Ocula Privacy Policy

WHAT IS A PRIVACY POLICY?

In order for Ocula to present you with the best in global contemporary art, it processes personal data relating to artists, gallerists, its clients and other third parties.

This Privacy Policy sets out important information about our data processing activities. We encourage you to take the time to read the contents of this Privacy Policy so you can better understand what personal data we process, why we process it, what happens to your personal data and what rights you have in relation to your personal data. It applies to the processing of personal data in relation to services provided by Ocula which includes the operation of the Ocula website https://ocula.com/, the operation of Ocula's art advisory business and the provision of relevant services to galleries and art institutions.

When we refer to "Ocula", "us", "we" or "our" what we really mean is Ocula Ltd, a limited liability company registered in New Zealand (company number: 2292868; New Zealand Business Number: 9429032080049) and whose registered office is at PO Box 47415, Ponsonby, Auckland, 1144, New Zealand. Ocula is a Controller of your personal data.

It is important that you read this policy together with any other privacy notice or fair processing notice we may provide at the point of collecting or processing your personal data. This policy supplements those notices and is not intended to override them. However, it does supersede earlier versions of this Privacy Policy.

WHAT PERSONAL DATA DOES OCULA COLLECT?

When we refer to "personal data" we mean information about an individual from which that person can be identified.

Types of personal data we collect

We process different types of personal data depending on who you are.

I am...

We process your...

An Ocula Member

If you have a My Ocula account with us, we may process the following in relation to you:

full name, email address, contact telephone number, city of residence, gender, date of birth and art profile
marketing and communication preferences
artwork preferences
artists and galleries you opt to follow on Ocula
data relating to the services we provide, including information about artworks you made enquiries about, services we have provided, what contacts have been made and what payments have been made in connection with these services
IP address

A subscriber to Ocula's e-newsletter

If you subscribe to Ocula's e-newsletter or other marketing initiatives by Ocula, we may process the following in relation to you:

full name, email address, contact telephone number, and art profile
marketing and communication preferences
artwork preferences
what sections of our e-newsletters you click on when you click on our e-newsletter
data relating to the services we provide, including information about artworks you made enquiries about, services we have provided, what contacts have been made and what payments have been made in connection with these services.

An Artist featured on our Website

If you are an artist featured on our website, we may process the following in relation to you:

full name, year of birth, place of birth
biography details
artwork details
representing gallery details
publications about you.

An Artist whose artwork we purchase or assist with the purchase of

If you are an artist and our advisory business purchases your artwork or assists with the purchase of your artwork, we may process the following in relation to you:

full name, year of birth, place of birth
biography details
artwork details
representing gallery details
publications about you
marketing and communication preferences
data relating to the services we provide, including what services we have provided, what contacts have been made and what payments have been made in connection with these services
if we purchase the artwork directly from you your bank details and/or credit card details.

An Ocula Client

If you engage our services or enquire about them, we may process the following in relation to you:

full name, email address, contact telephone number and postal address
bank details or credit card details
data relating to the services we provide, information about your art collection and art purchases and sales, your artwork preferences, what services we have provided, what contacts have been made and what payments have been made in connection with these services
your preferences in receiving marketing from us, as well as your communication preferences
personal data about your representative(s), being their full name, contact telephone number, email address, what services we have provided, what contacts have been made and what payments have been made in connection with these services, and their preferences in receiving marketing from us, as well as their communication preferences.

A Gallery Member

If you are, or sign up to become, a gallery member, we process information that is not personal data (such as the name of your organisation). We also process payment details, including bank account details or credit card details. We also process personal data about your representative(s) including their full name, contact telephone number and email address.

An organisation member (not being a commercial Gallery)

If you are, or sign up to become, a member and have a profile on Ocula or we otherwise enter into a formal partnership arrangement with you, we process information that is not personal data (such as the name of your organisation, payment details, including bank account details or credit card details).

We also process personal data about your representative(s). We process their full name, contact telephone number and email address.

A Guest at an Ocula event

If you sign up to attend an event we run alone, or jointly with a third party, we process your full name, email address and contact telephone number, and your preferences in receiving marketing from us, as well as your communication preferences.

An Advertiser

If you would like to reach our global audience of collectors, designers, art enthusiasts, art students, curators, artists and gallerists and you enquire or use our advertising services we process personal data about you, or your representative, including bank account details or credit card details.

We also process your representative's personal data. We process their full name, contact telephone number and email address.

