RSAS / Privacy Policy
Privacy Policy
Draft wording, pending review by RSAS’s solicitor.
Last updated: coming soon
1. Who we are
RSAS Ltd ("RSAS", "we", "us") trades as Research Sourced Art Solutions. We buy and sell works of art and provide research on art acquisitions and sales.
RSAS Ltd is registered in coming soon with company number coming soon. Our registered office is coming soon.
We are the controller of the personal data described in this policy. You can contact us about your data at gallery@rsasltd.com or coming soon.
2. The data we collect
| When | What we collect |
|---|---|
| You send an enquiry | Your name, email address or phone number, and your message |
| You ask us to sell a work | Details and photographs of the work, and what you tell us about its history |
| You buy or sell through us | Billing and delivery details, and the records of the transaction |
| We carry out identity checks | Identity documents, proof of address and, where the law requires it, the source of funds |
| You join our mailing list | Your name, email address and your interests |
| You visit the website | Basic technical logs kept by our hosting provider, such as IP address, date and time |
We do not ask for sensitive personal data, such as health information. Please do not send it to us.
3. Why we use your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| To reply to your enquiry | Our legitimate interest in answering people who contact us |
| To arrange a viewing, purchase, sale or consignment | To take steps before a contract, and to perform a contract with you |
| To verify your identity and keep the records the law requires | Legal obligation, including anti-money-laundering law |
| To send news about works and artists | Your consent, which you can withdraw at any time |
| To keep the website secure and working | Our legitimate interest in running a safe website |
We do not sell your data. We do not use it for automated decisions or profiling.
4. Marketing
We send marketing emails only if you have asked for them. Every email has an unsubscribe link. You can also ask us to stop at gallery@rsasltd.com.
5. Who we share your data with
- Service providers who work for us under contract: hosting provider, form provider and email provider.
- Professional advisers, such as solicitors and accountants.
- Shippers, insurers, framers and conservators, when you buy or sell a work.
- The other party to a sale, but only the details needed to complete it, and never an owner's identity without their agreement.
- Regulators, tax authorities and law enforcement, where the law requires it.
6. Transfers outside the UK and the EEA
We aim to keep your data in the UK or the European Economic Area. If a provider stores data elsewhere, we use the safeguards the law requires, such as approved standard contract clauses.
7. How long we keep your data
| Data | How long |
|---|---|
| Enquiries that do not lead to a transaction | Up to 12 months |
| Transaction, provenance and tax records | At least 6 years |
| Identity and due diligence records | 5 years after the business relationship ends |
| Mailing list details | Until you unsubscribe |
8. Your rights
You have the right to ask for a copy of your data, to ask us to correct or delete it, to ask us to restrict how we use it or object to our use of it, to ask for your data in a portable format, and to withdraw consent at any time.
To use any of these rights, contact us at gallery@rsasltd.com. We reply within one month. There is no charge.
9. Complaints
If you are unhappy with how we have handled your data, please tell us first at gallery@rsasltd.com. We will acknowledge your complaint within 30 days and reply without undue delay.
You can also complain to a regulator:
- United Kingdom: the Information Commissioner's Office (ico.org.uk)
- Gibraltar: the Gibraltar Regulatory Authority (gra.gi)
- Spain: the Agencia Española de Protección de Datos (aepd.es)
10. Security
We protect your data with access controls, encrypted connections and careful choice of providers. No website can promise complete security. We will tell you and the regulator if a breach puts you at risk.
11. Children
Our website and services are for adults. We do not knowingly collect data from anyone under 18.
12. Changes to this policy
We may update this policy. The date at the top shows the latest version.