Last updated: February 2020
5. If you would like to exercise
any of your legal rights under Data Protection Law or if you have any other
Marlborough Fine Art (London) Limited
6 Albemarle Street London
W1S 4BY United Kingdom
2. The personal data that we collect about you
1. We will collect any personal data or other information you provide to us when you visit any of our Galleries, contact us via phone/email or interact with us.
2. We will collect personal information contained in any communication between you (or your representatives) and us. For example:
- personal information contained in any documentation provided or made available for the purpose of us (or other regulated art market participants in a transaction, such as a seller or their representatives) being able to verify the identity of you or individuals involved in a transaction (such as the ultimate beneficial owner of a contracting party) and to carry out appropriate due diligence and conduct corresponding risk assessments where required under applicable regulations that seek to prevent money laundering or terrorist financing (AML Regulations);
- information that we collect for shipping, delivery, invoicing or payment purposes;
- personal information provided if you contact us with a complaint or enquiry;
- if you communicate with us online or using social media, we may keep a record of that information/communication; and/or
- we may also ask you for information when you report a problem with our Site.
4. When taking on new business, MFAL and MNY may need to process and verify certain information about you or individuals involved in a transaction (such as the ultimate beneficial owner of a contracting party) with third party online data services or other providers who enable us to conduct identity checks or other screening required under AML Regulations (for example, providers of databases on politically exposed persons or persons/entities that are subject to government or international sanctions). Some of these checks may conducted by automated means and we may use technology to help us identify the potential level of risk presented by a particular party or transaction. Our risk assessment may result in us having to make further enquiries regarding the parties involved in a transaction (or the transaction itself) and in some cases the results of our risks assessment may be that we are unable to act in relation to a particular transaction. The data we collect when conducting such checks will only be used for due diligence and risk assessment purposes under AML Regulations. You also have certain rights in relation to automated decision making under Data Protection Law (for which, see Your legal rights section below).
3. Use of your personal data
2. Personal data about you will be used for:
1. dealing with your enquiries or complaints;
2. providing customer services (including any after-sales services);
3. processing and fulfilling any order you place with us to (as well as dealing with any specific requirements you have);
4. contacting you with further information about our services or any changes;
5. financial management and administration of our business;
6. recording your artistic interests and marketing preferences (including any opt-out requests);
7. improving our services or Site;
8. the purposes of us (and other regulated art market participants in a transaction) being able to meet applicable legal obligations, for example, conducting identity checks and due diligence as well as generating corresponding risk assessment documentation required under AML Regulations as described hereunder; or
9. such other purposes you may consent to from time to time.
3. In addition to the specific uses set out above, we may use your information for the following purposes:
1. to ensure that content from our Site is presented in the most effective manner;
2. to develop our Site and your viewing experience;
3. to provide third parties with statistical information about our Site users but this information will not be able to be used to identify any individual;
4. to send direct marketing and other communications about Marlborough products, services or events. Where direct marketing is conducted by electronic means (such as email, SMS and/or MMS) and where required under applicable law, we will only send such marketing communications where we have your prior consent or, if you are an existing customer, where communications are in relation to works, products or services of the type that you purchased previously (or you have looked to purchase with us); and
5. for security purposes – for example, when monitoring use of our IT systems or recording images of Gallery visitors in accordance with Data Protection Law.
4. Disclosure of your data
2. We may disclose your personal data to third parties as follows:
1. to Marlborough affiliates or our service providers, who have to handle that data on our behalf and in accordance with our instructions under written contracts in accordance with applicable Data Protection Law (called "data processors"). These data processors include IT and software suppliers, data hosting providers, mail management companies, third party online data services or other providers we use to conduct identity checks or other screening required under AML Regulations (for example, providers of databases on politically exposed persons or persons/entities that are subject to government or international sanctions).