A Visitor to our Website

When you visit our website, we process information about how you use our website, for example we process personal data about your internet browser, operating device and application identifiers, IP address and geo-location information, access times and dates, referring and exit pages, URLs, clickstream data, search items, currentPages viewed, time spent on pages, bounce rate and login frequency. Some of this information is only collected if you consent to us deploying cookies and other similar technologies when you visit our website.

A Visitor to our Viewing Rooms

When you visit one of the viewing rooms hosted on our website, we collect your email address and may collect your name too prior to your entry into the viewing room. If you have consented to our use of cookies and other similar technologies, we also collect your approximate location, which we determine from your IP address.

An interviewee

If you are interviewed by Ocula for publication on Ocula.com, we may process your:

full name, email address, contact telephone number and possibly your postal address
your preferences in receiving marketing from us, as well as your communication preferences
personal data about your representative(s).

A representative, agent, advisor or employee of one of our clients

If you are an agent, advisor or an employee of one of our clients, we process personal data about you in order to provide our services to our mutual client.

The personal data we process may include your full name, contact telephone number, email address, what services we have provided, what contacts have been made in connection with the services and any interviews, what payments have been made in connection with these services, and your preferences in receiving marketing from us including communication preferences.

A friend on social media

If you follow us on social media, we process your username and personal data that you make publicly available on your social media.

A third party supplier

If you work for one of our third-party suppliers, or if you work with us to help us provide our services, we process personal data about you and your colleagues that we work with in order to help us facilitate our services. This includes your full name, email address, contact telephone number and job title.

As well as "personal data" you may have heard about "special categories of personal data". This is information about an individual's race, ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not process any special categories of personal data about you and we do not collect any personal data about criminal convictions or offences.

Where we get your personal data from

We collect information about you from different sources, including:

From you directly
1. When you correspond with us by post, phone, email, through social media or otherwise.
2. When you use our website, for example when you navigate our website, from contact forms, when you subscribe to our newsletters, when you click on our e-newsletter and when you download documentation and other resources.
From a gallery member that supplies us with your personal data when the gallery completes a gallery membership application.
From someone on your behalf, if you are an artist someone might give us your name, or if you are a representative of a gallery someone might give us your contact details in an enquiry. These individuals may be based inside or outside of the EEA.
From third parties, for example partners with whom we jointly offer services or conduct promotions, third party service providers, credit bureaus and social media platforms. These third parties may be based inside and outside of the EEA.
From publicly available sources.

We try to be sure that the personal data we hold about you is accurate, and so please get in touch with us if your personal data changes so we can update our records. You can contact us using the details provided in this Privacy Policy.

Our services and our website are not intended for use by children, and we do not knowingly process personal data relating to children.

WHY DOES OCULA NEED TO PROCESS MY PERSONAL DATA?

There are a number of reasons why we process your personal data. We have summarised the reasons within the table below.

Purpose

Types of Data

Lawful Basis for Processing

Signing up to your My Ocula account, or our e-newsletter referencing you as an artist, a gallery contact or a client

Types of Data:

Full name, email address, contact telephone number, city of residence, and art profile

Bank details and/or credit card details

Artwork preferences, artists and galleries you follow

Your artwork and biographical details

Marketing and communication preferences

Data relating to the services provided to you

Data relating to how you use our website

Personal data about your representative, agent, advisor or employees

Lawful Basis for Processing:

Performance of a contract, or the potential performance of a contract, with you

Necessary for our legitimate interests (for running our business, to keep our records updated, to recover debts due to us and to provide you with the services you have requested)

To communicate with each other

Types of Data:

Full name, email address, contact telephone number, gender, date of birth and art profile

Marketing and communication preferences

Data relating to the services provided to you

Lawful Basis for Processing:

Performance of a contract, or the potential performance of a contract, with you

Necessary for our legitimate interests (for running our business, to respond to any questions or complaints, to keep our records updated and to provide you with the services you have requested)

Using and providing our services

Types of Data:

Full name, email address, contact telephone number, gender, date of birth and art profile

Bank details and/or credit card details

Your artwork and biographical details

Information about your art collection, art purchases and sales

Marketing and communication preferences

Data relating to the services provided to you

Personal data about your representative, agent, advisor or employees

Data relating to how you use our website

Lawful Basis for Processing:

Performance of a contract, or the potential performance of a contract, with you

Necessary for our legitimate interests (to facilitate the provision of services to you, for running our business and for administrative purposes)

Consent (where we use non-essential cookies)

To make suggestions, recommendations and provide information to you about goods or services that may be of interest to you

Types of Data:

Full name, job title, email address, contact telephone numbers, postal address

Data relating to the services we provide

Information about your art collection, art purchases and sales

Data relating to how you use our website

Lawful Basis for Processing:

Necessary for our legitimate interests (to develop and grow our business)

Consent (for email direct marketing and where we use non-essential cookies)

To administer and protect our business and our website (for example, troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

Types of Data:

Full name, job title, email address, contact telephone numbers, postal address

Data relating to the services we provide

Data relating to how you use our website

Lawful Basis for Processing:

Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group group restructuring exercise)

Necessary to comply with our legal obligations

To comply with requirements imposed by law or any court order (for example, to verify your identity and to prevent or detect fraud)

Types of Data:

Full name, job title, email address, contact telephone numbers, postal address Data

Data relating to the services we provide

Bank details and/or credit card details

Data relating to how you use our website

Data relating to your representatives, advisors, agents or employees

Lawful Basis for Processing:

Necessary to comply with our legal obligations

Where we need to process your personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. This means that we may not be able to provide you with the information or services you require. We will let you know if this is the case at the time.

We may process your personal data for a different purpose than that listed above and without your consent where it is necessary for us to comply with our legal obligations.

If you would like further information about the specific legal basis for our processing of your personal data, please get in touch with us.

Marketing

We may process your personal data for marketing purposes to keep you up to date with the latest artworks, products, services and promotions we have to offer.

You will receive marketing communications from us if you have signed up to a My Ocula Account, our mailing list or registered to any promotions we offer, and in each case you have not opted-out of receiving those communications.

If you are a gallery member, the personal data of one or more of your representatives will be automatically added to our membership database so we can provide the services members are entitled to receive (which will include, amongst other things, adding personal data of a member's representatives to our newsletter database so that such person(s) receives our gallery newletter on behalf of the gallery member).

If you no longer want to receive marketing communications from us you can change your mind at any time by:

clicking the unsubscribe link on the marketing emails you receive; or
contacting us using the details in this Privacy Policy.

If you opt-out of receiving marketing communications we may still process your personal data in order to fulfil our contract with you and in accordance with our legal, accountancy and regulatory obligation.

Our Website and Cookies

Our website may include links to third party websites, plug-ins or applications that allow third parties to collect or share your personal data. We have no control over the processing activities of these third party websites, and so when you leave our website, please read the privacy notice of every website you visit.

Our website may automatically collect data about how you use our services in order to help us improve future functionality. This may include personal data. Please read our cookie policy to get further information about the cookies we use.

WHAT DOES OCULA DO WITH MY PERSONAL DATA?

We use your personal data for the purposes set out above. This might mean that we have to share your personal data with third parties, including:

service providers who act as processors on our behalf in order to provide services such as IT and administrative support, event and venue hire and cloud database providers;
artists, if you are a gallery representative or an Ocula Client or a curator or writer looking for an artist or with an interest in a particular piece of art that we showcase;
galleries, if you are an Ocula Member or Ocula Client, writer or curator looking for an artist or with an interest in a particular artist or piece of art that we showcase or are aware of;
galleries and/or art fairs, if you are a visitor to a viewing room hosted on our website relating to that gallery and/or art fair;
Ocula Clients, if you are another Ocula Client, a gallery or an artist looking to purchase or sell a piece of art;
Ocula Clients and Ocula Advertisers, if you are an artist, writer or a gallery or other art entity and we have a customer that is interested in communicating with you about the services you offer;
curators and writers, if you are an artist or a gallery or other art entity and a curator or writer is interested in communicating with you about the services you offer;
our professional advisers, such as our auditors and solicitors;
if we choose to restructure our business we may share your personal data with third parties who we choose to sell, transfer or merge parts of our business and assets with, or who we seek to acquire or merge with. New owners of our business may use your personal data in the same way as set out in this Privacy Policy; or
other legal, regulatory, judicial and law-enforcement agencies who we may need to share personal data with to comply with our legal obligations.

These third parties are required to respect the security of your personal data and treat it in accordance with the law. Where these third parties are Processors of your personal data on our behalf (rather than separate Controllers in their own right) they can only use your personal data in connection with the services we provide to you. We do not allow third party processors to use your personal data for their own purposes unless it is incidental to the services they are providing to you on our request.

Transfers outside of the EEA

We provide services globally and our Website can be accessed both inside and outside of the EEA, but we have offices in New Zealand, in London and Hong Kong, and representatives based in China. If you are based inside the EEA, please be aware that your personal data is transferred internally within Ocula, outside of the EEA. Specifically, we transfer your personal data to New Zealand where we are based, and we transfer your personal data to Virginia, USA, where our servers are based.

