Privacy Policy

This privacy notice (Notice) explains how Woolley and Wallis Salisbury Salerooms Limited (us, we, our, Woolley & Wallis), processes the personal data of users of our auction and valuation services (Services) and includes buyers, bidders and sellers of auction items as well as prospective users of our Services (you, your). It also explains your rights in relation to the personal data we hold about you.

 

Data controller and contact details

Woolley and Wallis is the data controller of your personal data and is subject to the Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR).

If you have any questions about how we use your personal data, whom we share it with, or if you wish to exercise any of the rights set out in this Notice, please contact us using the following details:

• By post – Privacy Officer, Woolley and Wallis Salisbury Salerooms, 51-61 Castle Street, Salisbury, SP1 3SU.
• By email – privacyofficer@woolleyandwallis.co.uk
• By telephone – +44 (0)1722 424599

How we collect your personal data

We collect your personal data from the following sources:

From you when you:

• interact with us before entering into a contract with us, for example when you express your interest in our Services;
• instruct us to provide Services to you, sign contractual documentation and provide information in connection with those instructions;
• communicate with us by post, telephone, email or via our website, for example in order to make enquiries or register for an online account;
• in various other ways as you interact with us during your time as a user (or potential user) of our Services, for the various purposes set out below.

From third parties such as:

• other auction houses and individuals and organisations in the auctioneering trade whom we may contact to check background details about you;
• the-saleroom.com who enable live online bidding and provide us with the name, contact details, the last four digits of registered payment cards and transaction history (in relation to activity on the-saleroom.com) of individuals who register for one of our auctions (please see the-saleroom.com's privacy policy for further information). We also receive names, contact details, sale details and payment details (the amount and date paid) from realex payments (the-saleroom.com's payment provider);
• sage paywho process payments on our behalf and who provide us with your name, contact details and payment details (only the last four digits of your payment card are provided);
• shipping companies whom you hire to collect items you purchased from us.

The categories of personal data we collect

We may collect the following personal data about you:

• your name and contact details including address, telephone and email address;
• your image, as captured by CCTV, if you attend our premises;
• personal identification documents, including copies of government-issued identification such as passport and driving license which are required to register bidders (or when we need to verify a seller's details);
• account details and other information relating to your transactions/dealings with us and your use of our Services;
• payment details such as credit card and bank account details;
• credit and payment history (where you open an account with us as a buyer or bidder);
• information on your collecting preferences and aspirations, and your collections, acquisitions and disposals; and
• other information that you provide to us, for example, when you have a comment/complaint, submit a question, take part in a survey or where you express an interest in receiving marketing material or request further information.

We may also process special categories of personal data, including information concerning your health and medical conditions (for example, disability), where relevant to the provision of our Services.

The basis for processing your data, how we use that data and with whom we share that data.

Where we have a contractual relationship with you

We will process your personal data because it is necessary for the performance of a contract with you (for example, a contract to use our Services) or in order to take steps at your request prior to entering into a contract. In this respect, we use your personal data for the following:

• to interact with you before you enter into a contract with us, such as when you express your interest in our Services (for example, to send you information about our Services or answer enquiries about our Services);
• once you have engaged us and entered into a contract, to provide you with the Services set out in any contractual documents.

In this respect, we will provide your data to our third party suppliers or subcontractors as necessary whom we engage to help us perform our Services or who assist us in conducting our business, such as our IT suppliers, data storage providers, and valuation companies.

Legitimate interests

We may also process your personal data because it is necessary for our or a third party's legitimate interests. Our legitimate interests include our commercial interests. In this respect, we may use your personal data for the following:

• to monitor and evaluate the performance and effectiveness of our Services, including by training our staff or monitoring their performance;
• to deal with any concerns or feedback you may have in the performance of the Services;
• for our internal business record keeping and processes;
• to seek advice on our rights and obligations, including obtaining legal advice;
• to contact you for marketing purposes. If you do not wish to receive such information, please let us know now or at any time in the future, and your details will be removed from our marketing list. We will not provide your personal data to third-party organisations to use for their own marketing purposes;
• to customise our website and marketing communications in line with your particular interests or preferences;
• to collect money owed to us or our consignors;
• to carry out background and credit checks in relation to bidders and buyers.

