Last updated: August 2026

Carl Kostyal Limited (“Kostyal”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use and protect personal information when you visit kostyal.com or subscribe to our mailing list.

1. Who we are

Carl Kostyal Limited is the controller responsible for your personal data.

Carl Kostyal Limited
Company No. 11309036
12a Savile Row
London W1S 3PQ
United Kingdom

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the contact details provided on our website.

2. Personal data we collect

When you subscribe to our mailing list, we may collect:

  • your email address;
  • your name, where provided;
  • your subscription preferences; and
  • information relating to your subscription, including your consent and unsubscribe status.

We collect this information when you voluntarily provide it to us, including when you subscribe through our website.

3. How we use your personal data

We use your personal data to send you communications relating to Kostyal, including:

  • exhibition announcements;
  • invitations to gallery events;
  • news about our artists and projects; and
  • other relevant gallery news and updates.
  • Where required by law, we send these communications on the basis of your consent.

You can withdraw your consent and unsubscribe from our mailing list at any time by clicking the unsubscribe link included in our emails.

4. Mailchimp

We use Mailchimp, an email marketing service provided by The Rocket Science Group LLC, part of Intuit, to manage our mailing list and send our email communications.

When you subscribe to our mailing list, the personal information you provide, such as your name and email address, may be transferred to and processed by Mailchimp on our behalf for the purpose of managing subscriptions and sending our communications.

Mailchimp and its service providers may process personal data outside the United Kingdom, including in the United States.

Where personal data is transferred internationally, appropriate safeguards and transfer mechanisms are used in accordance with applicable data protection law.

You can find further information about how Mailchimp processes personal data in Mailchimp’s privacy documentation.

5. Unsubscribing

You can unsubscribe from our mailing list at any time by clicking the Unsubscribe link included in any marketing email we send you.

Once you unsubscribe, we will stop sending you marketing communications.

We may retain limited information about your unsubscribe request where necessary to ensure that you are not added back to our mailing list or contacted for marketing purposes without an appropriate legal basis.

6. Sharing your personal data

We do not sell your personal data.

We may share personal data with trusted service providers where this is necessary to operate our website, manage our mailing list or provide related services.

These providers may only process personal data for the purposes for which they have been engaged and subject to applicable contractual and data protection requirements.

7. International transfers

Some of our service providers, including Mailchimp, may process personal data outside the United Kingdom.

Where your personal data is transferred internationally, we take appropriate measures to ensure that it receives an appropriate level of protection in accordance with applicable UK data protection law.

8. How long we keep your data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.

If you subscribe to our mailing list, we generally retain your contact details while you remain subscribed.

If you unsubscribe, we will stop using your personal data to send you marketing communications, although we may retain limited information where necessary to record and respect your opt-out.

9. Your rights

Under applicable UK data protection law, you may have rights in relation to your personal data, including the right to:

  • request access to your personal data;
  • request correction of inaccurate or incomplete personal data;
  • request deletion of your personal data in certain circumstances;
  • request restriction of processing in certain circumstances;
  • object to certain processing;
  • request the transfer of your personal data in certain circumstances; and
  • withdraw your consent at any time where processing is based on consent.

If you wish to exercise any of these rights, please contact us.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

10. Cookies and tracking

We do not currently use analytics or advertising tracking technologies on our website.
Our website may use cookies or similar technologies that are strictly necessary for its operation and functionality.

Third-party services integrated into the website may also use technologies necessary to provide their functionality.

If we introduce analytics, advertising or other non-essential tracking technologies in the future, we will update our privacy and cookie information and obtain consent where required by applicable law.

11. Third-party websites

Our website may contain links to websites operated by third parties.

We are not responsible for the privacy practices of those websites. We recommend reviewing the privacy information provided by third-party websites when visiting them.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, practices or legal obligations.

Any updated version will be published on this website together with the date on which it was last updated.