PRIVACY POLICY
Last updated: September 2026
1 – DATA CONTROLLER AND SCOPE OF APPLICATION
4 – PURPOSES AND LEGAL BASES FOR PROCESSING
5 – REGULATORY COMPLIANCE AND VERIFICATIONS
6 – DATA DISCLOSURES AND RECIPIENTS
7 – INTERNATIONAL DATA TRANSFERS
10 – SECURITY AND CONFIDENTIALITY
11 – AMENDMENTS AND CONTACT INFORMATION
1 – DATA CONTROLLER AND SCOPE OF APPLICATION
MONTERONE ART, S.L., with Spanish Tax Identification Number (NIF) B42847160 and registered office at Calle Velázquez, 10, 28001 Madrid, Spain (hereinafter, “Monterone Art”), is the data controller responsible for the processing of personal data covered by this Privacy Policy. Corporate and legal information, as well as information concerning the ownership and use of the Website, is available in the Legal Notice.
This Privacy Policy governs the processing of personal data carried out by Monterone Art in connection with access to and use of the Website, its activities and services, the transactions in which it is involved and, more generally, its professional, commercial, institutional or other relationships with natural or legal persons, including clients, prospective clients, artists, collectors, representatives, suppliers, collaborators, advisers, counterparties and other persons connected with its activities.
Where such relationships are maintained with legal persons or other entities, this Policy shall apply to the personal data of their representatives, directors, employees, beneficial owners, contact persons and any other natural persons associated with them whose data are processed by Monterone Art.
This Policy shall apply regardless of the means by which personal data are obtained or processed and regardless of the jurisdiction from which the relationship with Monterone Art is established, without prejudice to any mandatory provisions that may apply.
Matters relating to the use of cookies and similar technologies are governed separately by the Cookie Policy.
2 – PERSONAL DATA PROCESSED
Depending on the nature of the relevant relationship, activity, service or transaction, Monterone Art may process the following categories of personal data:
a) identification and contact data;
b) professional, corporate, company-related and representation data;
c) economic, financial, banking, tax, asset-related and billing data;
d) data relating to works of art, collections, assets, operations and transactions, including data concerning their ownership, provenance, valuation, acquisition, transfer or management;
e) data and documentation relating to identification, verification, regulatory compliance, fraud prevention, risk assessment and due diligence processes;
f) data arising from enquiries, communications, requests, negotiations, engagements and contractual, professional or commercial relationships;
g) technical, connection, browsing, device and Website usage data, including data relating to the use of its functionalities; and
h) any other personal data provided, obtained or generated in connection with the activities, services, operations or relationships maintained by Monterone Art.
The nature and extent of the data processed will depend on the circumstances of each relationship, service or transaction and on the information required for its proper management.
3 – SOURCES OF PERSONAL DATA
Personal data processed by Monterone Art may be obtained directly from the data subject or may be generated, received or otherwise obtained in the course of its activities, services, transactions and professional or commercial relationships.
In particular, such data may originate from the data subject; from natural or legal persons with whom the data subject is connected; from representatives, clients, prospective clients, counterparties, suppliers, collaborators, advisers or other third parties; from registers, databases, archives, publications, digital platforms and other publicly accessible sources; from specialist providers of information, verification, investigation, regulatory compliance or due diligence services; as well as from authorities, bodies and other sources legally authorised to disclose or make such information available for consultation.
Monterone Art may also generate or infer information from the data obtained, the relationships maintained, the transactions carried out or analysed, and the checks performed in the course of its activities.
4 – PURPOSES AND LEGAL BASES FOR PROCESSING
Monterone Art may process personal data for the following purposes:
a) to handle and manage enquiries, requests, communications, proposals and contacts, and to take steps prior to establishing a professional, commercial or contractual relationship;
b) to manage, provide, develop and carry out its activities, services, engagements, contractual relationships and transactions, together with any ancillary or related activities;
c) to manage relationships with clients, prospective clients, artists, collectors, representatives, suppliers, collaborators, advisers, counterparties and other persons or entities connected with its activities;
d) to analyse, research, document and assess works of art, collections, assets, operations and transactions, including information relating to their ownership, provenance, authenticity, attribution, condition, valuation, transfer and any other relevant circumstances;
e) to carry out identification, verification, due diligence, risk assessment, fraud prevention and other compliance activities, on the terms set out in the following section;
f) to manage payments, collections, invoicing, accounting, taxation, documentation, record-keeping and other administrative functions relating to Monterone Art’s activities;
g) to comply with legal, regulatory, administrative, tax, judicial and other obligations and to respond to requests from competent authorities, public bodies and courts;
h) to prevent, investigate and manage fraud, misuse, security incidents, breaches, disputes and claims, and to exercise and defend the rights, interests and assets of Monterone Art or third parties;
i) to maintain and develop professional and commercial relationships, carry out business development activities, and send communications, information, publications, invitations and content of an institutional, professional or commercial nature;
j) to manage, maintain, protect and improve the Website, its functionalities, systems, accounts and other technological resources, and to obtain information regarding their use; and
k) to pursue any other purposes connected with or compatible with the foregoing purposes and with Monterone Art’s activities, services, transactions and relationships, within the limits established by applicable law.