We may share your personal data with third parties that are based across the globe, including outside of the EEA. Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded, for example by ensuring that the country has been deemed to provide an adequate level of protection for personal data by the European Commission, using binding corporate rules, using specific contracts approved by the European Commission, or by ensuring that they are part of the Privacy Shield (where they are in the USA). As an example, we transfer personal data to New Zealand, a country that has been recognised by the European Commission as providing an adequate level of data protection.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

HOW LONG DOES OCULA PROCESS MY PERSONAL DATA FOR?

Under data protection laws, we cannot retain your personal data in a form that identifies you for longer than is necessary to fulfil the purposes for which we collected it. This may include for the purposes of satisfying any legal, accounting or reporting requirements.

We usually store personal data for 7 years from the last communication from you that we receive, but there may be occasions where we need to store it for longer or shorter periods. In order to determine how long we store your personal data for, we take into consideration why we need to continue to store your personal data, whether we can achieve the same result without having access to your data, and what the potential risk is if there is a data breach that affects your data.

Occasionally we may anonymise data which means that it is no longer associated with you. We do this for statistical or research purposes so we can improve the services we offer to you. We can use anonymous data indefinitely without further notice to you.

HOW DOES OCULA KEEP MY PERSONAL DATA SECURE?

Once we have received your personal data we will use reasonable and necessary procedures and security features to try and prevent unauthorised access. For example:

we limit who can access your personal data to those individuals and third parties who need to know it and who are subject to a duty of confidentiality;
we require users to have complex passwords which are encrypted, and we use two-factor authorisation where appropriate;
we store data on servers protected by a firewall, and our server software is regularly updated with the latest software updates;
all data in transit is protected by SSL encryption technology;
we use web-filtering to prevent access to hazardous URLs; and
we regularly back-up our data to a separate, secure location, based in Virginia, USA.

If we become aware of a data breach that affects personal data within the United Kingdom, we will notify the Information Commissioner's Office. If we believe the data breach is serious, we may notify you in accordance with our legal requirements.

WHAT RIGHTS DO I HAVE?

People who are in the European Union have the right to:

ask us for details of the personal data we hold and process about them (this is usually called a subject access request);
ask that any inaccurate information we hold about them is corrected;
ask that we delete personal data we hold about them (this applies only in certain circumstances);
ask that we stop using their personal data for certain purposes;
ask that we do not make decisions about them using completely automated means;
withdraw their consent;
ask that we give them the personal data we hold about them, or (where technically feasible) that we give this personal data to a third party chosen by them, in a commonly-used machine-readable format; and
complain to a Member States' supervisory authority for data protection issues. Before exercising this right, we encourage you to contact us first to resolve any complaint you may have, although this is not legally required. In the UK, the supervisory authority is the Information Commissioner's Office at Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF. Further details can be found at: www.ico.org.uk

To exercise any of the rights above please contact us using the details in this Privacy Policy. If you do so, please provide us with as much information as you can about the request you want to make to help us respond as soon as we can. You might need to provide us with proof of identity (for example a passport or driving licence) before we can fully respond, as we need to be sure we are giving the correct personal data to the correct individual.

Please be aware that the above rights are not available to everyone all the time. Some are subject to exemptions, and so we may not always be able, or required, to comply with your request to exercise these rights. You can read more about the rights that you have on the ICO website.

We usually respond to data protection requests within one month, but it can take longer if your request is particularly complex or if you have made a number of requests. You will not usually have to pay a fee to exercise the rights above, but we reserve the right to charge a fee if your request is clearly unfounded, repetitive or excessive; alternatively, we may refuse to comply with your request.

We may need to process your personal data in order for us to respond to your request.

WHO CAN I CONTACT ABOUT OCULA'S PROCESSING OF MY PERSONAL DATA?

Ocula works hard to ensure that it processes personal data in compliance with data protection laws. We know that sometimes you might want to ask questions about our processing activities and so please contact us by writing to the relevant address below:

New Zealand: Ocula Ltd, PO Box 47415, Ponsonby, Auckland, 1144, New Zealand (email: info@ocula.com)
United Kingdom: (email: info@ocula.com)
Hong Kong: (email: info@ocula.com)

We reserve the right to update this policy to reflect any changes to the way in which we collect, process or share your personal data, or to reflect any legal requirements. When we make any changes, we will upload the new version to our site. The new version will take effect as soon as it is uploaded. We last updated this Privacy Policy in April 2020.