Privacy Notice

Bartha Contemporary Ltd (“we”, “us”) is the controller of the personal data described in this notice. We are a company registered in England and Wales under company number 07863410, with our registered office at 36 Scotts Road, Bromley BR1 3QD. Our gallery and correspondence address is 7 Ledbury Mews North, London W11 2AF, and we are registered with the Information Commissioner’s Office under registration number ZA868878.

We have not appointed a data protection officer; the law does not require one for a business of our size and kind. Questions about this notice or your personal data go to the gallery’s directors at info@barthacontemporary.com, or by post to the gallery address above.

Our representative in the European Union, under Article 27 of the EU General Data Protection Regulation, is Niklas von Bartha, Bartha Contemporary, Doyenweg 17, 59494 Soest, Germany, telephone +49 2921 3542605. If you live in the European Union you may contact our representative, as well as us, about anything in this notice, and data protection supervisory authorities in the EU may contact our representative too.

This notice covers visitors to our website, people who contact us, subscribers to our emails, people who follow our artists, clients and buyers, and the professional contacts we work with: museums, galleries, auction houses, art advisers, interior designers, architects, press and other partners. Where the rules differ between private individuals and professional contacts, we say so. Our Terms & Conditions and Anti-Money Laundering Statement explain related matters. We never sell personal data.

The table sets out, for each purpose, what data we use, where it comes from, our lawful basis under the UK GDPR, who receives it and how long we keep it. On a narrow screen, the table scrolls sideways.

You can browse the website without telling us who you are. To buy from us, we need your contact and delivery details to perform the contract, and the law requires us to check your identity (section 5.2); if you do not give us what the checks need, we cannot complete the sale. Everything else is your choice.

5.1 Email correspondence with our staff

Our staff use Google Workspace. Where a member of staff has connected their mailbox to our CRM, emails between that mailbox and a person already on our records are linked to that person’s record: we copy the sender, recipients, date, subject and a short snippet of up to 300 characters, never the full message, which stays in the mailbox. For professional contacts, and when a member of staff asks for it, the CRM also reads the three most recent emails from you to suggest contact details from your email signature, such as a telephone number or website; nothing is saved unless the member of staff confirms it. Emails our staff send you from the CRM do not track whether you open them.

5.2 Identity checks and sanctions screening

As an art market participant, we must check the identity of buyers and sellers in transactions worth 10,000 euros or more, including linked transactions, and we check every client’s identity before a card purchase on our website.

We also screen everyone in our contact records each week, not only buyers and sellers, because a small gallery cannot know in advance who will become a client. We check names against five public lists: the UK Sanctions List (Foreign, Commonwealth and Development Office), the EU consolidated financial sanctions list, the US Treasury’s OFAC lists (the SDN List and the Consolidated non-SDN List), the UN Security Council Consolidated List and the Swiss SECO sanctions list. We use your name, country and organisation, and your nationality and date of birth only if we already hold them for another reason; we do not collect anything extra for screening. The matching runs on equipment we control, and only the public lists are downloaded; your details are not sent anywhere.

A possible match is reviewed by a member of staff, who decides whether it is a real match and writes down why. We aim to review each one within two working days. While the review is open, we pause online card payment, offers, invoices and payment links for that person. This is a holding step, not a decision: a person decides, and nothing is reported to any authority unless a member of staff has confirmed the match. If the match is cleared, everything carries on as before. Section 8 says how long we keep the results. Our Anti-Money Laundering Statement explains what we ask for and why.

5.3 Email marketing and measuring opens and clicks

We send exhibition news, invitations and news about new works through our own system, using Resend to deliver the emails. Private individuals receive them only with their consent, which we confirm by email (double opt-in): we send you a link, and you press Confirm on the page it opens. Professional contacts at organisations may receive them on the basis of our legitimate interests. You can ask for them on our newsletter form, or by ticking the box for news on our enquiry, offer, purchase and booking forms; the box is never ticked for you, and if you leave it empty nothing changes. Every email has an unsubscribe link, and unsubscribing takes effect at once.