Depending on their nature and purpose, processing activities may be based on the performance of a contract or the taking of steps at the request of the data subject prior to entering into a contract; compliance with legal or regulatory obligations; the legitimate interests pursued by Monterone Art or third parties, including the management and development of its activities, the maintenance of professional and commercial relationships, security, fraud prevention, risk management, asset protection and the exercise or defence of rights and interests; the data subject’s consent where consent constitutes the required legal basis; and any other legal basis recognised under applicable law.
In particular, the handling of enquiries and pre-contractual relationships, the provision of services, the performance of engagements and transactions, and the research, documentation and assessment of works of art, assets, collections and transactions may be based, as appropriate to the nature and circumstances of the processing, on pre-contractual measures, contractual relationships, legal obligations or legitimate interests.
Identification, verification, compliance, administrative, accounting, tax, record-retention, fraud-prevention and dispute-management activities, as well as responses to requests from competent authorities, may be based on legal or regulatory obligations and, where appropriate, on legitimate interests relating to risk management and the protection of rights and interests. Business development activities, the maintenance of professional and commercial relationships and the sending of communications may be based on consent or, where permitted by applicable law, on Monterone Art’s legitimate interests.
Processing relating to the administration, security, maintenance and operation of the Website and Monterone Art’s systems may be based on legitimate interests relating to their proper management, security and protection, without prejudice to any consent required for certain technologies or functionalities. Where certain data are necessary to manage or perform a relationship, service or transaction, or to comply with legal obligations, failure to provide such data may prevent or restrict the relevant relationship, service or transaction.
5 – REGULATORY COMPLIANCE AND VERIFICATIONS
Monterone Art will carry out the checks and verifications required by applicable law and may adopt such additional due diligence, monitoring and verification measures as may be appropriate having regard to the nature, circumstances and level of risk of the relevant relationship, service or transaction.
These measures may include, among others, the identification and verification of individuals and entities; verification of authority to act, ownership and control; identification of beneficial owners; risk assessment; checks relating to sanctions, restrictions, conflicts or other relevant circumstances; verification of the source of funds, assets or works of art; and measures relating to the prevention of fraud, money laundering, the financing of unlawful activities and other compliance obligations.
For these purposes, Monterone Art may request additional information or documentation and cross-check the available data against public sources, registers, databases, specialised service providers, advisers, counterparties, authorities and any other sources lawfully accessible.
The extent and intensity of such checks may vary depending, among other factors, on the value, nature, frequency, structure and circumstances of the relevant relationship or transaction; the quantitative thresholds, risk criteria and due diligence requirements established in the various jurisdictions; the characteristics and location of the parties involved; and any other factor relevant for compliance purposes. Where required, linked or related transactions may be considered in aggregate for the purpose of determining whether such thresholds or measures apply.
Monterone Art may decline to enter into, continue or carry out a relationship, service or transaction where it is not possible to satisfactorily complete the required checks, the available information is insufficient, legal or regulatory impediments exist, or there are circumstances that reasonably make continuation inadvisable.
Information obtained in the course of these activities may be retained and used to demonstrate compliance with applicable obligations, manage risks, prevent unlawful activities and protect the rights and interests of Monterone Art or third parties, in accordance with applicable law.
6 – DATA DISCLOSURES AND RECIPIENTS
Personal data may be disclosed or made available to third parties where necessary for the conduct of Monterone Art’s activities, services, relationships or transactions, for compliance with legal or regulatory obligations, risk management, the protection of rights and interests, or for any of the purposes set out in this Privacy Policy.
Access to personal data may be granted, among others, to providers of technology, hosting, communications, storage, document management, security, administrative, payment and other ancillary services, as well as to legal, tax, financial and technical advisers and other professionals providing services to Monterone Art.
