Art Pylkkänen LLP: Privacy Notice

We are Art Pylkkänen LLP, a limited liability partnership incorporated in England and Wales (number OC451379), with its registered office at Third Floor, 20 Old Bailey, London, United Kingdom, EC4M 7AN.

This privacy notice provides information on how we collect and process your personal data (meaning information relating to you personally, from which you can be identified) when you use visit our website or engage our art consultancy services.  

We process your personal data in accordance with the UK General Data Protection Regulation, Data Protection Act and other data protection or privacy laws that may apply to our collection and use of personal data from time to time ('Data protection law').

If you have any questions about this notice, including any requests to exercise your legal rights below, please contact us at guy@artpylkkanen.com or by writing to Art Pylkkänen LLP, PO Box 335, Didcot, OX11 1GP, UK.

This notice was last updated on 9 July 2024. We may amend or update this notice from time to time so please check our website regularly to make sure you have seen the latest version.

Data we collect about you; our legal basis for doing so and the purposes we process it for:

Type of data

Identification data: we will collect your name, email address, phone number, address, company name and address (if applicable) and your payment details.

Lawful Basis

Performance of a contract

Legitimate interest

Legal obligations

We collect this in order to take steps to enter into a contract with you and allow you to engage our art consultancy services

Purpose of Processing

When you contact us either by phone, email, via social media or our 'contact us' page, we will usually collect your name, social media handle and contact details, because it’s in our legitimate interest to make sure we can properly respond to your query.

We may also need to collect and process personal data where necessary in connection with the legitimate interest of being able to properly manage and operate our business.

We may collect certain identification documents (e.g. passports, national identity cards, utility bills or data from official registers) to conduct due diligence or identity checks if we are required to do so by law or under legislation relating to anti-money laundering, proceeds of crime or counter terrorism financing.

Financial data: we will collect credit card details and bank account details

Performance of a contract

To allow you to pay for our art consultancy services.

Who may you share my personal data with?

  • Contract counterparties, business partners and specialists in connection with the services we may provide to you. For instance, with your authorisation, we may disclose your details to contract counterparties such as artists, auction houses or the owners, sellers or buyers of artworks (or their agents, representatives, galleries or dealers).  With your knowledge, we may also engage specialist experts to review issues in relation to the condition, provenance or authenticity of artworks. We may also share your details with providers of insurance and other professionals who you require us to engage from time to time.

  • Our suppliers who we share personal data with so that they can provide services to support our business operations. Thes parties include payment processors, data hosting providers, providers of software support or other 'processors' of your personal data who only act in accordance with our instructions and under a written contract that complies with relevant Data protection law. We may also need to share your data with providers of services to conduct due diligence or identity checks under legislation relating to anti-money laundering, proceeds of crime or counter terrorism financing.

  • Legal Advisers and Regulators/ Authorities/ Enforcement Agencies if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of our clients or others. This includes sometimes exchanging personal data with our legal advisers for the purpose of us being able to obtain legal advice or other companies and organisations for the purposes of fraud protection or to manage any risks to our business. We may also sometimes be compelled by law to disclose personal data to the police, regulatory authorities or the courts (and in some cases cannot tell you in advance).

  • Buyers of our business (prospective and actual) under our legitimate interest to ensure our business can be continued by the buyer, or other businesses we may merge with. We process your personal information for this purpose because we have a legitimate interest to ensure our business can be continued by the buyer. If you object to our use of your personal information in this way, the buyer of our business may not be able to provide services to you.

Where do you store my personal data?

We will store your personal data on third party servers which are based in the UK.

When working with third parties we may need to transfer your personal data outside of the UK and/or EU.

Whenever we transfer your personal information outside of the UK and the EU, we ensure it receives additional protection as required by Data protection law to make sure you have the same standard of protection and privacy as you enjoy in this country. To keep this privacy notice as short and easy to understand as possible, we haven’t set out the specific circumstances when each of these protection measures are used. You can contact us using the details above for more information on this.

How long do you keep my personal data for?

We will only retain your personal data for as long as we need it unless we are required to keep it for longer to comply with our legal, accounting or regulatory obligations.  To deal with future legal claims, we will hold personal data collected during the course of us performing any contract with you for a period of up to 6 years after such contract expires or terminates. The criteria we use for setting data retention periods will be determined by Information Commissioner guidance and decisions of the courts from time to time.

In some circumstances we may carefully anonymise your personal data so that it can no longer be associated with you, and we may use this anonymised information indefinitely without notifying you. We use this anonymised information to improve the way we work and our services.

What are my rights under data protection law?

You have various other rights under applicable data protection laws, including the right to:

  • access your personal data (also known as a “subject access request”);

  • correct incomplete or inaccurate data we hold about you;

  • ask us to erase the personal data we hold about you;

  • ask us to restrict our handling of your personal data;

  • ask us to transfer your personal data to a third party; 

  • object to how we are using your personal data; and

  • withdraw your consent to us handling your personal data.

You also have the right to lodge a complaint with us or the Information Commissioner's Office, the supervisory authority for data protection issues in England and Wales. If you are based in the EU you can find your relevant supervisory authority here.