In this respect we will provide your data to the following:

• our professional advisors;
• the-saleroom.com;
• debt collection agencies;
• third parties who assist us with our marketing;
• our website and email management software provider.

Legal obligations

We may also process your Personal Data for our compliance with our legal obligations. In this respect, we may use your Personal Data for the following:

• to meet our compliance and regulatory obligations, such as our tax reporting requirements or to carry out identity checks;
• in order to assist with investigations (including criminal investigations) carried out by competent authorities;

In this respect we will provide your data to the following:

• external auditors;
• the police and other competent authorities, including HMRC;

Consent

We may also process your Personal Data where we have your specific consent to do so (for example, where we have your agreement to include information about you (as a seller) in sale marketing materials) or where we have sought and obtained your consent to send you direct marketing by email, or for the use of cookies on our website. If you have given your consent and you wish to withdraw it, please contact us using the contact details set out above.

Please note that where our processing of your personal data relies on your consent and where you then withdraw that consent, we may not be able to provide all or some aspects of our Services to you and/or it may affect the provision of our Services.

Special categories of personal data

We process special categories of personal data for the following reasons:

• if it is necessary to protect your or another person's vital interests (for example, where you have a life-threatening accident or illness and we have to process your personal data to ensure you receive appropriate medical attention);
• if it is necessary for the establishment, exercise or defence of legal claims (for example, to protect and defend our rights, and/or the rights of our customers);

We may process information relating to your health where we have your explicit consent to do so (for example, when you provide information about your access requirements prior to attending one of our events).

International transfers of data

We transfer names and addresses on our Asian mailing list to a printing company in Hong Kong to distribute our auction catalogues and promotional material. In these circumstances, your personal data will be transferred subject to standard data protection clauses (adopted by the European Commission) and included in our contract with the printing company.

We share your data collected for marketing purposes and through our website with our website and email management software provider who are based in Jersey. In these circumstances, your personal data is transferred to them subject to an Adequacy Decision made by the European Commission in respect of Jersey. 

Profiling

We may use your geographical location to target our communications and advertising and promotions to you. If you do not wish us to do this, then please contact us using the details provided above.

How long your information is kept

We will retain your personal data for as long as we are providing you with the Services referred to in any contractual document, and for as long as is required for legal, regulatory, fraud prevention and our legitimate business purposes after the termination of your account/agreement with us, or if your application for a particular Service is declined or abandoned.

In particular:

• in relation to CCTV images taken when you attend our premises, we will retain these for a few months;
• in relation to personal data relating to the transactions you have entered into with us as part of the provision of our Services, we will retain that data for a period of seven years after that transaction has concluded in case any legal claims arise out of the provision of those Services;
• we will retain your details on our marketing database until you inform us that you no longer wish to receive our marketing communications. However, where you do unsubscribe from our marketing communications we will keep your details on a suppression list to ensure that we do not send you information you have asked not to receive;
• in relation to personal data relating to the provenance of works, we may retain that data indefinitely in our legitimate interests and the legitimate interests of the wider art market in maintaining the integrity of that market.

Your legal rights

Under the DPA you have the following rights:

• to obtain access to, and copies of, the personal data that we hold about you;
• to require that we cease processing your personal data if the processing is causing you damage or distress;
• to require us not to send you marketing communications;
• to require us to correct the personal data we hold about you if it is incorrect;
• to require us to erase your personal data;
• to require us to restrict our data processing activities (and, where our processing is based on your consent, you may withdraw that consent, without affecting the lawfulness of our processing based on consent before its withdrawal);
• to receive from us the personal data we hold about you which you have provided to us, in a reasonable format specified by you, including for the purpose of you transmitting that personal data to another data controller;
• to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.

If you are not satisfied with how we are processing your personal data, you can raise a concern with the Information Commissioner. You can also find out more about your rights under data protection legislation from the Information Commissioner's Office website available at: www.ico.org.uk.