Largo NORD
Visit our gallery at largonord.com.
Visit the galleryVisit our gallery at largonord.com.
Visit the galleryLast updated 9 November 2026
This policy explains how we use personal information when you browse largonord.com, save choices, contact us, subscribe to our newsletter or buy from us. It also covers dealings with artists, sellers, people who entrust works to us for sale and their representatives.
Largo NORD ApS is responsible for the processing described here, except where a provider has its own responsibilities as explained below. Our address is Borresøvej 27, 3.3, 8240 Risskov, Denmark, CVR 46718658, VAT DK46718658. Use our Contact page.
Our website uses Sites hosting and Cloudflare infrastructure. Shopify provides our catalogue, commerce services and checkout. Google Workspace handles gallery email and enquiry notifications. MailerLite handles newsletter subscriptions and delivery.
We use contact details, messages, artwork and framing choices, quotes, orders, payment and delivery information, certificates, returns and complaints. The enquiry form stores your name, email, optional phone number, message, artwork reference, framing choice, submission time and reference, and the version of the privacy acknowledgement. Required fields are marked. The enquiry is saved in our hosted database and sent to the gallery mailbox. Email links open your email application.
Payment providers handle your card details. We receive payment status, amount, method, references and the limited details needed to manage the transaction. Bank-transfer records may include account information. Our custom storefront does not collect or store your full payment-card details.
Our hosting and security providers use technical information such as IP addresses, requested web addresses, request times, browser and device details, errors and security events. Your basket, framing choices, language and delivery country use browser storage described in Cookies and Preferences. We use your selected country and framing option to obtain the applicable price from Shopify and use your selections when needed for your enquiry or checkout. The storefront does not offer customer accounts or saved selections shared across devices.
We receive information from you, website and checkout activity, service providers, artists, sellers, previous owners and other people involved in a transaction. We may also consult public company and ownership registers, sanctions records, professional information, catalogues and other relevant sources.
Artist biographies and catalogue entries may include professional information. Records about ownership, purchases, sales on behalf of others, authenticity, awards and provenance may identify living people. We consider privacy and confidentiality before publishing or sharing them. If we obtain information indirectly, we give the privacy information the law requires unless an exception applies.
The GDPR requires a legal basis for using personal information. The basis depends on the purpose:
To take steps you request before a contract, or carry out a contract with you as an individual, we rely on Article 6(1)(b). This includes enquiries, quotes, purchases, agreements to sell works for you, delivery and agreed returns.
To meet legal duties, we rely on Article 6(1)(c). These include bookkeeping, tax, customs, consumer rights, anti-money-laundering checks and sanctions rules.
For legitimate interests, we rely on Article 6(1)(f). These include running and securing the gallery, preventing fraud and misuse, answering general correspondence, dealing with business representatives, keeping accurate artwork and provenance records, publishing relevant artist information and handling legal claims. We weigh these needs against your rights and reasonable expectations.
We rely on consent (GDPR Article 6(1)(a)) to send newsletters and collect website analytics. You can withdraw consent at any time without affecting earlier lawful use.
Reading or acknowledging this policy does not sign you up for marketing or give blanket consent to everything described here. We need certain contact and order details to answer you or carry out a purchase. Required identity checks may be a condition of proceeding. Newsletter signup is optional. We explain any further requirements when asking for information.
Danish anti-money-laundering rules for art transactions apply to qualifying transactions of DKK 50,000 or more, including linked transactions. Checks can concern buyers, sellers, people who entrust works to us for sale, representatives and the individuals who ultimately own or control a business. More detailed checks depend on risk and the law, not the amount alone.
Where required, we may collect identity-document details, date of birth, CPR number or another identifying number where appropriate, company and ownership information, authority to act, information about politically exposed people, the transaction's purpose and the source of funds. We follow the additional Danish rules for CPR numbers. We use anti-money-laundering information for the compliance purposes the law permits, not marketing.
Follow our instructions for sending this information securely. Do not send unsolicited identity documents, card details or source-of-funds records through an ordinary enquiry form or email.
Buying or making an enquiry does not subscribe you. If you choose to subscribe, MailerLite receives your email and subscription information and sends a confirmation request. Once you confirm, we can send the gallery news, artworks, artist stories and exhibition information you requested. We keep evidence of confirmation and withdrawal.
To record signup requests and prevent misuse, our website keeps a coded version of your email address, the consent-text version, language, request time and result. The coded address is created using a secret key. It is pseudonymous personal information, not anonymous data. It is separate from MailerLite's subscriber list. The signup function does not store raw IP addresses; infrastructure logs are handled separately.
We use delivery, confirmation, bounce and unsubscribe records to run the newsletter. If we introduce newsletter engagement tracking, we will ask for your separate, optional consent. With that consent, MailerLite will measure whether you open newsletters and which links you click so we can improve the newsletter. You can withdraw tracking consent through our Contact page and keep receiving the newsletter.