2. third-party companies and/or organisations to whom disclosure is necessary to enable us to provide you with the works, services or products you have purchased or sell through us, such as providers of insurance, shipping and delivery services; payment processors or parties who we use to administer/collect money owed to us;
3. to artists and their representatives, for their own records;
4. if our business or substantially all of our assets are acquired by a third party, in which case personal data held by us about our clients or contacts will be one of the transferred assets although your data will continue to be used for the same purposes as set forth hereunder;
5. where disclosure is necessary to enable us to establish, exercise or enforce our legal rights, or to protect the rights, property or safety of our clients or employees, including without limitation, disclosure to our attorneys or legal advisers for these purposes; or
6. where disclosure of information or documents may be required by law such as to a court, regulator, law enforcement or other relevant authority, such as a tax or customs authority or a collecting society.
Where such personal data is shared externally, to the fullest extent legally permitted we will endeavour to ensure that information is only used for the purposes for which it was disclosed and in accordance with Data Protection Law.
5. Third party content on our Site
1. Our Site may contain content and links to other websites and microsites that are operated by third parties that use.
6. Security of your data
1. We employ appropriate technological and operational security measures to protect personal data we hold against any unauthorised access, any unlawful processing or loss.
2. Data transmission over the internet is inherently insecure, and although we employ appropriate technological and organisational security measures to protect your data from unauthorised access we cannot guarantee the security of any data sent over the internet or by public communications services.
3. You must take reasonable steps to protect yourself against fraud. For example, if you receive any unsolicited communication that claims to be from a Marlborough email account asking for financial details or payment, please contact us by phone and do not act without taking steps to make sure it is genuine.
4. For security purposes, we may also monitor and block emails that are sent to us which are suspicious or we believe may contain attachments or content likely to disrupt or damage our systems.
7. International data transfers
1. Marlborough operates internationally. This means that the personal data that you provide to us may be stored in the United States, United Kingdom and countries of the EU and European Economic Area (EEA) where we operate.
2. Contact details of clients and other individuals who have been in contact with us are held on our global database. Access to this database may be shared between MFAL, MNY and our other Marlborough Galleries as listed on our Site. This means that we can note your particular interests and send information regarding particular artists, works, exhibitions or events in our Galleries that are relevant to you.
3. In addition, we may use IT and back-office service providers who act as our data processors using equipment located in the United States and other countries outside of the EU/EEA.
4. The United States is one of the countries outside the EEA whose laws are currently not considered to meet the same legal standards of protection for personal data as those set out under the GDPR. However, we will only transfer personal data out of the EEA under an appropriate contract or method authorised under the GDPR to make sure that such data is appropriately safeguarded.
8. How long do we keep your personal data for?
1. The period for which we keep your personal data usually depends on the purpose for which your information was collected in the first place
2. We have data retention policy that sets out the different periods we retain personal data for in accordance with our duties under Data Protection Law.
3. The criteria we use for determining relevant data retention periods are based on:
1. Whether we need to keep data to comply with a contract obligation, deal with any potential claims or to enforce our rights. This is usually the legal limitation period for dealing with any claims under the applicable law of the relevant contract;
2. Various legislative requirements - for example, duties under tax laws to hold financial transaction details and accounting records or legal requirements to hold certain due diligence information and corresponding risk assessment documentation for certain periods in accordance with AML Regulations;
3. The purpose for which we collected that personal data and where we have identified a continued legitimate need to hold that personal data to serve such purpose, such as keeping a record of provenance in respect of artworks; and
4. Guidance issued by relevant
regulatory authorities under Data Protection Law in a country where Marlborough
processes personal data.
Personal data that we no longer need to hold is securely disposed of and/or anonymised, so you can no longer be identified from it.
9. Lawful basis for processing your personal data under EU Data Protection Law
1. In accordance with GDPR requirements, we process your personal data relying on one or more of the following lawful grounds:
1. where we agree to provide any product and/or service to you, in order to take any pre-contract steps at your request and/or to perform our contract obligations to you;
2. where we need to use your personal data for our legitimate interests of being able to market and sell our works, products or services; provide our gallery services and administer our business. We will always seek to pursue these legitimate interests in a way that does not unduly infringe on your legal rights and freedoms and, in particular, your right of privacy;
3. where you have freely provided your specific, informed and unambiguous consent to us using your personal data for particular purposes, such as receiving electronic direct marketing;
4. where we need to protect your vital interests or those of someone else (such as in a medical emergency); and/or
5. we need to collect, process or hold your personal data to comply with legal obligations, including, but not limited to, AML Regulations.
