Privacy Notice

The data controller is Joost van den Bergh, of St. James's, London, United Kingdom. For any privacy matter, or to exercise your rights, write to joost@joostvandenbergh.com. We have not appointed a statutory Data Protection Officer; the gallery\u2019s principal is responsible for data protection.

From you: your name and contact details, correspondence, enquiries and appointment requests, your collecting interests, and purchase, sale, consignment and shipping details. Where the law requires it, identity documents, proof of address and information about the source of funds.

From other sources: the UK Sanctions List published by the Foreign, Commonwealth & Development Office, and public records used for anti-money-laundering checks; shippers and insurers in connection with a delivery.

From your use of this website: only what you consent to in the cookie choice (see our Cookie Policy), plus the technical data needed to keep the site secure.

Answering enquiries and arranging appointments \u2014 steps you ask us to take before a contract, and our legitimate interest in running the gallery.

Selling, buying and consigning works, invoicing, shipping and insurance \u2014 performance of a contract, and our legal obligations to keep tax and accounting records.

Our newsletter \u2014 your consent, given by double opt-in and withdrawable at any time with the link in every email. For existing clients we may rely on the \u201csoft opt-in\u201d in the Privacy and Electronic Communications Regulations, with the same right to opt out.

Private offers and previews sent to you personally \u2014 our legitimate interest in offering works to collectors we know; you can ask us to stop at any time.

Anti-money-laundering due diligence and sanctions screening \u2014 our legal obligations as an HMRC-supervised art market participant under the Money Laundering Regulations 2017 and the Sanctions and Anti-Money Laundering Act 2018.

Keeping the website and our systems secure \u2014 our legitimate interest in preventing abuse and fraud.

Website statistics and advertising measurement \u2014 your consent, as set in the cookie choice.

We do not make decisions about you by automated means. Sanctions screening produces possible name matches that are always reviewed by a person.

Service providers who process data on our instructions under written contracts: Vercel (hosting of this website and our internal system, USA); Vultr (our database and image storage, London, UK); Resend (email delivery, USA); Sanity (website content, EU and USA); Cloudflare (protection of our forms against automated abuse, global); and Meta, only if you accept marketing cookies. Our accountants, solicitors and insurers where needed. Shippers and insurers when a work is delivered to you. Identity-verification providers where we use one for anti-money-laundering checks.

Public authorities where the law requires it, including HM Revenue & Customs, the National Crime Agency and the Office of Financial Sanctions Implementation. We do not sell personal data.

Our data is stored in the United Kingdom. Some providers process data in the United States or the European Economic Area. Transfers to the EEA are covered by the UK\u2019s adequacy regulations. Transfers to the United States rely on the UK Extension to the EU\u2013US Data Privacy Framework where the provider is certified, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

Enquiries: three years. Appointment bookings: two years.

Newsletter subscription: until you unsubscribe; we then keep a record that you opted out so that we do not email you again. A sign-up that is never confirmed is deleted after 30 days.

Email delivery records and private-offer page views: two years.

Purchase, sale and consignment records: six years after the end of the tax year, as tax law requires.

Anti-money-laundering records: five years after the end of our business relationship or the transaction, as the Money Laundering Regulations require.

Contact records with no activity are reviewed for deletion after five years.

When you ask us to erase your data we delete everything we are not legally required to keep, and remove your identity from anything we must retain.

You can ask for a copy of your data; have it corrected or erased; restrict or object to how we use it; receive the data you gave us in a portable form; and withdraw consent at any time. We respond within one month, free of charge, and may ask you to confirm your identity. Some rights are limited where we must keep data to meet a legal obligation, and we will tell you if that applies.

If you are unhappy with how we handle your data you can complain to the Information Commissioner\u2019s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would welcome the chance to resolve any concern first.

Data is held in encrypted, access-controlled systems in the UK; access is limited to gallery staff who need it, protected by strong authentication; backups are encrypted; and every change is logged. This website and our systems are served only over HTTPS.

Our services and this website are intended for adults. We do not knowingly collect data about anyone under 18.

We review this notice at least annually and whenever our processing changes. The date at the top shows the current version.