We may process your personal data in the following situations:
— by visiting our website www.mad-group.com
— by visiting the gallery or meeting us at events and art fairs
— by inquiring by e-mail, phone or via online art platforms
— by subscribing to our newsletter
— by applying for a job
— by delivering goods or services
— by purchasing from us
Article 1 — General terms
1.1. M&AD, as a Belgian company, is compliant with the European Regulation 2016/679 of 27 April 2016 on the protection of personal data (hereinafter ‘GDPR’).
1.2. M&AD takes responsibility for the processing of your personal data.
Article 2 — Processing activities
2.1. Visiting our website
2.2. Meeting us
If you provide us with your personal details during a meeting, we will store these details in our database. Personal data processed include your name and contact details, such as phone number, e-mail address or physical address, as well as your artistic preferences and collections, your marketing and communication preferences or any other information disclosed. Your data are processed so we may invite you to and inform you about our events and the activities of our artists. The legal ground is our legitimate interest (Art. 6.1 f) GDPR). Our vital relationships with collectors, artists and suppliers are recorded in our database. In the context of our research and the maintenance of records pertaining to the ownership of artworks (to assist with checks on authenticity, provenance and title), we will keep this data for as long as the record is relevant to our legitimate business interest and the public interest. Your data will be removed as soon as you express your desire to opt out from or object to the further processing of your data.
2.3. Contacting us
Whenever you contact us via e-mail or telephone, or when submitting an inquiry through an online art platform, you are providing us with your name(s), contact details and the content of your request. This information can be processed and stored, together with our response. Your data are processed for the purpose of responding to your request. The legal ground is the performance of services (Art. 6.1 b) GDPR). Unless the data are necessary for other activities, it will be removed as soon as your request has been handled.
2.4. Our newsletter
You may subscribe to our newsletter. We only process your e-mail address and your name(s) in order to send you a personalised newsletter. The legal ground for this processing is your explicit consent (Art. 6.1 a) GDPR). Your data will be removed as soon as you decide to opt out. You may inform us of your decision to withdraw your consent. You may also unsubscribe via a link at the bottom of each newsletter.
2.5. Your job applications
When applying for a job, we will receive your résumé and a covering letter. We will process this data in order to respond to your job application. Personal data processed typically include your identification details, picture, contact details, education, experience, skills and qualities, as well as any other information you decide to include within your application. Data also include our e-mail correspondence and notes taken during an interview. Your data are processed in order to assess your aptitude to take on a certain position within the company. The legal ground for the processing consists of taking the necessary steps prior to the possibility of entering into an employment contract (Art. 6.1 b) GDPR). When you submit an open application, we will keep your data for up to two (2) years afterwards. When you respond to a job advertisement, we will keep your data for up to two (2) years after the submission of your application. Should you be recruited, we will continue to process your data as part of our human resources administration.
If you are a service provider or a deliverer of goods, we process certain personal data for the execution of the agreement. These data typically include your name(s), legal entity, address(es), contact details, bank details, your general terms and conditions, vat number, invoices, goods and services delivered, e-mail correspondence and all other data you have provided. We need to process your personal data in order for us to execute our contract and for accountancy purposes. The legal grounds for this processing are the performance of the agreement (Art. 6.1 b) GDPR) and our legal accountancy obligations (Art. 6.1 c) GDPR). Your data will be removed after the legal retention time of seven (7) years. After the initial retention time of seven years, we keep records of your professional details for further reference and for up to ten years after the last services rendered.
2.7. Freelance artists, Designers and Experts
If you are a designer, artist or expert, we process certain personal data for the execution of the agreement, but also for future reference. These data typically include your name(s), legal entity, address(es), contact details, bank details, your general terms and conditions, vat number, invoices, goods and services delivered, e-mail correspondence, your artworks, career history, details of your participation in exhibitions and events, your expertise and all other data provided to us. We need to process your personal data in order for us to maintain our professional network and our knowledge of the art market. The legal grounds for this processing is our legitimate interest (Art. 6.1 f) GDPR). Your data will be removed as soon as you express your desire to opt out from or object to the further processing of your data.
If you purchase any work or tickets from M&AD, your personal data will be processed. These data typically include your name(s), address(es), contact details, bank details, invoices, e-mail correspondence and all other data provided to us. We need to process your personal data in order for us to execute our contract and for accountancy purposes. Your name and city of residence will be communicated to the creator of the artwork for archival purposes. For this transfer of data, we will ask for your explicit consent. The legal grounds for this processing are your consent (Art. 6.1 a) GDPR), the performance of the agreement (Art. 6.1 b) GDPR), our legal accountancy obligations (Art. 6.1 c) GDPR) and our legitimate interests (Art. 6.1 f GDPR). The financial data (invoice) of the transaction will be removed after the legal retention time of seven (7) years. The other data (personal details, artwork, artist, price, etc.) are kept in our database for as long as they prove relevant to us in the context of our research and for the maintenance of records relating to sales and ownership of delivered designs and/or artworks (to assist with checks on authenticity, provenance and title). This data will be retained for as long as the record is relevant to our legitimate business interest and the public interest.
