Personal Data Policy
1 General information
1.1 This policy regarding the handling of personal data ("Personal Data Policy") describes how Bruun Rasmussen Auctioneers of Fine Art A/S ("BRK") collects and handles data about you.
1.2 The personal data policy applies to the personal data that you submit to BRK or the data that is collected via BRK's website: bruun-rasmussen.dk ("the website").
1.3 BRK is the data controller for your personal data. All inquiries to BRK regarding this personal data policy can be made through the contact details listed in paragraph 7.
1.4 BRK protects your data through physical, electronic and administrative means. You should always protect your personal data when you are online. As a minimum, you should change your passwords regularly, use a combination of numbers and letters and make sure your browser is secure. BRK uses SSL (Secure Sockets Layer) standard encryption on pages with personal data. This protects confidential data while they are being transferred over the Internet.
1.5 BRK's website may contain references to other websites and collaborators. As a rule, BRK does not share your personal data with these third parties and cannot be held responsible for their policies regarding the protection of the customers' identity. BRK encourages you to read the policies of the websites in question regarding the protection of personal data.
1.6 On various occasions, TV and video segments are recorded in the Bredgade saleroom in Copenhagen and at BRK's other locations. BRK will on the days in question post signs about the presence of cameras. The recordings are primarily used for television broadcasts. BRK may also use the recordings for other marketing purposes, including on social media. If you do not wish to appear in these recordings, please contact BRK's staff at the given location.
2 What personal data does BRK collect, for what purpose and the legal basis for the handling of this data
2.1 Visits to the website
2.1.1 When you visit BRK's website, you do so anonymously. BRK does not collect any personal data, nor your e-mail address. However, the browser on your computer will disclose your IP address, including your network location, and the type of computer and operating system you are using.
2.1.2 The purpose of the above is to optimize the user experience and the website's function. This processing of data is necessary in order for BRK to continue the process of improving the website.
2.1.3 BRK does not share your data with third parties for remarketing/retargeting purposes.
2.1.4 The legal basis for the handling of the data is article 6 of EU’s General Data Protection Regulation (1) f).
2.2 Customer registration
2.2.1 When you sign up as a customer (create an account), BRK collects the data you provide, for example, name, address, country, valid and verified email address, phone number, password, payment method, in most cases valid debit or credit card, bank details and picture ID. In addition, BRK collects data about which items you bid on, buy, return, have evaluated or sell, delivery requests and data about the IP address from which the transaction was made.
2.2.2 The purpose is to provide you access to use BRK as an auction house. In addition, BRK can fulfil its agreements with you and offer you better customer service, including assisting you with issues related to the desired transactions, as well as managing your right to return items and submitting complaints. BRK also handles data about your purchases and sales in compliance with legal requirements, for purposes such as bookkeeping and financial statements.
2.2.3 The purpose of collecting the data is also to ensure traceability of items as BRK collaborates with the authorities under the Ministry of Justice.
2.2.4 The legal basis for the handling of the data is article 6 of EU’s General Data Protection Regulation (1) b), c) and f), and section 290 of the Danish Criminal Code.
2.3 Newsletters and search agents
2.3.1 When you sign up for BRK's newsletters and/or create a search agent (personalized newsletter), data will be collected about your email address and the types of newsletters you want to receive.
2.3.2 The purpose is to manage BRK's interest in being able to deliver newsletters to you, as well as offer you the special advantage associated with the newsletter subscription, namely to receive relevant information concerning new services, events or auction lots in categories that you have previously expressed an interest in (online marketing).
2.3.3 The legal basis for the handling of the data is article 6 of the EU General Data Protection Regulation. (1) b) and f).
2.4.1 When you sign up for a subscription for a given type of catalogue, BRK collects data about the types of catalogues you want.
2.4.2 The purpose of the above is to be able to deliver the catalogues you have ordered and to fulfil BRK's agreement with you. Data about your purchase of catalogues is handled by BRK to comply with legal requirements for purposes such as bookkeeping and financial statements.
2.4.3 The legal basis for the handling of the data is article 6 of the EU General Data Protection Regulation. (1) b), c) and f).
3 Recipients of the personal data
3.1 As a rule, your data will never be disclosed to third parties unless you explicitly request this.
3.2 BRK, however, passes on the required personal data to the necessary collaborators (e.g. carriers and the catalogue printing company) in connection with the purchase of catalogues and auction lots.
3.3 Data will also be provided to relevant public authorities (e.g. the Danish Nature Agency and the Danish Business Authority) in connection with, for example, applying for permits on your behalf. Finally, your customer data as well as data about transactions, valuations etc. may be disclosed to relevant public authorities (such as the Police) in the case of an ongoing investigation.
3.4 The data can include company name, recipient name, address and telephone number, e-mail address, customer number, auction and lot number, hammer price, bill of delivery, lot description, VAT amount specification, invoice copy, customs documentation etc.
3.5 Data may be left with external collaborators who process the data on behalf of BRK. BRK uses external partners to operate, for example, the financial system, mail system, mail filter, telephone system, shredding of papers, and technical operations and improvements on the website. These companies are data handlers, and under BRK's instructions, they handle the data which BRK is the controller for. The data handlers may not use the data for any other purpose than to fulfil the agreement with BRK and are subject to confidentiality regarding the data. BRK has entered into written data handling agreements with all the data handling companies that handle personal data on behalf of BRK.
