Privacy & cookies

YOUR VISIT · YOUR PRIVACY

Privacy information

Updated 25 October 2026.

Controller & contact

Michael Allmaier, Georg-Schumann-Straße 55, 04155 Leipzig, Germany. Email: info@michaelallmaier.de.

Shared gallery room

Your chosen display name, avatar type, position, direction and seated state are transmitted to our one.com server and shared with people in the same room. No account or real name is required. A technical session cookie and a random per-tab identifier associate your requests with your own visitor. Inactive avatars expire after approximately 45 seconds. Closing the page also requests removal.

Room messages and moderation

Messages you submit are visible to everyone in the room. Please do not post personal or confidential information. The room retains at most 100 messages for up to 20 minutes. Expired records are removed on subsequent room activity. You may mute a visitor locally for the current visit. Reported messages, reporter identifiers and timestamps are kept separately for up to seven days for review, with expired reports removed on subsequent room activity. Muting does not delete another visitor's messages for everyone.

Website delivery and browser storage

one.com hosts this website. Optional gallery caching is off until you select “Allow gallery cache”. If you allow it, public gallery code and images are saved on this device to speed up later visits. Choose “Necessary only” under “Privacy & cookies” to withdraw this permission and remove the optional gallery cache. Your choice is remembered for up to six months. Necessary session cookies, visitor session storage and shopping-basket storage support the services you request; they do not enable advertising or analytics. Chat responses and payment API responses are not added to that offline cache. Your browser may retain its own technical cache and session data until you clear it. This gallery does not add advertising or analytics trackers. Hosting access-log details and retention depend on the one.com hosting service.

Virtual café payments

PayPal processes real EUR payments for virtual café items. The gallery keeps the order reference, selected item, amount, payment state and PayPal transaction references to verify and fulfil the purchase. Your payment credentials are entered at PayPal, not in the gallery. PayPal's own privacy information applies to its payment service. The virtual item is supplied only after the server verifies the payment. Purchase records are separate from the short-lived room conversation.

Email enquiries and your rights

We use information you send by email to answer your enquiry and meet applicable record-keeping duties. Contact the controller to request access, correction, deletion, restriction, portability or to object to processing, subject to applicable law. You may also contact the Saxon Data Protection and Transparency Commissioner.

Card payments through Stripe

If you choose card payment, Stripe processes the information required to complete the payment. For physical prints, this includes your billing and delivery details. The gallery receives confirmation and the order information needed for fulfilment; it does not store your full card number. See Stripe’s privacy information.

Purposes and legal bases

Delivering and protecting this website, preventing misuse and moderating public contributions serve our legitimate interests under Article 6(1)(f) GDPR. Data necessary for the gallery functions or purchases you request is processed under Article 6(1)(b) GDPR; legally required records are processed under Article 6(1)(c). Optional browser caching is enabled only with your consent under Section 25(1) TDDDG and, where applicable, Article 6(1)(a) GDPR. Strictly necessary device storage is covered by Section 25(2)(2) TDDDG. Consent to optional storage is not required to visit the gallery.

Hosting and technical requests

When a page or file is requested, technical connection data such as your IP address, request time, requested address and browser information is transmitted to the hosting service to deliver and protect the website. one.com provides hosting infrastructure and processes hosted personal data as a service provider. Log retention and security-backup cycles follow the applicable hosting configuration and contract; contact us for information about the records relevant to your request. We do not use these requests to create advertising profiles. See one.com privacy information.

Guestbook and patrons’ wall

Submitting a guestbook entry publishes your text and chosen signature to gallery visitors. A technical session-derived identifier and submission reference support moderation and duplicate prevention. Entries are not subject to the room chat’s 20-minute expiry; they remain until removed or until the guestbook is discontinued. Contact us to request removal. Only the latest 100 approved entries are shown, which does not mean older entries have been deleted. Patrons’ chosen names are displayed only if public display was requested, for one month from confirmed payment. Contribution amounts are not published.

Purchases and contact requests

For a requested purchase, we process the order contents, contact and delivery details where needed, amounts, transaction references and payment status to fulfil the order and handle support. Records are retained while needed for fulfilment, support or legal claims and for applicable tax and commercial retention duties. Information sent by email is retained while needed to answer the enquiry and meet applicable duties. Optional contributions and purchases are separate from cookie choices.

Recipients, external links and international processing

Other visitors receive only the profile state and public messages described above, not your payment credentials. Hosting, payment, and any printing or delivery provider receive the information necessary for their task. External websites such as 1x, Instagram, PayPal and Stripe receive connection information when you follow their links or use their checkout; their services may process data outside the European Economic Area. The applicable provider privacy information describes locations and transfer safeguards. The gallery does not embed advertising, analytics or social-media tracking scripts. PayPal information is available in its Privacy Statement.

Choices and rights

You can withdraw optional cache consent at any time through “Privacy & cookies”, as easily as giving it. This does not affect earlier lawful processing. You may object to processing based on legitimate interests for reasons relating to your situation. Access, correction, deletion, restriction and portability rights apply as provided by GDPR. You may complain to the supervisory authority linked above. A real name is not required to visit. Public chat and guestbook use is voluntary; checkout details are required only for the purchase you request. We do not make automated decisions producing legal or similarly significant effects on visitors.

Optional artwork viewing statistics

Only with your separate permission, the gallery measures estimated viewing time while you remain nearly still with a photograph at the centre of your view for at least three seconds. This is not eye tracking. Background tabs, open dialogs and idle periods after 60 seconds are excluded. We keep only cumulative viewing counts and total seconds per artwork on our one.com server, without names, visitor identifiers, IP addresses or individual viewing histories in the statistics file. Technical hosting and session processing described elsewhere still applies. Aggregate totals are retained until the exhibition statistics are reset. Your separate local preference (ma-art-statistics-v1) expires after 183 days. You can withdraw at any time under Privacy & cookies. Processing and optional device access rely on Article 6(1)(a) GDPR and Section 25(1) TDDDG. Previously accumulated totals cannot be attributed to a person.