PRIVACY POLICY

Personal data is any information relating to an identified or identifiable natural person, such as a name, email address, postal address, telephone number or tax identification number. When the User visits the Bernard Rives website, certain information may be collected automatically for technical reasons, such as the IP address assigned by the internet service provider.

Bernard Rives, as Data Controller, informs Users about the different ways in which personal data is collected and processed through this website or through electronic communications such as email.

Only data strictly necessary to provide the requested service, respond to the User’s enquiry or manage the other legitimate purposes described below will be collected. Special-category personal data will not be collected without express consent. Bernard Rives will not use personal data for purposes other than those expressly described when it is collected.

2.1. Enquiries, contact form and email

Purpose: to respond to enquiries, requests for information or advisory requests received through website forms, email, WhatsApp or other enabled channels.

Where an enquiry relates to the possible acquisition of a work, a request for proposal or a special project, data may also be processed in order to take the pre-contractual steps requested by the data subject.

Data processed: name, email address, telephone number where provided, the content of the enquiry and any other information voluntarily provided by the User.

Legal basis: steps taken at the request of the data subject before entering into a contract where the enquiry concerns a possible engagement and, in other cases, Bernard Rives’s legitimate interest in responding to communications and requests.

Recipients: data may be processed by technology providers supplying services required for communications management, web hosting or maintenance, in accordance with applicable law.

Retention: data will be retained for the time necessary to respond to the enquiry and subsequently for the periods required to address possible legal liabilities.

2.2. Newsletter and marketing communications

Purpose: to send electronic information about new works, limited editions, projects, exhibitions, studio news and other communications relating to Bernard Rives.

Legal basis: the User’s express consent when subscribing.

Subscription is voluntary and consent may be withdrawn at any time using the unsubscribe link included in communications or by writing to info@bernard-rives.com. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Recipients: data may be processed by technology providers used to manage and send marketing communications.

Retention: data will be retained while the User continues to consent to receiving communications and until the User unsubscribes, without prejudice to any retention period required by law.

2.3. Customers, purchases and user accounts

Purpose: personal data provided during a purchase, request for proposal, account creation or project engagement may be processed to:

• Manage and confirm orders.
• Process payments.
• Prepare and ship purchased works.
• Manage transport, delivery and installation where applicable.
• Issue invoices and comply with tax and accounting obligations.
• Manage exchanges, returns, guarantees and incidents.
• Provide after-sales assistance.
• Manage the customer account where this functionality is used.
• Manage monumental works, commissions and special projects.

Data processed: identification and contact details, billing and delivery address, information about orders and purchased works, information required for invoicing and any additional information necessary to manage the contractual relationship.

Full card or other payment-instrument details are processed directly by the relevant payment service providers, and Bernard Rives does not directly store complete card details.

Legal basis: performance of the contract or steps taken at the data subject’s request before entering into a contract, together with compliance with Bernard Rives’s applicable legal obligations.

Recipients: where necessary to manage a purchase, certain data may be disclosed to or processed by payment providers, the ecommerce platform, transport and logistics companies, technology providers, professional advisers and public authorities where there is a legal obligation.

Retention: data will be retained for the duration of the contractual relationship and subsequently for the periods required by law to comply with tax, accounting and commercial obligations or address possible liabilities.

Data protection: where the processing of personal data is based on consent, persons over 14 years of age may give that consent themselves under the terms provided by Spanish law. For children under 14, consent from those exercising parental authority or guardianship will be required where legally applicable.

Purchases and contracting: Bernard Rives’s online store and contracting services are intended for persons over 18 years of age. If a minor wishes to acquire a work, the purchase must be handled through their parent, guardian or legal representative, unless another legal capacity regime applies.

Bernard Rives may request information reasonably necessary to verify the User’s age or legal capacity where there are justified grounds to do so.

Users may access a customer account to view and manage certain information relating to their orders and contact details.

Customer account functionality is provided technically through the Shopify platform. Access may take place through the authentication systems enabled from time to time, such as sending a one-time verification code to the User’s email address.

Through the account, the User may, depending on the functions available, view order history and status, manage certain profile and address information, and access other purchase-related functions.

Creating or using a customer account does not automatically subscribe the User to marketing communications. Newsletters and promotional communications require the appropriate legal basis and may be cancelled through the unsubscribe mechanisms provided.

