Privacy Notice

This privacy policy was last updated on 4th August 2026.

At Alison Jacques, we understand that your privacy is important to you and that you care about how your information is used and shared. As a Data Controller, we respect and value the privacy of everyone who uses our services and will only collect and use information in ways that are consistent with your rights and our obligations under the Uk GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

Our Privacy Notice aims to provide you with key information about:

• What data we collect from you and why

• How we use or process that data

• How long we store data

• How you can access and take ownership of your data

• How and where you can make a complaint if you’re unhappy

Please read this Privacy Notice carefully and ensure that you understand it.

If you do not accept and agree with this Privacy Notice, you should stop using our services immediately.

Who are we?

Alison Jacques is a limited company registered in England under company number 04961190. Our registered office is

22 Cork Street, London, W1S 3NG

In accordance with data protection law, we are registered as a data controller with the ICO. Reg no. ZA389217.

Our Data Privacy Officer is responsible for managing our compliance with data protection law and for effectively overseeing all queries from data subjects about their personal data.

For all data related matters, including subject access requests, please contact our Data Privacy Officer

Alison Jacques

dpo@alisonjacques.com

Telephone Number +44 (0)20 7631 4720

What data do we collect?

Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

• Identity Data - First name, last name, title, and institutional or company affiliation.

• Contact Data – Email address, billing address, delivery address, and telephone numbers.

• Financial Data - Bank account and payment card details (processed securely via our encrypted payment providers; we do not store raw card details).

• Transaction Data - Details about payments to and from you, and specific records of artworks you have enquired about, viewed at art fairs, or purchased from us.

• Marketing and Communications Data - Your preferences in receiving marketing from us (such as our exhibition newsletters or art fair previews) and your communication preferences.

• CCTV Footage – Images and video footage captured by our Closed-Circuit Television (CCTV) system when you visit our physical gallery premises.

How we collect your personal data?

We use different methods to collect data from and about you, including:

• Filling in request forms on our website

• Emailing us directly

• Subscribing to our mailing list

• Corresponding with us by email/phone

• Leaving details with us in person at our London gallery or international art fairs

What is our lawful basis for processing your data?

Under the UK GDPR, we must have a valid legal reason to process your data. Most commonly, we use your data in the following circumstances:

• Performance of a Contract - Where we need to fulfil a contract that we are about to enter into or have entered into with you, such as selling and delivering an artwork.

• Legitimate Interests - Where it is necessary for our legitimate business interests, for example, managing our relationship with collectors, keeping our gallery secure, or analysing how our website is used, provided your fundamental rights do not override those interests.

• Compliance with a Legal Obligation - Where we need to comply with a legal or regulatory law e.g., UK anti-money laundering regulations for high-value art transactions or financial record-keeping laws.

• Consent - Generally, we rely on your explicit consent as a legal basis for sending direct marketing communications via email. You can withdraw your consent at any time.

Who do we share your data with?

We never sell your personal data. However, to run our gallery effectively and deliver your artwork, we may share your information with trusted third parties:

• Service Providers – Our primary database provider is Artlogic and their Privacy Notice can be found here https://artlogic.net/legal/pri…;

• Internal support- IT Services Supplier

• Logistics and Shipping Companies - Fine art couriers, shippers, and customs agents who require your delivery details to securely transport purchased artworks to your location.

• Professional Advisers - Our lawyers, bankers, auditors, and insurers who provide professional consultancy services.

• Financial and Legal Authorities - HM Revenue & Customs law enforcement, or regulatory bodies in the UK where we are legally required to disclose information.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

We do not sell your data to any third parties.

How do we keep your data secure?

Your data is important to us, so we take all appropriate technical and organisational measures to protect your personal information by:

• Putting appropriate security measures in place, to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed in an unauthorised way.

• Limiting access to your personal data on a ‘need to know’ only basis.

• Ensuring our staff are trusted and trained in data protection compliance and confidentiality.

• Following due process to deal with any suspected personal data breach.

• Only retaining your personal information for as long as necessary to fulfil the purpose we collected it for.

International Transfers

Because the art market is global, Alison Jacques frequently participates in international art fairs and works with international artists, estates, and collectors. This means your personal data may sometimes be transferred to, or stored in, a destination outside the United Kingdom and the European Economic Area (EEA).

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government.

• Where we use certain service providers, we may use specific Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) approved for use in the UK, which give personal data the same protection it has in the UK.

How long do we retain your data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for satisfying any legal, accounting or reporting requirements.

For example, by law, we must keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for six years after they cease being customers for UK tax compliance and corporate record keeping.

If you would like more specific information on our data retention periods, please contact our Data Privacy Officer.

Your legal rights

We fully support your rights and we will always seek to uphold them. However, if you ever feel this is not the case please contact our Data Privacy Officer, to discuss the matter further.

At any point you can exercise your:

• Right of access – contact us for a copy of the data we hold about you.

• Right of rectification – let us know if the data we hold is out of date or inaccurate and we’ll update it.

• Right to be forgotten – if you no longer want to use our services, please contact us and we’ll delete all related data.

• Right to restrict processing – we only ever collect data we need and actively ensure we’re never collecting anything over and above need. You can opt in and out of our services by contacting us.

• Right of portability – we will support reasonable requests to transfer your data to another organisation should you require it.

• Right to object to automated decision making and profiling- we do not currently use any automated profiling of any description.

You will not have to pay a fee to access your personal data, or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these extreme circumstances.

In the event you are unhappy with the way we’re processing your data please contact Data Privacy Officer (Contact details above) directly in the first place.

If this does not resolve your compliant to your satisfaction, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the United Kingdom’s Supervisory Authority.

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

Tel: 0303 123 1113

Email: https://ico.org.uk/global/cont…