2.9. Visiting M&AD
When you have an appointment at M&AD, your name is stored in our agenda and our e-mail correspondence, if any, is kept in our digital mailbox. You may be filmed by surveillance cameras when entering the premises. Processing your personal data is required for organisational purposes. Images taken by our surveillance cameras are made for security purposes. The legal ground for this processing is the performance of an agreement (Art. 6.1 b) GDPR). As for the surveillance cameras (and in part for the agenda), the legal grounds are both our legal obligation to take appropriate technical security measures in order to comply with GDPR (Art. 6.1 c) GDPR), as well as our legitimate interest to have security in place for the safety of our staff. The retention time for the agenda is five (5) years. The retention time of the surveillance footage is one (1) week, in accordance with the timed loop of the surveillance system.
Article 3 — Direct marketing
Certain processing activities may serve marketing purposes, such as those related to our newsletter. Your personal data will only be used for these purposes if you have given your explicit and preliminary consent (‘opt-in’). If you consent to be added to the gallery’s mailing list, your personal data will be used to send you information relating to the gallery’s activities and those of its artists. This consent can be revoked at any time, at no cost and without motivation by clicking the unsubscribe button below every newsletter.
Article 4 — Transfer of your data
4.1. Certain processing activities require the transfer of your data to third parties such as our bank, recruitment agencies, insurers, experts, photographers, caterers, art fair organisers, logistic providers, and third-party cookies. These transfers are necessary for the performance of the contract and/or for our activities as a company. Some of these transfers may be outbound from the EU.
4.2. In the case of M&AD's complete or partial reorganisation, its liquidation or cessation of its activities your personal data may be transferred to new entities or third parties.
4.3. M&AD might be obliged by rule of law, court or administrative order to disclose personal data. M&AD will make all reasonable efforts to inform you beforehand of this transfer of your personal data.
4.4. M&AD will not sell, lease or give away your personal data except in the situations provided for in this policy or unless you have given explicit and preliminary consent.
Article 5 — Your rights
5.1. Access right and right to obtain a copy
You have the right to freely obtain access to your personal data at any moment, as well as to be informed about the purpose of the processing by M&AD.
5.2. Right to correct, delete and limit
You have the choice to share your personal data with M&AD as well as to request their correction, deletion or completion. You acknowledge that a refusal to share data or a deletion request will make the delivery of certain services and/or products impossible. You can also request the processing of your personal data to be limited.
5.3. Right to object
You have the right to object to the processing of your personal data when you have serious and legitimate reasons to do so. You also have the right to object to the use of your personal data for purposes of direct marketing without providing a motivation.
5.4. Right of data portability
You have the right to obtain your personal data which are processed by M&AD in a structured and standard form, which is readable by machines, and/or to transfer this data to another data controller of your choice.
5.5. Right to withdraw consent
When the processing is based on prior consent you have the right to withdraw this consent.
5.6. Exercise of rights
Our Privacy Co-ordinator handles all requests from data subjects, authorities and third parties. You can exercise your rights by contacting us via e-mail: firstname.lastname@example.org or by post: M&AD - Privacy, Marcel Habetslaan 13, 3600 Genk, Belgium.
5.7. Automated decisions and profiling
The processing of your personal data does not include profiling, nor shall you be subjected to automated decisions.
5.8. Right to file a complaint
If you think that your privacy rights have been violated, you have the right to file a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, Belgium, Tel +32 (0)2 274 48 00, Fax +32 (0)2 274 48 35, e-mail: email@example.com. This does not affect your right to file a suit before the civil court. If you have suffered damages caused by the processing of your personal data you can file a claim for damages.
Article 6 — Safety and confidentiality
6.1. We have adopted safety measures which are suited on both a technical and an organisational level to avoid the destruction, the loss, the forgery, the adjustment, the non-authorised access or the accidental disclosure of the personal data to a third party, as well as the non-authorised processing of these data.
6.2. M&AD shall not be liable in any way for direct or indirect damages caused by the wrongful or improper use of personal data by a third party.
Article 7 — Access by third parties
7.1. In order to process your personal data, we need to provide certain employees with limited access to the records.
Article 8 — Cookies
8.1. What is a cookie?
A ‘cookie’ is a small text file that is sent from the server of M&AD and stored on your device’s hard drive. In this way, our systems can remember your preferences when visiting our website. The information stored through these cookies can only be read by M&AD and only for the duration of your visit to our website.
8.3. Your permission
You can block cookies by activating your browser settings to refuse them. The rejection of these cookies may have the effect of not allowing you to use some functionalities on the website. Should you have further questions or remarks regarding the processing of personal data, please contact M&AD by e-mail: firstname.lastname@example.org; or by post: M&AD Privacy, Marcel Habetslaan 13, 3600 Genk, Belgium. General information about cookies can also be found via the following link: http://www.allaboutcookies.org/ Further information about online behavioural advertising and online privacy can be found via this link: http://www.youronlinechoices.eu/