Privacy policy

As of: 8 November 2026

1. Controller

Executionists, trading as “Mie Gallery”
12773 Caswell Avenue, #104, Los Angeles, CA 90066, USA
Email: info@miegallery.com · Phone: +1 310 435 7452

EU representative (Art. 27 GDPR)
Executionists, trading as “Mie Gallery”, has appointed the following representative in the European Union under Art. 27 of the General Data Protection Regulation (GDPR):

Cloudkasten GmbH
Seestr. 20 G
50374 Erftstadt, Germany
Email: shopify-9576022094@rep4.eu
Verify the appointment: https://rep4.eu/verify/bd3b3b4d-2e93-4e93-afad-a51f7607087f/

Data subjects resident in the EU can contact our EU representative on all questions about the processing of their personal data and about exercising their rights under the GDPR.

2. Overview

This notice applies to our website for customers in Germany, miegallery.com/de-de (German) and miegallery.com/en-de (English), and to our German-language social network profiles (section 11). We process personal data only as far as necessary to run the website, process your order, answer your enquiries, present our offer on social networks, or on the basis of your consent.

We are based in the USA and process your data there. When you give us your data directly, that alone is not a transfer to a third country within the meaning of Chapter V GDPR. When we pass your data on to other recipients outside the EU, that can be such a transfer, even if the recipient is also in the USA. The GDPR applies to our processing of your data because this offer is directed at customers in Germany.

Recipients outside the EU and basis of the transfer.

  • Shopify Inc., Canada (shop system, section 3): for Canadian organisations within the scope of the Canadian data protection law PIPEDA, there is an adequacy decision of the European Commission. Shopify also processes data in other countries. Shopify's data processing addendum provides binding corporate rules for certain transfers within the Shopify group and the European Commission's standard contractual clauses for other transfers (shopify.com/legal/dpa).
  • United Parcel Service (UPS) and United States Postal Service (USPS), USA (shipping, section 6): passing on your name, address and contact details is necessary to deliver your order (Art. 49(1)(b) GDPR).
  • Google LLC, USA (our mailbox info@miegallery.com and reCAPTCHA, section 8; statistics and advertising, section 10; YouTube videos, section 11), Meta Platforms, Inc., USA (sections 10 and 11), Pinterest, Inc., USA (section 11), Buffer, Inc., USA (section 11), Intuition Machines, Inc. (hCaptcha), USA (section 8) and Fly.io, Inc. and Twilio Inc. (SendGrid), USA as service providers of Visionz GmbH (section 8): according to their own statements, these companies are certified under the EU-U.S. Data Privacy Framework, for which there is an adequacy decision of the European Commission.

On request to info@miegallery.com you receive a copy of the safeguards or information on where they are available.

3. Hosting and shop system

Our website runs on the Shopify platform. Our contracting party is Shopify Inc., 151 O'Connor Street, Ottawa, Ontario, Canada. Shopify processes the data on our behalf (Art. 28 GDPR). If you use Shop Pay, Shopify processes your data to that extent as a controller in its own right. When you visit the website, technically necessary data is processed, such as IP address, date and time of access, pages visited, browser and operating system. The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR).

4. Cookies and consent

We use technically necessary cookies, for example for the cart and the language setting, without consent (§ 25(2) no. 2 TDDDG). We use all other cookies and similar technologies, in particular for statistics and advertising, only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You give it through our cookie banner. You can withdraw your consent at any time with effect for the future through the “Cookie preferences” link at the bottom of every page. For YouTube videos, see section 11.

5. Orders and payment

When you order, we process the details from checkout: name, delivery and billing address, email address, phone number, the prints ordered and the payment information. The legal basis is the performance of your order (Art. 6(1)(b) GDPR). Providing this data is necessary for the order; without it we cannot carry out your order.

Payment is processed through Shopify Payments. Your payment data (e.g. card details) is processed by Shopify and the payment service providers Shopify uses; we do not receive full card details. Technical data such as the IP address may be checked for fraud prevention (Art. 6(1)(f) GDPR). If you use Apple Pay, Google Pay or Shop Pay, the privacy terms of those providers also apply.

How long we keep the order data is set out in section 12.

6. Shipping and customs clearance

For delivery, we pass your name, delivery address, email address and phone number to the carrier we use: United Parcel Service (UPS) or the United States Postal Service (USPS), which hands the parcel over to Deutsche Post or DHL in Germany. The legal basis is the performance of your order (Art. 6(1)(b) GDPR) and our legitimate interest in delivery (Art. 6(1)(f) GDPR).