If you buy a work from us, we may also email you news of exhibitions and works similar to the one you bought, without asking you to sign up first (the “soft opt-in” that the Privacy and Electronic Communications Regulations allow). Your purchase confirmation lets you say no at once, and so does every email we send. If you have unsubscribed from our emails before, we do not add you. Professional contacts receive our news on the basis of our legitimate interests. We treat a professional contact as working for a company unless we know otherwise; if you are a sole trader, or in a partnership other than an LLP or a Scottish partnership, tell us and we will email you only with your consent.

A campaign email can contain a small image and personalised links that tell us whether it was opened and which links were clicked, with the approximate country and city of your connection and the email program used. Since 5 October 2026 we do not record the region or map coordinates. We include them only for people who agreed to this measurement: when you sign up for our newsletter on our website, the wording you confirm tells you about it, and pressing Confirm is your agreement. Subscribers who agreed to it when they joined our earlier mailing list are measured too. Everyone else, including people who follow an artist under wording that does not mention it and every professional contact who receives our emails on the basis of our legitimate interests, receives emails with no measuring image and with plain links that go straight to where they point, through no tracking service. You can ask us at any time to stop measuring your emails, and we will record that and stop, without unsubscribing you; unsubscribing stops the emails altogether. We keep records of deliveries, bounces, opens and clicks while you are subscribed. After you unsubscribe, we delete those older than 24 months, remove the region and coordinates recorded before 5 October 2026 and any location kept with your unsubscribe, and delete opens and clicks recorded before 3 October 2026 if you had not agreed to measurement. Confirming your subscription does not mean you agree to profiling (section 5.6).

5.4 Following artists

When you follow an artist and confirm your email, we email you about that artist’s new works and exhibitions. A token stored in your browser (bc_follow_token) then lets us record which works you look at on our website, up to the 50 most recent, so that what we send you is relevant. People who have not followed an artist send us nothing of this kind: the “Recently viewed” strip on work pages is kept only in your own browser.

5.5 The chat and voice assistants

Our website offers two optional AI assistants: one you can type to and one you can speak with. They are AI systems, they can make mistakes, and you can ask for a person at any time. The text assistant sends your messages to Anthropic to produce an answer; we do not keep a copy of that conversation ourselves. The voice assistant is provided by ElevenLabs, which records the conversation and keeps its transcript; we keep voice recordings and transcripts for 3 months, after which they are deleted automatically, unless the conversation leads to an enquiry. If an assistant prepares a selection of works for you, the selection and the conversation behind it are kept for 90 days unless you save or share the selection. Please do not share sensitive personal information with the assistants. Live chat with a member of our staff is treated as correspondence. Part 3 of our Terms & Conditions explains where and how we use AI.

5.6 Lead scoring and the opportunity engine (profiling)

To look after our relationships well, our CRM gives each contact an engagement score. It adds up weighted points for recent interactions with us (a purchase or an offer counts most; an email open counts least) and lets older interactions fade over time, then places the contact in a band from “cold” to “hot”. Once a week, our opportunity engine looks at the contacts we have been in touch with in the last 90 days and suggests to our staff who might like to hear about which works, and why. For this, Anthropic receives a pseudonymised extract: a reference code, your contact type (for example collector or curator), your country, the artists you are interested in, and your recent contact with us as the channel, direction, date and the artist or work concerned. It never receives your name, email address, telephone number, our notes or the text of your messages. Anthropic keeps what it receives only for the limited period its commercial terms allow, and does not train its models on it. If you unsubscribe from our emails, the engine leaves you out of its suggestions; your score stays, because it helps us look after you when you get in touch.

Separately from the score and the engine, our staff may note a budget range or buying habits, such as buying at fairs. Unless you told us yourself, these are our staff’s estimates, and the record says so. You can ask to see them, have them corrected or have them removed.