Unsubscribe using the link in any newsletter. See MailerLite’s privacy information.
With your consent, we use Google Analytics 4 to improve how you find and view art. We measure artwork and collection visits, time spent viewing pages and expanded images, artwork selections from collections, successful artwork enquiries and additions to your basket. Events include catalogue IDs. We handle enquiry contact details, messages and cart tokens separately.
Google receives these events, browser and session identifiers, and technical data such as device and browser information, IP address and approximate location. We use this data for storefront statistics. You can withdraw consent in Cookie settings. See Cookies and Preferences.
We send public catalogue information to Google Merchant Center to list our artworks on Google.
Shopify generally handles core merchant information on our behalf. It is independently responsible for some other processing. Shopify Network Intelligence is enabled for our Shopify services. For relevant Enhanced Services, Shopify may combine interactions with Largo with information from Shopify and other merchants for security, personalisation, analytics, marketing and advertising. This does not mean every Shopify feature runs on our custom storefront.
Optional technologies or uses that require consent must wait for that consent. Shopify's own interfaces provide information and relevant controls. See the Shopify Consumer Privacy Policy, cookie policy and Privacy Portal. You can also contact us to ask about your rights to access information, withdraw consent, object or make choices about sharing.
We share information as needed with:
Sites and Cloudflare for hosting, security and the database.
Shopify, payment providers and banks for purchases and payments.
Google Workspace for correspondence, MailerLite Limited in Ireland for newsletters, and Google Ireland Limited to process website analytics on our behalf. MailerLite hosts subscriber data in the Netherlands.
Carriers, customs intermediaries and insurers for delivery and claims.
Necessary IT, accounting, legal and compliance advisers.
Artists, sellers and others involved in a sale or provenance matter, where limited sharing is needed.
Authorities where the law requires or permits it. Confidentiality rules may prevent us from telling you about some disclosures.
Providers processing information for us must have the required contractual protections. Some recipients, including banks, carriers and Shopify for certain services, make their own decisions about their processing. If the business is sold or restructured, necessary information may be shared with advisers and the other parties under appropriate confidentiality and data-protection safeguards.
Providers may process information outside Denmark and the EEA, including in the United States. Where safeguards are required, we use a valid adequacy decision or approved Standard Contractual Clauses with any necessary extra protections. You can ask which countries and safeguards apply to your information and request a copy of the safeguards, with confidential details removed where necessary.
Google collects analytics data from EU devices through EU infrastructure and may process it outside the EEA, including in the United States. Google relies on the EU–U.S. Data Privacy Framework for covered transfers to certified U.S. recipients and on the European Commission’s Standard Contractual Clauses where applicable. See Google’s transfer safeguards.
We keep information only as long as needed for its purpose or required by law.
Required accounting records are normally kept for five years after the end of the relevant financial year. Other purchase records are kept to manage the agreement, your rights and any legal claims.
Required anti-money-laundering records are generally kept for five years after the business relationship ends or the transaction is completed. Personal information is then deleted within the legal deadline, normally within one month, unless another legal requirement applies.
We keep enquiries while needed to respond and follow up. If an enquiry leads to a purchase, complaint or claim, relevant records follow the retention period for that purpose. We review other correspondence and delete it when no longer needed.
Some authenticity and provenance records remain useful for longer. We review whether personal details are still needed, limit access and remove unnecessary identifying information.
We keep subscription information while you remain subscribed. Limited consent and unsubscribe records may be kept to prove compliance and prevent further marketing after an opt-out.
GA4 is set to retain user-level and event-level data for two months. If we introduce newsletter tracking, we will keep identifiable engagement data for two months.
Website signup logs have a 90-day operational retention period. Automatic cleanup runs when signup requests are processed. If there is no further activity, records are deleted at the next cleanup or retention review. Browser-storage periods are listed in Cookies and Preferences. Technical logs are kept for the service's operational, security or incident-investigation needs.
We use reasonable technical and organisational safeguards and restrict access to people who need it for their work. No internet service can guarantee complete security.
Automated stock and basket checks support shopping; they do not make decisions about you with legal or similarly significant effects. Payment providers may carry out their own automated fraud checks.
Subject to the legal conditions, you can ask to see or correct your information, have it deleted, restrict its use, or receive it in a portable format. You can object to use based on legitimate interests because of your situation, and object to direct marketing at any time. You can also withdraw consent. Legal recordkeeping or claims may limit deletion; we explain any limits that apply.
Use our Contact page to make a request. We may ask for proportionate identity verification. We normally answer without unnecessary delay and within one month. If a permitted extension is needed, we explain why within that month. Requests are normally free.
You can complain directly to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, or another competent authority, including in the EEA country where you live or work. See Datatilsynet's complaint guidance. You do not have to contact us first. Other applicable laws may give you extra rights.
Our services are not aimed specifically at children. Contact us if a child has provided information inappropriately. We update this policy when our processing changes and give any extra notice or request for consent required for a new purpose.