Because your order is imported from the USA, the shipping documents contain the details needed for the customs declaration (name and address of the recipient, description and value of the goods). These are transmitted to the customs authorities through the carrier (Art. 6(1)(b) and (c) GDPR).

7. Customer account

If you create a customer account, we store your details and orders so that you can view them. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time by emailing info@miegallery.com.

8. Contact by email or form

When you write to us, we process your details to answer your enquiry (Art. 6(1)(f) GDPR; for enquiries about an order, also Art. 6(1)(b) GDPR). To protect against spam, Shopify uses a captcha service on forms (Google reCAPTCHA or hCaptcha). Technical data such as the IP address is transmitted to the provider (Art. 6(1)(f) GDPR).

Withdrawal through our online form. If you withdraw from your contract using the “Withdraw from contract” function, we process your name, your email address, your order number, the related order data (items ordered and address) and, if given, your reason for withdrawal and the time of receipt, in order to process the withdrawal and acknowledge its receipt (Art. 6(1)(b) and (c) GDPR in conjunction with § 356a BGB). For this function we use the “EU Widerrufsbutton” app of Visionz GmbH, Richthofenstr. 29, 31137 Hildesheim, Germany, which processes the data on our behalf (Art. 28 GDPR). Visionz uses further service providers for this: Fly.io, Inc. for hosting, and Brevo SAS (France) and, as a fallback, Twilio SendGrid (USA) for sending email. Data may be transferred to the USA in the process.

9. Newsletter

If you sign up for our newsletter, we use your email address to send you news about our prints. The legal basis is your consent (Art. 6(1)(a) GDPR). After signing up you receive an email asking you to confirm your sign-up (double opt-in). We send you the newsletter only after you confirm. You can unsubscribe at any time through the unsubscribe link in every email.

10. Statistics and advertising (only with consent)

Shopify analytics. Shopify records for us how the website is used, for example the pages visited and where visits come from.

Google Analytics and Google Ads. We use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. They measure the use of the website and the success of advertising. Data may be transferred to Google LLC in the USA in the process. Google LLC is certified under the EU-US Data Privacy Framework.

Meta pixel. We use the pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It measures the success of our advertising on Facebook and Instagram. We are jointly responsible with Meta for collecting the data on our website (Art. 26 GDPR). Data may be transferred to Meta Platforms, Inc. in the USA in the process. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.

These services are loaded only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Wishlist. With the “Add to wishlist” function you can save prints for later. For this we use the “Wishlist by Square” app of Square Apps (Appsolve, Grigore Mora 11, 011885 Bucharest, Romania). The saved prints are stored in your browser and, if you are signed in, in your customer account; technical data such as the IP address is transmitted to the provider. Storage takes place only if you use the function yourself (§ 25(2) no. 2 TDDDG). The legal basis is our legitimate interest in a convenient wishlist function (Art. 6(1)(f) GDPR).

11. Social networks

Links on our website. Our website contains links to our profiles on Facebook, Instagram and Pinterest and to YouTube. These are plain links. No data is transferred until you click a link and open the network.

YouTube videos on our website. On some product pages you can play YouTube videos, through the “Video Summary” button or in the image gallery. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The video player is loaded only when you choose or start a video; before that, no data is transferred to YouTube. After that, Google receives in particular your IP address, information about our page on which the video is embedded, and technical details of your browser, and YouTube may store and read cookies or similar technologies on your device. For the “Video Summary” button we use YouTube’s privacy-enhanced mode (youtube-nocookie.com); according to Google, it prevents watching the video from personalising your YouTube experience and the ads shown to you, but it does not prevent your data from being sent to Google. Data may be transferred to Google LLC in the USA (section 2). In our blog posts, videos are only linked, not embedded.

The legal basis is our legitimate interest in showing you videos about our prints when you ask for them (Art. 6(1)(f) GDPR). The player is loaded only when you expressly request a video (Section 25(2) No. 2 TDDDG). You can object to this processing (section 13), most simply by not playing videos.

We are jointly responsible with Google for collecting your data when the player loads and for transmitting it to Google (Art. 26 GDPR; CJEU, judgment of 29 July 2019, C-40/17). Google alone is responsible for the subsequent processing; Google decides itself which data it processes and for what purposes: policies.google.com/privacy. We have no agreement under Art. 26 GDPR for this. You can exercise your rights (section 13) against us and against Google.