A member of staff reviews every suggestion and decides whether to act on it. Neither the score nor the engine makes any decision about you that has legal or similarly significant effects: they do not decide prices, whether we will sell to you or the terms of a sale. You can object to this profiling at any time, as explained in section 9, and we will then leave you out of it.

5.7 Contact enrichment

For professional contacts only, our staff may look up missing business details from public professional sources: Companies House and OpenRegister (company registers), Wikidata, the contact’s own website and email signature, Hunter.io’s email finder, postcodes.io (to fill in the town and region from a postcode), and an image search (Brave Search, unavatar.io and Wikipedia) for a public profile photo. Every result is a suggestion that a member of staff must confirm before it is saved. We do not use people-search services or collect details from private social media.

5.8 Historical records from 2017 onward

Our CRM holds records of people who enquired with us or bought from us since 2017, taken from the gallery’s own enquiry and sales records, with notes our staff compiled from them: names, email addresses, locations, the artists and works concerned, dates and past purchases. We keep them to have an accurate history of our client relationships, on the basis of our legitimate interests. They are not used to send you marketing unless you have given your consent. Buyer records are kept for 6 years after the relationship ends; older enquiry records are reviewed against the periods in section 8, and a member of staff confirms each deletion, because we are often in touch with people by telephone or in person. You can object to our keeping your record, or ask us to delete it, at any time.

The same applies to records we took from our previous CRM and to people our staff added from their correspondence. If we hold your details from one of these sources and have not yet written to you, the first email we send you, personal or a mailing, includes a short line that links to this notice, and we note on your record that we gave it.

5.9 Website analytics

We use Plausible, which we run on our own server, to count visits without cookies and without identifying you. On a few key pages we also measure, on our own servers, where visitors click and how far they scroll, kept only as anonymous totals, and how quickly pages load, kept for 14 days and then only as daily totals. Only if you allow analytics do we load Google Analytics, which measures how our website is used; only if you allow advertising do we load the Meta Pixel and the Pinterest Tag, which measure our advertising and help us reach relevant audiences on Facebook, Instagram and Pinterest. You can allow one without the other. Section 11 lists the cookies.

5.10 Approximate location

When you send an enquiry, start a live chat or sign in to your client account, and, if you agreed to email measurement (section 5.3), when you open or click one of our emails, we record the country and city that our hosting provider derives from your IP address. We do not store the IP address, and since 5 October 2026 we do not record the region or map coordinates. We use it to understand where interest in our artists comes from and to spot unusual sign-ins. Email records made before then may still hold the region and coordinates, and older opens of personal emails from our staff may hold a location; we keep email records while you are subscribed and remove these details when you unsubscribe (section 5.3).

5.11 WhatsApp

If you message the gallery on WhatsApp, we receive your telephone number, the name on your WhatsApp profile and your messages, and we note when you send a photo, voice note or document. The conversation reaches our inbox, is linked to your record if we have one, and is kept as correspondence: reviewed 2 years after our last contact, as for enquiries (section 8). Our staff may also message you on WhatsApp from the gallery’s account when you have given us your number.

When we reply to you one-to-one about something you asked us, that is correspondence, not marketing. We send promotional messages on WhatsApp, such as news of exhibitions or new works, only if you have agreed to receive them there, and you can tell us to stop at any time by replying STOP, by telling us in any other words or by writing to us.

WhatsApp is provided by WhatsApp Ireland Limited, part of Meta. Where we send and receive messages through WhatsApp’s business platform, Meta processes them on our behalf under its data processing terms. Your own use of WhatsApp is governed by WhatsApp’s terms and privacy policy. Messages may be transferred to the United States (section 7).

We share personal data only with service providers acting on our behalf, under their data-processing terms, and with others where the law requires. Our main providers are:

We may also share personal data with fine-art handlers and couriers who deliver your work, our accountants, lawyers and other professional advisers, our bank, and with HMRC, the National Crime Agency, the police, the Office of Financial Sanctions Implementation or other authorities where the law requires. We also use OpenAI and Google’s Gemini models to monitor what AI answer services say about the gallery and its artists; that sends no information about visitors or clients.

