ulrichs-Platz 6 1070 Vienna AustriaPhone: +43 (0) 664 223 60 60 Email: tba@baseat4.comThe controller determines, alone or jointly with others, the purposes and means of processing personal data.
3. General Information on Data Processing
Legal Bases
Depending on the relevant processing activity, we process personal data on the following legal bases:Art. 6(1)(a) GDPR – where you have given your consent;Art. 6(1)(b) GDPR – where processing is necessary for the performance of a contract or in order to take steps at your request prior to entering into a contract;Art. 6(1)(c) GDPR – where processing is necessary for compliance with a legal obligation;Art. 6(1)(f) GDPR – where processing is necessary for the purposes of our legitimate interests or those of a third party and such interests are not overridden by your interests or fundamental rights and freedoms.Where the storage of information on your device or access to information already stored on your device requires consent, such consent is obtained in accordance with Section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021).You may withdraw any consent you have given at any time with effect for the future.
Storage Period
Unless a specific storage period is stated in this Privacy Policy, we retain personal data only for as long as necessary for the purpose for which it was collected.Data may be retained for a longer period where this is required by statutory retention obligations or where retention is necessary for the establishment, exercise or defence of legal claims.Once the relevant purpose or legal basis no longer applies and no statutory retention obligation exists, the data will be deleted.
Recipients of Personal Data
In the course of operating this website and conducting our business, we may use external service providers that process personal data on our behalf or receive personal data where this is necessary for the provision of their services.Where required by law, appropriate data processing agreements are concluded with such providers.We disclose personal data only where there is a valid legal basis for doing so.
4. Hosting and Squarespace
This website is created and hosted using services provided by Squarespace Ireland Ltd., Le Pole House, Ship Street Great, Dublin 8, Ireland (“Squarespace”).When you visit this website, Squarespace may process technical information required to provide and secure the website. Depending on the configuration of the website, this may include information such as your IP address, browser and device information, the pages you visit, timestamps and other technical information.Squarespace may use necessary cookies and similar technologies to ensure the secure and proper operation of the website.The processing of data necessary to provide and secure the website is based on our legitimate interest in operating a secure, reliable and functional website pursuant to Art. 6(1)(f) GDPR.Where non-essential analytics, performance or similar technologies are used, these are activated only on the basis of your consent, where such consent is legally required, pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021.Squarespace may process data outside the European Economic Area, including in the United States. Where personal data is transferred internationally, Squarespace states that it uses appropriate safeguards for such transfers, including mechanisms recognised under applicable data protection law.Further information about Squarespace's processing of personal data can be found in Squarespace's Privacy Policy and data protection information.
5. Server Log and Technical Data
When you access this website, technical information may automatically be transmitted by your browser and processed by our hosting provider.This may include:IP address;browser type and browser version;operating system;referring website;pages or resources accessed;date and time of access; andother technical information required to establish and secure the connection.This data is processed in order to provide the website, ensure its technical stability and security, and detect or prevent misuse.The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, reliable and technically correct operation of our website.
6. Cookies and Similar Technologies
This website uses cookies and similar technologies.Cookies are small files or pieces of information that may be stored on your device when you visit a website. They may be required for the website to function correctly or may be used for purposes such as analytics or remembering preferences.
Necessary Cookies
Certain cookies and similar technologies are technically necessary for the website to function and for services expressly requested by you to be provided.These may be used without prior consent where the requirements of Section 165(3) TKG 2021 are met.
Non-Essential Cookies
Cookies and similar technologies that are not technically necessary, including certain analytics or performance technologies, are used only after obtaining your consent where required by law.The legal basis for accessing or storing information on your device is Section 165(3) TKG 2021. Where personal data is processed in connection with these technologies, the legal basis is Art. 6(1)(a) GDPR.You may withdraw your consent at any time with effect for the future through the cookie settings available on this website.You may also configure your browser to restrict or block cookies. Please note that disabling necessary cookies may affect the functionality of the website.The specific cookies used may depend on the Squarespace features and third-party integrations currently active on this website.
7. Squarespace Analytics
This website may use Squarespace Analytics to obtain information about website traffic and how visitors interact with the website.Depending on the settings and your consent choices, analytics data may include information about:your browser, network and device;your IP address;pages visited;referring websites;clicks and internal links;searches;scrolling activity; andtimestamps.We use this information to understand how our website is used and to improve its content, functionality and performance.Where Squarespace Analytics requires the use of non-essential cookies or similar technologies, these technologies are used only after your consent has been obtained.The legal basis is Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 165(3) TKG 2021.You may withdraw your consent at any time through the cookie settings available on this website.
