Privacy policy

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018, of 5 December, on the protection of personal data and the guarantee of digital rights (LOPDGDD), we inform you that the controller of the personal data collected through artheon.es is:

Artheon has not appointed a data protection officer, as none of the circumstances that require one apply. For any question regarding your privacy, you can write to danielmartin@artheon.es.

We only process the data you provide to us or that is generated in the course of your relationship with us:

Contact form

Name, email address, telephone number (optional), reason for the enquiry, work of interest (if any), the message you send us, the page from which you send it and the date and time at which you accept this policy.

Direct communications

The identification and contact details you give us by email, telephone or in person, as well as the information needed to arrange a viewing, an acquisition or a commission (billing details, delivery address, preferences).

Artists and professional partners

Identification, contact, biographical and bank details of the represented artists and of suppliers (carriers, insurers, framers, etc.) needed to perform the contractual relationship. The biographical material and images published on the website are shared with the artist's authorisation.

Browsing data

For security reasons, the systems hosting the website record technical data about connections (IP address, date and time, pages requested, browser type). The website does not use tracking cookies or analytics tools; you can find the details in the cookie policy.

The fields marked with an asterisk in the contact form are required; without them we cannot answer your enquiry. You guarantee that the data provided is accurate and undertake to inform us of any change.

We use your data for the following purposes, each with its legal basis:

• Answering your enquiries about works, artists, private viewings or general information, and maintaining any subsequent contact arising from them. Legal basis: your consent (art. 6.1.a GDPR), given by ticking the box on the form, and steps taken at your request prior to entering into a contract (art. 6.1.b GDPR).
• Managing the relationship with collectors, artists and suppliers: reservations, acquisitions, commissions, certificates of authenticity, deliveries, invoicing and payments. Legal basis: the performance of a contract or of pre-contractual measures (art. 6.1.b GDPR).
• Complying with legal obligations, in particular commercial, tax and accounting obligations, and responding to requests from the authorities. Legal basis: compliance with a legal obligation (art. 6.1.c GDPR).
• Ensuring the security of the website and its systems, preventing abuse and resolving technical issues. Legal basis: Artheon's legitimate interest (art. 6.1.f GDPR) in maintaining the integrity of its services.
• Sending you information about exhibitions, news and activities of the gallery, only if you expressly request it. Legal basis: your consent (art. 6.1.a GDPR), which you may withdraw at any time through the link included in each communication or by writing to danielmartin@artheon.es.

We do not take automated decisions or build profiles with your data.

• Enquiries received through the contact form are kept while they are being handled and for a maximum of one year from the last communication, unless they lead to a contractual relationship.
• Data linked to a contractual relationship is kept while it lasts and, once it has ended, duly blocked for the limitation periods of legal liabilities (generally six years for commercial and accounting purposes, and four for tax purposes).
• Technical connection logs are kept for a maximum of twelve months.
• Data processed on the basis of your consent is kept until you withdraw it.

Once those periods have elapsed, the data is securely deleted.

Artheon does not disclose your data to third parties, except where legally required or where necessary to fulfil your request: for example, passing on to an artist an enquiry about their work, or providing your delivery details to the transport company and the insurer responsible for shipping a work you have acquired.

To provide its services, Artheon relies on providers acting as data processors, with whom it has signed the contracts required by article 28 of the GDPR: web hosting and databases, image storage, email and IT support.

Our providers are, as a general rule, located in the European Economic Area. If any of them processed data outside that area, we would ensure that the transfer has the appropriate safeguards provided for in chapter V of the GDPR (an adequacy decision of the European Commission or standard contractual clauses).

You may exercise at any time the rights granted to you by the regulations:

• Access: find out whether we process your data and obtain a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data when it is no longer needed.
• Objection: object to the processing on grounds relating to your particular situation.
• Restriction: ask us to restrict the processing in the cases provided for by law.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before.

To exercise them, write to us at danielmartin@artheon.es, stating the right you wish to exercise and enclosing a document that proves your identity. We will reply within one month at most, which may be extended by two further months in particularly complex cases.

If you consider that the processing does not comply with the regulations, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, calle Jorge Juan, 6, 28001 Madrid; www.aepd.es). We would be grateful, however, if you let us know first so that we can resolve it.

Artheon applies technical and organisational measures appropriate to the risk to protect your data against unauthorised access, loss or alteration: encrypted communications (HTTPS), access control to the management panel through personal credentials, regular backups and a duty of confidentiality for staff and providers with access to the data.

The website and its services are aimed at adults. We do not knowingly collect data from children under fourteen; if we find that such data has been provided without the consent of their parents or guardians, we will delete it.

Artheon may update this policy to adapt it to changes in the regulations or in its processing activities. The version in force will always be the one published on the website, indicating the date it was last updated (19 October 2026). If the changes are substantial and affect processing based on your consent, we will let you know.