Privacy Policy

1. Identity of the Data Controller

The data controller responsible for personal data collected on this website is:

• Company / Trading Name: Galerie Tamaris
• Management / Operator: Niticha Parsand-Goffart, Visual Artist and Founder
• Physical Address: Ruisseau Créole Commercial Centre, La Preneuse, Black River (Rivière Noire) 90608, Mauritius
• Téléphone : +230 5918 1428 / +230 483 5150
• DPO / Data Protection Contact Email: galerietamaris@gmail.com

2. Personal Data Collected

In operating our fine art gallery and online platform, we may collect the following categories of data, depending on your use of the website:

Note regarding bank payments: Galerie Tamaris does not store any credit or debit card data on its servers. Electronic transactions transit in encrypted form through secure banking gateways compliant with PCI-DSS standards.

3. Purposes and Legal Bases for Processing

In accordance with Section 21 and general provisions of the Data Protection Act 2017, every data processing operation serves an explicit purpose and relies on a lawful basis:

• Management and fulfillment of artwork orders: Cart processing, invoice generation, certificate of authenticity issuance, and specialized art transport coordination (legal basis: Contract performance).
• Responding to inquiries and personalized quotes: Collector support and private gallery viewing arrangements (legal basis: Consent and pre-contractual relationship).
• Accounting, tax, and statutory obligations: Compliance with Mauritian statutory authorities, notably the Mauritius Revenue Authority (MRA) (legal basis: Compliance with a legal obligation).
• Website security and copyright protection: Cyberattack prevention, digital art piracy protection, and fraud detection (legal basis: Legitimate interest).

4. Data Retention Periods

Personal data is retained only for the duration strictly necessary to fulfill the intended purposes:

• Inquiry / contact form data: 3 years from the last interaction initiated by the visitor.
• Order, billing, and accounting records: 5 to 7 years in accordance with Mauritian tax and commercial statutory requirements.
• Customer accounts: Retained as long as the account remains active, or deleted within 30 days upon simple request.
• Preference and consent cookies: 12 months maximum.

5. Data Subject Rights (Data Protection Act 2017)

Under Mauritian data protection legislation (Part VII of the Data Protection Act 2017), you are entitled to the following fundamental rights:

• Right of Access (Section 37): The right to request confirmation whether personal data concerning you is being processed and to receive an intelligible copy.
• Right of Rectification (Section 38): The right to obtain without undue delay the rectification of inaccurate, incomplete, or misleading data.
• Right to Erasure ('Right to Be Forgotten', Section 39): The right to obtain the erasure of your personal data when its retention is no longer legally justified.
• Right to Object and Restriction (Section 40): The right to object at any time on legitimate grounds to data processing, or to request restriction of processing.
• Right to Data Portability: The right to receive personal data concerning you in a structured, commonly used, and machine-readable format.

To exercise any of these statutory rights, you may contact our data controller at any time:
By email: galerietamaris@gmail.com
By postal mail: Galerie Tamaris — Data Protection Officer, Ruisseau Créole, La Preneuse, Black River 90608, Mauritius.

Complaint to the Supervisory Authority:
If you consider, after contacting us, that your statutory rights have not been respected or that data processing infringes the Data Protection Act 2017, you have the right to lodge a complaint with the national supervisory authority:
Data Protection Office (Mauritius)
5th Floor, SICOM Tower, Wall Street, Ebène, Mauritius
Official website: https://dataprotection.govmu.org

6. Cross-Border Data Transfers from Mauritius

The technical infrastructure of our website and our hosting servers may be located outside Mauritius (specifically in secure high-standard data centers located in the European Union or jurisdictions with equivalent security safeguards).

In accordance with Section 36 of the Data Protection Act 2017, any international transfer of personal data is governed by appropriate safeguards ensuring an adequate level of data protection (end-to-end encryption, strict compliance by infrastructure providers).

7. Security Measures

Galerie Tamaris implements all technical and organizational measures under Section 31 of the Data Protection Act 2017 to preserve the confidentiality and integrity of your data:

• Secure transmission protocol HTTPS / SSL / TLS across the entire website.
• User passwords systematically encrypted with industry-standard cryptographic hashing algorithms (bcrypt).
• Web application firewall, restricted administrative access, and encrypted daily backups.
• Enhanced digital asset protection and copyright enforcement for all gallery artworks.

8. Policy Updates

This policy may be updated periodically to reflect legislative modifications or new gallery services. Any revision will be posted on this page with the updated effective date.

Last updated date: September 16, 2026.