Some of our providers are based in, or give access to data from, countries outside the United Kingdom, including the United States. Where a recipient in the United States is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), we rely on that. Otherwise we rely on the UK International Data Transfer Agreement, or on the UK Addendum to the European Commission’s Standard Contractual Clauses. The table in section 6 gives the safeguard for each provider. Transfers to the European Economic Area rely on the UK’s adequacy regulations. Where the EU GDPR applies to the personal data of people in the European Union, we rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards that apply to a transfer by writing to info@barthacontemporary.com.

Where a period says a record is reviewed, our system lists it for a member of staff when the period ends, and the record is deleted only once they confirm that we no longer have a relationship with you. Other data is deleted or made anonymous automatically when its period ends. Deleted data may remain in our backups for a short time until they are overwritten. You can ask us to delete your record at any time (section 9).

You also have the right to:

• access your personal data and receive a copy;
• rectification: have inaccurate data corrected and incomplete data completed;
• erasure: have your data deleted, unless we must keep it, for example for anti-money-laundering or tax records;
• restriction: ask us to limit our use of your data while a concern is resolved;
• data portability: receive data you gave us, in a structured, machine-readable format, where we use it on the basis of consent or a contract;
• withdraw consent at any time, where we rely on consent; this does not affect what we did before;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We do not make such decisions. The pause on online sales while a possible sanctions match is reviewed (section 5.2) is a holding step until a person decides.

To use any of these rights, email info@barthacontemporary.com or write to the gallery. It is free. We may ask you to confirm your identity. We reply within one month; if a request is complex, we may extend this by up to two further months, and we will tell you why within the first month.

If you are unhappy with how we have handled your personal data, please tell us first: email info@barthacontemporary.com with the subject “Data protection complaint”. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office (ico.org.uk, telephone 0303 123 1113). If you live in the European Union, you may also complain to the data protection supervisory authority in your country.

Cookies, local storage and session storage are small pieces of information kept by your browser. We use the ones in the table below. Those marked “Yes” are set only if you allow their purpose in our cookie banner: analytics (Google Analytics) or advertising (Meta Pixel and Pinterest Tag). The banner offers “Accept all”, “Reject all” and “Choose”, which lets you allow each purpose on its own. We ask again after 12 months, or sooner if the tools we use change.

Plausible analytics, our click and scroll measurement and our page speed measurement use no cookies and no identifiers. Cloudflare Turnstile checks your browser when you send one of our forms, to keep out spam.

Record of your choice. When you choose, your browser also sends us a receipt: a random receipt number, your answer for each purpose, the version of this policy and the time. It contains nothing that identifies you, and we keep it for 24 months as a record of consent.

Changing your choice. Use the “Cookie settings” link in the footer of every page, or at the foot of our Instagram, TikTok, RedNote and Pinterest link pages and of the web copies of our mailings. It shows your choices again, so that you can change them. When you turn a purpose off, we delete the cookies its tools set on our website’s domain and reload the page so that they stop. Cookies that Google, Meta or Pinterest keep on their own domains are outside our reach; you can delete them in your browser settings.

Maps and videos. The map on our About page comes from Google and is loaded only when you press “Show map (Google)”; until then nothing is sent to Google, and a plain link opens Google Maps in a new tab instead. Vimeo videos on our website play with Vimeo’s do-not-track setting, which stops Vimeo setting cookies or recording your viewing, and YouTube videos come from YouTube’s privacy-enhanced service (youtube-nocookie.com), which sets no cookies until you play a video.

We use technical and organisational measures that include encryption in transit, passwords stored only as one-way hashes, two-step sign-in for staff, access controls and a log of staff actions. No method is perfectly secure; if you suspect misuse of your data, please contact us at once.

Our website and services are not directed at children under 16, and we do not knowingly collect their personal data. You must be 18 or over to open a client account or to buy from us.

We update this notice when our processing changes. The current version is always on this page, and we will tell registered clients by email about material changes.