8. Contacting Us
If you contact us by email, telephone or through a contact form on this website, we process the information you provide in order to respond to your inquiry and communicate with you.This may include your name, email address, telephone number, the content of your message and any other information you voluntarily provide.If your inquiry relates to a purchase, potential purchase or another contractual relationship, processing is based on Art. 6(1)(b) GDPR.For other inquiries, processing is based on our legitimate interest in responding to communications addressed to us pursuant to Art. 6(1)(f) GDPR.We retain correspondence only for as long as necessary for the relevant purpose, subject to statutory retention requirements and the need to establish, exercise or defend legal claims.
9. Newsletter
You may subscribe to our newsletter in order to receive information about BASE AT4, including upcoming exhibitions, events and gallery news.For this purpose, we process your email address and any additional information you voluntarily provide when subscribing.The processing of your data for newsletter purposes is based on your consent pursuant to Art. 6(1)(a) GDPR.You may withdraw your consent and unsubscribe from the newsletter at any time, in particular by using the unsubscribe link included in our newsletters.Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.Your data will be stored for newsletter purposes until you unsubscribe or until the purpose of processing otherwise ceases to apply, subject to any data that may need to be retained to demonstrate compliance with legal requirements.We do not sell your newsletter data to third parties.
10. Instagram and Social Media
This website may contain links to, or content and functions from, Instagram.Instagram is operated in Europe by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.If Instagram content or functions are directly embedded into this website, a connection to Meta's servers may be established when the relevant content is loaded. Meta may thereby receive information including your IP address and information about your visit to this website.If you are logged into an Instagram or Meta account, Meta may be able to associate your interaction with your account.Where an Instagram integration requires the storage of or access to information on your device, or otherwise involves processing requiring consent, it will be activated only after you have given your consent.In such cases, processing is based on Art. 6(1)(a) GDPR and Section 165(3) TKG 2021.You may withdraw your consent at any time with effect for the future.If this website only provides an ordinary link to our Instagram profile and no Instagram content is loaded directly on the website, data is generally transferred to Meta only when you follow that link.Further information about Meta's processing of personal data can be found in Meta's and Instagram's privacy information.
11. Google Fonts
This website may use Google Fonts for the consistent presentation of typography.Depending on the technical configuration of the website, fonts may either be provided locally or loaded from servers operated by Google.If Google Fonts are loaded directly from Google servers, your browser establishes a connection to Google and technical data, including your IP address, may be transmitted.Where such processing or access requires consent, Google Fonts will be loaded only after you have given your consent pursuant to Art. 6(1)(a) GDPR and Section 165(3) TKG 2021.If the fonts are hosted locally or are provided entirely through the website platform without a direct connection from your browser to Google, no such direct transfer to Google takes place merely for displaying the font.
12. Data Transfers Outside the European Economic Area
Some of the service providers used in connection with this website may process personal data outside the European Economic Area (EEA), in particular in the United States.Where personal data is transferred to a country outside the EEA, we or the relevant service provider ensure that an appropriate legal mechanism is available for the transfer as required under Chapter V GDPR.Depending on the recipient and circumstances, this may include an adequacy decision by the European Commission, participation in the EU-U.S. Data Privacy Framework where applicable, or the European Commission's Standard Contractual Clauses together with any additional safeguards required.
13. SSL/TLS Encryption
This website uses SSL/TLS encryption for security purposes and to protect confidential information transmitted between your browser and our website.You can generally recognise an encrypted connection by the “https://” prefix and the lock symbol displayed in your browser.Please note that no method of transmitting information over the internet can guarantee absolute security.
14. Your Rights Under the GDPR
Subject to the applicable legal requirements, you have the following rights regarding your personal data:Right of access pursuant to Art. 15 GDPR;Right to rectification pursuant to Art. 16 GDPR;Right to erasure pursuant to Art. 17 GDPR;Right to restriction of processing pursuant to Art. 18 GDPR;Right to data portability pursuant to Art. 20 GDPR;Right to object pursuant to Art. 21 GDPR; andRight to withdraw consent at any time where processing is based on your consent.You also have the right to lodge a complaint with a competent data protection supervisory authority.In Austria, the competent supervisory authority is:Austrian Data Protection Authority (Österreichische Datenschutzbehörde) Barichgasse 40–42 1030 Vienna AustriaIf you have questions about the processing of your personal data or wish to exercise your rights, you can contact us at:tba@baseat4.com
15. Right to Object
Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data.We will then cease processing the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for such purposes. If you object, your personal data will no longer be processed for direct marketing purposes.
16. Changes to This Privacy Policy
We may update this Privacy Policy where necessary, for example if the functionality of this website, the services we use or applicable legal requirements change.The version published on this website is the current version.Last updated: August 2026