Our profiles. We also present prints from our shop on our German-language profiles:

  • Facebook: “Mie Gallery Deutschland”, facebook.com/people/Mie-Gallery-Deutschland/61596182692562/
  • Instagram: instagram.com/miegalleryde
  • Pinterest: pinterest.com/miegalleryde

The networks are operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Facebook and Instagram), and by Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland, together with Pinterest, Inc., USA (Pinterest).

When you visit our profiles or interact with our posts, for example by liking, commenting, sharing, saving or following, the operator processes your data. This applies even if you have no account there or are not logged in. The operator itself decides which data this is and what it uses it for. Details are in its privacy policy: facebook.com/privacy/policy, privacycenter.instagram.com/policy and policy.pinterest.com/en/privacy-policy.

Statistics. The operators give us statistics on the use of our profiles, such as reach and interactions, and the location (country or city), age group and gender of visitors in aggregated form. From these we cannot tell who individual visitors are. We can see what you make visible yourself, such as your comments, that you liked a post or that you follow our profile; Pinterest also shows us the public boards a Pin was saved to, from which the saving account may be identifiable.

We are joint controllers with Meta for the processing of personal data used to produce Facebook Page statistics (Art. 26 GDPR). Meta has published an agreement under which Meta Platforms Ireland Limited assumes responsibility for compliance with the GDPR obligations applicable to this processing: facebook.com/legal/terms/page_controller_addendum. We also assume joint controllership for the processing used to produce Instagram and Pinterest statistics; we have no corresponding agreement for that processing.

Messages and comments. If you write to us through one of these networks, we process your details to reply (Art. 6(1)(f) GDPR; for questions about an order, also Art. 6(1)(b) GDPR). For questions about an order, it is best to email us at info@miegallery.com.

Buffer. We schedule and publish our posts with the Buffer service of Buffer, Inc., San Francisco, USA. Through its connection to our Facebook Page, Buffer also retrieves for us the comments on our posts (with the commenter's name and profile) and the Page statistics and processes this data on our behalf (Art. 28 GDPR). For transfers to the USA, see section 2.

Legal basis. We run these profiles to present our prints where interested people look for them and to stay in contact with them. The legal basis is this legitimate interest (Art. 6(1)(f) GDPR). Where an operator asks for your consent, for example for cookies, the legal basis is that consent (Art. 6(1)(a) GDPR); you can withdraw it with the operator.

Links in our posts. Links in our posts carry a campaign tag (e.g. “utm_source=facebook”) that tells us which network a visit to our website came from. It contains no information about you. It is evaluated only with your consent, by the statistics services in section 10.

Transfers to the USA. The operators may transfer your data to Meta Platforms, Inc. or Pinterest, Inc. in the USA. Both state that they are certified under the EU-US Data Privacy Framework (section 2).

Storage period. Posts, comments and messages stay on the network until they are deleted. The operator may keep data beyond that for its own purposes; its privacy policy governs its retention, including of the statistics data. We make no copies of our own outside the networks; however, Buffer holds the comments on our Facebook posts for us (see above). If we continue handling your enquiry by email, section 12 applies.

Your rights. You can exercise your rights (section 13) with us and with the operator. You may object to processing based on our legitimate interest (section 13). Because only the operator has access to the full data, a request to the operator is usually the most effective. We forward requests about Facebook statistics that reach us to Meta. Meta: help.meta.com/support/privacy (privacy rights requests). Pinterest: help.pinterest.com/data-protection-officer-contact-form.

12. Retention periods

We store order, customer and account data only in our shop on the Shopify platform; we do not keep our own copies outside it. We delete or anonymise this data seven years after your last order, or, for a customer account without an order, seven years after it was created. The period is based on the tax record-keeping periods in the USA. At your request we delete your data earlier, unless a statutory retention obligation prevents this.

We delete emails to info@miegallery.com, including a withdrawal declared by email, seven years after the enquiry concerned has been closed.

The Visionz GmbH app for withdrawal via our online form deletes the withdrawal data once the withdrawal has been fully processed and statutory retention periods have expired.

We keep your email address for the newsletter until you unsubscribe.

Shopify, Google and Meta store technical access data (section 3), statistics and advertising data (section 10) and data from playing YouTube videos (section 11) according to their own periods; we do not keep our own copies of them.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent you have given at any time with effect for the future (Art. 7(3)). To do so, write to us at info@miegallery.com or to our representative in the EU.

Right to object. Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to that processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons (Art. 21(2) GDPR). To do so, write to us at info@miegallery.com or to our representative in the EU.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).