Does GDPR apply to art galleries?

Yes. Collector names, contact details and purchase histories are personal data under GDPR. Any gallery in the EU — and any gallery worldwide selling to EU residents — must process that data lawfully, keep it secure, honor access and deletion requests, and sign data-processing agreements with its software vendors.

Why should gallery data be hosted in the EU?

EU hosting keeps personal data under GDPR jurisdiction and EU court oversight, simplifies compliance (no transfer-impact assessments needed for routine storage), reduces latency for European collectors and staff, and signals professionalism to European institutions that increasingly ask vendors where data lives.

What should a gallery ask a CRM vendor about data?

Six questions: Where is the data stored? Who can access it? Is it encrypted in transit and at rest? Can we export everything in open formats at any time? Is there a signed data-processing agreement? And what happens to our data if we cancel?

Why EU Hosting Matters for Gallery and Collector Data (GDPR, Explained for Art Businesses)

Short answer: your CRM holds your gallery's most sensitive assets — collector identities, purchase histories, prices, contracts. EU hosting keeps that data under GDPR jurisdiction, avoids legal friction with cross-border transfers, speeds up access for European teams and collectors, and is increasingly a question institutions and corporate buyers ask before signing. Art Gallery CRM is hosted entirely in the European Union, with collector data never sent to third-country servers.

Art databases don't look like "personal data" at first glance — they look like inventory. But open a gallery CRM and count the people inside it: collectors with addresses and phone numbers, purchase histories, the names on invoices, the notes from studio visits. That is personal data under GDPR, and the gallery — not the software vendor — is on the hook for how it's handled. Where the servers physically sit is the first domino.

What EU hosting actually buys you

One legal regime. Data stored in the EU stays under GDPR and EU court oversight. Data stored elsewhere drags in transfer mechanisms (SCCs, transfer-impact assessments) that most galleries have neither the time nor counsel to manage.
Institutional credibility. Museums, corporate collections and public institutions increasingly ask vendors a blunt question: "where does the data live?" A clean answer shortens procurement; a hedged one stalls it.
Performance where your clients are. For a European gallery, EU servers mean faster pages for the people who actually browse the catalogue — a collector in Paris, not a crawler in California.
Simpler vendor due diligence. EU-only hosting plus a signed data-processing agreement covers the majority of what a privacy-conscious client needs to see.

The six questions to ask any art-software vendor

Where is our data stored? Country and datacenter, not "in the cloud".
Who can access it? Named roles, and whether support staff can view records by default.
Is it encrypted in transit and at rest? TLS for transport is table stakes; ask about encryption at rest too.
Can we export everything, any time, in open formats? The exit test — a CRM you cannot leave owns you.
Do you sign a data-processing agreement (DPA)? Under GDPR this is an obligation for vendors processing personal data, not a favor.
What happens on cancellation? Deletion timeline, and written confirmation you can hold.

How we answer those questions

Art Gallery CRM runs on infrastructure hosted in the European Union — we are currently consolidating everything on a German datacenter to serve European galleries with the lowest latency and the clearest residency story. Concretely:

Collector records, documents and images are stored on EU servers; nothing is replicated to third-country clouds.
All traffic is encrypted in transit; access inside the platform follows role permissions you control — artists see their works, not your whole client book.
You can export your artworks and contacts in open formats at any time, without asking us.
Our privacy policy states what we process, for how long, and how to exercise your rights — and we sign DPAs with gallery clients on request.

One deliberate design choice worth noting: our free Image Editor processes images entirely in your browser — artwork photos never touch our servers at all. Privacy you can verify is stronger than privacy you're promised.

The practical GDPR duties of a gallery — in plain words

Collect less. A CRM tempts you to record everything; record what you use. "Prefers outdoor bronze" is useful; a collector's private circumstances are a liability.
Have a lawful basis. For existing clients, legitimate interest or contract covers relationship management; for newsletters, use consent.
Honor access and deletion requests. In a good CRM this is two clicks — another reason to leave spreadsheets.
Sign DPAs with every vendor that touches collector data: CRM, email tool, accountant's platform.

FAQ

Does GDPR apply to a non-EU gallery selling to European collectors?

Yes — GDPR follows EU residents' data regardless of where the gallery is based. EU hosting plus a DPA is the simplest way for a non-EU gallery to approach compliance.

Is US-based art software illegal in Europe?

No. It is legal but requires transfer safeguards (such as Standard Contractual Clauses) and adds due-diligence work. EU-hosted alternatives remove that friction — which is why many European galleries prefer them.

Where is Art Gallery CRM hosted?

Entirely in the European Union, consolidating on German infrastructure. Collector data is not replicated outside the EU, and the free Image Editor never uploads images to any server.

Your collectors, your data, your jurisdiction

EU-hosted, exportable any time, with a DPA on request. Try Art Gallery CRM free for 15 days.

Start the free trial