Privacy Policy

We are delighted that you are visiting our website. The protection and security of your personal information when using our website is very important to us. We would therefore like to take this opportunity to inform you about which of your personal data we collect when you visit our website and for what purposes it is used.

Personal data refers to individual details about the personal or factual circumstances of an identified or identifiable natural person (data subject), e.g. name, address, email addresses, user behaviour. This is therefore data that we can use to identify you. In addition, you will also find occasional information here about data processing procedures outside this website (e.g. video conferences or newsletters).

Responsible for data processing

Responsible

For the processing of personal data within the meaning of the EU General Data Protection Regulation (GDPR)

Hargesheimer Kunstauktionen Düsseldorf GmbH
Friedrich-Ebert-Strasse 11+12
40210 Düsseldorf
Telephone: +49 (0) 211 – 30 200 10
Email: info@kunstauktionen-duesseldorf.de

Data Protection Officer

exkulpa gmbh
Waldfeuchterstr. 266
52525 Heinsberg
Telephone: 02452 / 99 33 11
Email: datenschutz@kunstauktionen-duesseldorf.de

General information

In addition to the data that you actively provide to us on this page (e.g. via our contact form), we collect some technical data. This so-called metadata is automatically transmitted from your computer to our servers as soon as you enter our website (including browser, operating system or timestamp). We use this data to ensure that our website is displayed correctly. In addition, we may collect data via integrated third-party providers (e.g. for external media such as map services or analysis tools). We will explain the individual purposes and legal bases in the course of this privacy policy.

Storage period

Unless a separate storage period is specified in this privacy policy, we will store your personal data for as long as the purpose of data processing exists. If you contact us with a legitimate request for deletion or revoke your consent, we will delete your data. Statutory retention obligations remain unaffected.

Legal basis for data processing

If you have consented to data processing, your personal data will be processed on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR if special categories of data are processed in accordance with Art. 9 (1) GDPR. If you have expressly consented to the transfer of personal data to third countries, the data will also be processed in accordance with Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your end device (e.g. through device fingerprinting), data processing will also take place on the basis of Section 25(1) TDDDG. Your consent can be revoked at any time. If your data is necessary for the performance of a contract or for the implementation of pre-contractual measures, we process your data in accordance with Art. 6 (1) lit. b GDPR. In addition, we process your data if this is necessary to fulfil a legal obligation, on the basis of Art. 6 (1) lit. c GDPR. Data processing may also take place on the basis of our legitimate interest in accordance with Art. 6 (1) lit. f GDPR. In the following sections of this privacy policy, you will be informed about the respective legal basis in individual cases.

Note on data transfer to third countries and US companies without DPF certification

Please note that we use tools from companies based in third countries or the USA that are not covered by the EU-US Privacy Shield Framework (DPF) and where data protection is not guaranteed. When using these tools, your personal data may be transferred to these countries and processed there. Please note that in these third countries, a level of data protection comparable to that in the EU cannot be guaranteed.

We would like to clarify that the USA generally offers a level of data protection comparable to that of the EU. The transfer of data to the USA is permitted if the recipient has DPF certification or provides appropriate additional safeguards. Information about data transfers to third countries, including data recipients, can be found in our privacy policy.

Automated decision-making

Your personal data will not be processed for the purpose of automated decision-making.

Your rights

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: You have the right to request confirmation from us as to whether your personal data is being processed and, if so, to receive further information about the processing and copies of the data being processed (Art. 15 GDPR).

• Right to rectification: You have the right to request the immediate rectification of inaccurate personal data concerning you and, where applicable, the completion of incomplete personal data (Art. 16 GDPR).

• Right to erasure: You have the right to request the immediate erasure of personal data concerning you if the legal requirements are met, in particular if the data is no longer necessary for the purposes pursued and the processing is unlawful (Art. 17 GDPR).

• Right to restriction of processing: You have the right to request that we restrict the processing of your personal data if the legal requirements are met, in particular if you dispute the accuracy of the data, the processing is unlawful and you refuse to have it erased (Art. 18 GDPR).

• Right to data portability: You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us, provided that this is technically feasible (Art. 20 GDPR).

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, if the processing is based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR).

• Right to withdraw consent: You have the right to withdraw your consent to the processing of personal data at any time with effect for the future. The withdrawal of your consent does not affect the lawfulness of the processing carried out on the basis of your consent until withdrawal (Art. 7(3) GDPR).

• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR (Art. 77 GDPR).

Further data processing procedures

General information obligations

This information is intended for customers, interested parties, suppliers and employees. We process your personal data for the following purposes:

• To fulfil our contractual obligations to you (Art. 6(1)(b) GDPR).

• To perform pre-contractual obligations (Art. 6(1)(b) GDPR).

• To respond to enquiries (Art. 6(1)(b) GDPR).

• If you have given us your consent to process your personal data for specific purposes (e.g. to receive our newsletter), data processing is based on your consent (Art. 6(1)(a) GDPR).

• To fulfil legal obligations to which our company is subject (Art. 6(1)(c) GDPR).

• Where necessary, we also process your data to protect our legitimate interests, in particular to assert legal claims and defend ourselves in legal disputes or to ensure IT security, to consult and exchange data with credit agencies to determine creditworthiness and default risks, for direct marketing and market research, provided you have not objected to the use of your data for this purpose, for measures relating to business management and the further development of services and products, for measures relating to product and sales optimisation, for measures relating to risk management, for the prevention or investigation of criminal offences (Art. 6 para. 1 lit. f GDPR).

Categories of recipients of personal data

Within our company, only those employees who absolutely need the data to perform their tasks have access to it (need-to-know principle). Individual processes and services are carried out by carefully selected service providers based within the EEA who are commissioned in accordance with data protection regulations. If service providers commissioned by us have access to personal data when performing their services, data processing agreements have been concluded with them in accordance with Art. 28 (3) GDPR.

Duration of data storage

The data we process is stored for the duration of the existence and execution of the contractual relationship and in compliance with statutory retention periods. These are, in particular, commercial and tax law retention obligations under the German Commercial Code (HGB) and the German Fiscal Code (AO). The regular retention and documentation periods are up to ten years. If no contractual relationship is established, we only process the data for as long as the specific purpose requires.

Data processing in accordance with the Money Laundering Prevention Act

According to Section 2 (1) GwG (Money Laundering Prevention Act), we are obliged to comply with measures to prevent money laundering and terrorist financing. The measures required by law include, among other things, the identification of contractual partners (Section 11 GwG) if a certain transaction amount is exceeded.

Under certain circumstances, we are also obliged to report suspicious transactions or intended transactions (Sections 27 ff. GwG). As part of the prescribed identification and/or reporting process, we collect personal data and, if necessary, pass it on to the Financial Intelligence Unit (FIU). The legal basis for data collection and transfer is Art. 6 (1) lit. c GDPR in conjunction with the respective legal provisions of the GwG.

Unless other legal provisions on recording and retention obligations provide for a longer period in individual cases, we are obliged to retain the data for five years. Once the retention period has expired, the data will be destroyed in accordance with data protection regulations without the need for a separate request.