3.6 One of these data handlers, Help Scout, is based in the United States. The necessary guarantees for the transfer of data to the United States are secured through the data controller’s certification under the EU-US Privacy Shield, cf. the EU General Data Protection Regulation article 45. A copy of Help Scout's certification can be found here: https://www.privacyshield.gov/participant?id=a2zt0000000KzX1AAK
4 Your rights
4.1 In order to provide transparency regarding the handling of your data, BRK must, as data controller, inform you of your rights.
4.2 Right of access
4.2.1 At any time, you are entitled to request access to whatever data BRK has registered about you, the purpose of this registration, which categories of personal data and recipients of data there may be, as well as information on where the data comes from.
4.2.2 You can access the personal data that BRK has registered about you under your personal page on the website. Here you have the opportunity to both view and modify this data.
4.2.3 You can always contact BRK if you have changes or questions regarding your data.
4.2.4 You are entitled to receive a copy of the personal data that BRK is keeping about you. If you want a copy of your personal data, you must first send a written request to email@example.com. You will be asked to provide documentation stating that you are who you claim to be.
4.2.5 In accordance with the Danish Data Protection Agency’s instructions, the price for the above service is DKK 10 (Incl. VAT) per commenced page handed out.
4.3 Right to rectification
4.3.1 You are entitled to have incorrect personal data about yourself corrected. If you become aware that there are errors in the data that BRK has registered about you, you can log on to your personal page on the website, where you can change this data.
4.3.2 You can always contact BRK if you have any other changes or questions regarding your data.
4.4 Right to erasure
4.4.1 In some cases, you have the right to have all or some of your personal data erased by BRK. For example, if you revoke your consent, and BRK has no other legal basis to continue the handling of your data. To the extent that a continued handling of your data is necessary, for example, to allow BRK to be in compliance with its legal obligations, or for legal claims to be determined, enforced or defended, BRK is not required to delete your personal data.
4.4.2 In the event that you wish all or some of your personal data erased by BRK and this turns out to be undoable due to one of the reasons listed above, BRK will instead keep your data in a protected environment with highly limited access.
4.5 The right to limit the handling to storage only
4.5.1 In certain cases, you have the right to limit the handling of your personal data to consist of storage only, for instance, if you believe that the data BRK is handling about you is incorrect.
4.6 Right to data portability
4.6.1. You may, in certain cases, have the right to obtain personal data that you yourself have provided BRK, which will be given to you in a structured, commonly used and machine-readable format. You also have the right to transfer this data to another data controller.
4.7 The right to object
4.7.1 You are entitled at any time to object to BRK's handling of your personal data for direct marketing purposes, including the segmentation done to more accurately target BRK's direct marketing.
4.7.2 In addition, you may at any time, for reasons relating to your personal situation, object to the handling of your personal data, which BRK undertakes based on our legitimate interests, cf. 2.1 - 2.4.
4.8 The right to withdraw your consent
4.8.1 At any time, you are entitled to withdraw a consent you have given to BRK for the handling of your personal data, including signing up for newsletters, search agents, catalogues and online marketing. If you wish to withdraw your consent, you have to log on to your personal page via the website and change your personal settings.
4.9 The right to lodge a complaint
4.9.1 At any time, you are entitled to lodge a complaint with the Danish Data Protection Agency, Borgergade 28, 5, 1300 Copenhagen K, about BRK's handling of your personal data. The complaint can, among other things, be submitted via email to firstname.lastname@example.org or by phone on +45 3319 3200.
5 Deletion of personal data
5.1 Data collected about your use of the website, cf. 2.1., will be deleted no later than a year after your latest activity on the website.
5.2 Data gathered in connection with your registration for newsletters, search agents or catalogues will be deleted as soon as your consent is withdrawn, unless BRK has another legal basis for handling the data.
5.3 As BRK collaborates with the authorities in connection with ongoing cases concerning crimes such as fencing, forgery and fraud, BRK does not normally delete personal data. Data collected in connection with transactions (bids, purchases, consignments and sales) that you have carried out either on the website or at traditional auctions, cf. 2.2, will, as a rule, be placed in a protected environment with limited access for three years following the end of the calendar year in which you made your transaction. Data may be stored for a longer time than this when there is a legitimate need for longer storage time, for instance, if this storage proves necessary for legal claims to be determined, enforced or defended, or if storage is required by BRK to comply with legal requirements. Accounting materials are kept for five years until the end of a financial year in order to comply with the requirements of the Danish Financial Statements Act.
6.1 BRK has implemented appropriate technical and organizational security measures to prevent the accidental or illegal destruction, loss, change or deterioration of the personal data, as well as unwanted parties gaining access to and/or misusing the personal data.
6.2 Only those of BRK's employees who have a real need of your personal data in order to perform their job have access to these.
7 Contact information
7.1 BRK is the controller of the personal data collected via the website.
7.2 If you have questions or comments about this personal data policy or wish to make use of one or more of your rights described in paragraph 4, please contact:
Bruun Rasmussen Auctioneers of Fine Art
Tel.: +45 88 18 11 11
8 Changes in the personal data policy
8.1 If BRK makes changes to the personal data policy, you will be informed of this at your next visit to the website or upon receiving your receipt material in connection with bidding, purchase, consignment or sale at auction.
8.2 If you have signed up for a newsletter, search agent or catalogue subscription, you will be informed of the policy changes via a newsletter to your registered email address.
This is the second version of BRK’s personal data policy, dated 15 May 2018.