2. If we collect any sensitive personal data (or special category data) about you such as data relating to health, ethnic origin, religious/philosophical or political beliefs or sex life, we will only do this with your explicit consent; or, to protect your vital interests or those of someone else; and/or, where you have clearly publicised such data; and/or, where we need to use such data in connection with a legal claim.
10. Your legal rights if you are located in the United Kingdom or European Union (EU).
- If you are located in
the European Union (EU) or UK you have certain rights:
- You have the legal right to request information about the personal data that we hold about you, what we use that personal data for; who it has been disclosed to, as well as certain other related information (called a subject access request). Usually we will have one month to respond to such a subject access request, although in the case of complex requests, we may require a further two months to respond. We may refuse or charge for administrative time in dealing with any manifestly unreasonable or excessive requests. We may also ask for further information to locate the specific information you seek and may apply certain legal exemptions when responding to a subject access request.
- You also have the
following rights, which are exercisable by making a request to us in
- that we correct personal data that we hold about you which is inaccurate or incomplete;
- in relation to any automated processing that we may carry out in relation to your personal data (for example if we conduct any automated credit scoring or automated screening for due diligence or risk assessment purposes under AML Regulations) you have a right to ask for information about the logic behind such processing. You can also ask for human intervention or challenge a particular decision made using such automated processing or, in certain cases, may object to such automated processing;
- to object to our continued use of your personal data for direct marketing purposes;
- to require us to erase your personal data without undue delay and/or to object to or to restrict the use of your personal data by us unless we have a legitimate reason for continuing to hold or use that data (e.g. in relation to a legal claim); or
- that we transfer your personal data to another party where the personal data has been collected with your consent or is being used to perform contract with you and we are processing that data by automated means (i.e. on computer).
- If you are located in the European Union (EU) or UK you have certain rights:
2. If you are not satisfied with our response or believe that we are illegally processing your personal data, you have the right to complain to the data protection regulator in the country where you are located. If you live in the United Kingdom, the relevant regulatory authority is the UK Information Commissioner's Office (ICO) – see: https://ico.org.uk/concerns/.
11. Complaints and Mandatory Law
1. If you have any questions or concerns about how we use your personal data – even if you are not located in the EU - please contact us at the address in the Introduction above.
2. When you make any request, we may ask you to provide us with appropriate evidence to verify your identity before we can respond.
2. We use the following cookies:
1. Strictly necessary
These are cookies that are required for the administration and operation of our Site. Some cookies that we use are necessary for our Site to function properly and to enable you to move around the Site and use its features. They include, for example, cookies that enable you [to log into secure areas of our Site.
We may also use an analytics service provider (including Google Analytics) for website traffic analysis and reporting. Analytics service providers generate statistical and other information about the use of the Site by using cookies, which are stored on users’ computers. They allow us to recognise and count the number of visitors and to see how visitors move around our Site when they are using it. This helps us to improve the way our Site works, for example, by ensuring that users are finding what they are looking for easily. The information generated relating to the Site may be used to create reports about the use of the Site and the analytics service provider will also store this information.
3. Functionality cookies.
In addition we may also use functional cookies that allow our Site to remember choices you have made in relation to the Site so as to provide a more personalised by remembering your preferences (for example, enhanced user experience by delivering content specific to your interests).
4. Targeting cookies.
These cookies record your visit to our Site, the pages you have visited and the links you have followed. We will use this information to make our Site more relevant to your interests. We may also share this information with third parties for this purpose.
You can find more information about the individual cookies we use and the purposes for which we use them in the table below:
This cookie enables us to estimate our audience size and usage pattern and how visitors reached our Site.http://www.google.co.uk/intl/en/analytics/privacyoverview.html
Store information about your preferences, and so allow us to customise our Site and to provide you with offers that are targeted at your individual interests.
4. Except for essential cookies, all cookies will expire after 2 weeks.