Personal data may also be disclosed, where necessary, to financial institutions and payment service providers; insurers; carriers, custodians and logistics operators; galleries, auction houses, platforms, agents, intermediaries and other market professionals or operators; laboratories, specialists, experts and technical service providers; clients, counterparties and other persons or entities involved in a relationship or transaction; as well as to authorities, public bodies, regulators, courts and other recipients legally entitled to receive such data.
Access to or disclosure of personal data may likewise extend to third parties involved in verification, compliance, fraud prevention, financing, insurance, valuation, research, conservation, transport, custody, acquisition, transfer or management processes relating to works of art, assets or transactions.
Where a third party processes personal data on behalf of Monterone Art, such processing will be subject to the applicable contractual, confidentiality, security and data protection obligations.
7 – INTERNATIONAL DATA TRANSFERS
Personal data may be subject to international transfers or may be accessed, processed or stored from different countries in connection with Monterone Art’s activities, services, relationships and transactions.
Where an international transfer of personal data is subject to specific data protection requirements, Monterone Art will implement the measures and safeguards required by applicable law, including, where appropriate, adequacy decisions, standard contractual clauses, binding corporate rules, legally recognised derogations or other mechanisms recognised under the relevant legislation.
The determination of the applicable transfer mechanism will take into account, among other factors, the destination jurisdiction, the nature of the processing, the category of recipient, the circumstances of the transfer and the level of protection required in each case.
Monterone Art may also implement additional contractual, technical or organisational measures where necessary to ensure an adequate level of protection for the personal data being transferred.
8 – DATA RETENTION
Personal data will be retained for as long as necessary to fulfil the purposes for which they were collected and, thereafter, for the periods required by applicable law or necessary to address liabilities, claims, retention obligations, audits, compliance requirements or the exercise or defence of rights and interests.
Retention periods may vary depending on the nature of the data, the relationship concerned, the type of service or transaction, applicable limitation periods, and the minimum or maximum retention periods established under commercial, tax, regulatory, anti-money laundering or any other applicable legislation. Certain compliance regimes may require extended retention periods which, in the field of anti-money laundering, may be up to ten years.
Certain information relating to relationships, transactions, works of art, collections, provenance, verification procedures or compliance activities may be retained beyond the termination of the relevant relationship or transaction where necessary to establish or evidence facts, maintain historical or documentary records, manage risks, prevent unlawful activities or protect legitimate rights and interests, within the limits established by applicable law.
When personal data are no longer necessary and there is no legal basis for their continued retention, they will be deleted, anonymised or made subject to any applicable blocking or restriction measures.
9 – DATA SUBJECT RIGHTS
Data subjects may exercise the rights granted to them under applicable data protection law, including, where applicable, the rights of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw any consent previously given and to exercise any rights applicable in relation to decisions based solely on automated processing.
These rights may be exercised by contacting Monterone Art using the contact details provided in this Privacy Policy. Monterone Art may request such information as is reasonably necessary to verify the identity of the applicant, determine the scope of the request and ensure that personal data are not improperly disclosed, altered or erased.
The exercise of these rights will be subject to the conditions, limitations and exceptions provided for under applicable law and will not affect processing lawfully carried out prior to their exercise or the retention of information where there is a lawful basis for doing so.
Data subjects may also lodge a complaint with the competent data protection authority or supervisory authority in accordance with applicable law.
10 – SECURITY AND CONFIDENTIALITY
Monterone Art will implement appropriate technical and organisational measures to protect personal data against unauthorised destruction, loss, alteration, disclosure, access or processing, taking into account the nature of the data, the circumstances of the processing and the associated risks.
Access to personal data will be limited to those persons who need to process such data in the performance of their duties or in connection with the provision of services related to Monterone Art’s activities, subject to the applicable confidentiality, security and data protection obligations.
Security measures may be reviewed and adapted in light of technological developments, identified risks, changes in processing activities and applicable legal or regulatory requirements.
11 – AMENDMENTS AND CONTACT INFORMATION
Monterone Art may amend this Privacy Policy to reflect legislative, regulatory, technological or organisational changes, or developments in its activities, services and personal data processing operations.
Any amendments will be published on the Website and will apply from the date specified in each version, without prejudice to any additional notices that may be required under applicable law.
Any enquiries, requests or communications relating to this Privacy Policy or to the processing of personal data may be addressed to Monterone Art through the contact channels made available on the Website or in writing to its registered office at Calle Velázquez, 10, 28001 Madrid, Spain.
The current version of the Privacy Policy will state the date on which it was last updated.
