This policy explains what personal data Artist Museums (“we”, “us”) collects through this website, why, and the choices you have. If you have any question, contact us at the address shown on the contact page.
1. Data we collect
- Account data — name, email address, password (stored only as a one-way hash), and optionally phone number and country.
- Bidder verification data — legal name, postal address, phone number, any information you add to your application, and, if you verify a payment card, the card brand, last four digits and expiry date. Full card numbers are entered directly into our payment provider’s secure form and are never received or stored by us.
- Auction activity — registrations, bids (including confidential maximum bids), lots watched, purchases, invoices and payments.
- Messages — what you send us through the contact or enquiry forms.
- Technical data — IP address (recorded with bids, sign-ins and form submissions to prevent fraud and abuse), and the cookies described below.
- Visit statistics — pages viewed, time on page, the referring website, device and browser type, and approximate location (country, region, city) derived from your IP address. These are recorded by our own analytics system on our server, without cookies, to understand how the website is used; they are kept for up to 13 months and are not shared.
- Certificate lookups — certificate number and REF/ISNI entered on the verification page, with IP-based rate limiting.
2. Why we use it
- to run your account and the auctions: verifying bidders, processing bids, sending outbid and result notices, issuing invoices and collecting payment (performance of a contract);
- to prevent fraud, keep the site secure and keep the legally required records of sales and payments (legitimate interests and legal obligations);
- to answer your enquiries;
- to understand how the site is used, only with your consent (analytics cookies).
We do not sell personal data, and we do not send marketing email unless you have asked for it.
3. Who we share it with
- Stripe — card verification and online payments;
- our email provider — to deliver account and auction emails;
- Google Analytics — anonymous usage statistics, only if you accept analytics cookies;
- our hosting provider, professional advisers, and authorities where the law requires it.
Some of these providers process data outside your country. Where required, they are bound by appropriate safeguards such as standard contractual clauses.
4. Cookies
- Necessary: a session cookie that keeps you signed in, and a short-lived cookie used during two-step verification. These are required for the site to work.
- Analytics (optional): Google Analytics cookies, set only after you click “Accept” in the cookie notice. You can change your choice at any time using “Cookie settings” at the bottom of every page.
- The payment form provided by Stripe may set its own cookies for fraud prevention.
5. How long we keep it
Account data is kept while your account is open. Bidding, invoice and payment records are kept for as long as accounting and anti-money-laundering rules require (typically up to 10 years). Messages are kept for up to 3 years. You can ask us to close your account at any time.
6. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us. You may also complain to your data protection authority.
7. Security
Passwords are hashed, connections are encrypted (HTTPS), card data is handled by Stripe, and optional two-step verification is available in your account.
8. Changes
We will post any changes on this page and update the date below.