The User is responsible for maintaining control of access to the email address and other means used to authenticate the account.

Bernard Rives applies technical and organisational measures that are reasonably appropriate to protect personal data against loss, destruction, alteration, disclosure or unauthorised access, taking into account the nature of the data processed, the risks associated with the processing and the state of the art.

Where applicable, these measures include access-control mechanisms, confidentiality measures, protection of communications, encrypted connections and security measures provided by the technology suppliers used to deliver the website’s services.

Measures are also adopted to preserve the confidentiality, integrity and availability of information and to reduce the risks associated with the processing of personal data.

However, no information system or data transmission over the Internet can guarantee absolute security. If an incident or security breach affecting personal data occurs, Bernard Rives will act in accordance with the obligations established by applicable law.

The User should ensure that any personal data provided through the website is accurate, complete and up to date.

When any relevant change occurs, the User may inform Bernard Rives or update the information through the functions available in their account, where applicable.

Bernard Rives will take reasonable measures to keep personal data accurate and up to date in relation to the purposes for which it is processed and may request the correction or confirmation of certain information when necessary to manage a purchase, delivery, invoice, enquiry or contractual relationship.

If Bernard Rives identifies that certain data may be inaccurate or outdated, reasonable steps may be taken to verify, correct or update it in accordance with applicable law.

Bernard Rives will not disclose personal data to third parties unless this is necessary to manage requested services, perform a contractual relationship, comply with a legal obligation or another lawful basis authorises the disclosure.

For the operation of the website and provision of its services, certain personal data may be processed by technology providers acting as processors or, where appropriate, independent controllers.

Categories of recipients and providers that may be involved include:

• 
  Ecommerce and web-hosting platforms.
  
• 
  Email and communications providers.
  
• 
  Newsletter and marketing services, where the User has provided the relevant consent.
  
• 
  Payment service providers and financial institutions.
  
• 
  Transport, logistics and delivery companies.
  
• 
  Technology, maintenance, security and support providers.
  
• 
  Tax, accounting, legal or other professional advisers where necessary.
  
• 
  Public authorities, courts or other bodies where there is a legal obligation.
  

These providers will only have access to the data required to provide the relevant services and must process it in accordance with the data protection legislation applicable to them.

International data transfers

Some technology providers used by Bernard Rives may be established outside the European Economic Area or may process information outside it.

Where an international transfer of personal data takes place, safeguards provided for under the GDPR will be applied, such as a European Commission adequacy decision, standard contractual clauses or other legally recognised mechanisms, as appropriate.

The User may request additional information about the safeguards applicable to international transfers of their data by contacting info@bernard-rives.com.

Persons whose personal data is processed by Bernard Rives may, where applicable under the relevant legislation, exercise the following rights:

Right of access: to obtain confirmation as to whether Bernard Rives is processing their personal data and, where applicable, to access that data and information about its processing.

Right to rectification: to request correction of inaccurate or incomplete personal data.

Right to erasure: to request deletion of personal data where one of the circumstances provided by law applies.

Right to restriction of processing: to request that processing of data be restricted in certain circumstances provided for by law.

Right to object: to object to processing of personal data where permitted according to the legal basis used and the particular circumstances of the data subject.

Right to data portability: to receive personal data provided in a structured, commonly used and machine-readable format and, where technically feasible and legally applicable, request its transmission to another controller.

Right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal effects concerning the data subject or similarly significantly affect them, under the terms provided by law.

Where processing is based on consent, the data subject may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, send a request to info@bernard-rives.com, indicating the right you wish to exercise and providing the information necessary to identify the request correctly.

Where there are reasonable doubts about the identity of the person making the request, Bernard Rives may request additional information necessary to verify identity.

As a general rule, exercising these rights is free of charge. Requests will be handled within the periods established by data-protection law. As a general rule, a response will be provided within one month of receipt of the request, which may be extended where the complexity or number of requests justifies it.

If the data subject considers that processing of personal data infringes applicable law or that their rights have not been handled appropriately, they may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority.

Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected and, subsequently, for the periods required to comply with legal obligations or address potential liabilities.

In particular:

• 
  Enquiries and information requests: for the time necessary to respond to and manage the request and, subsequently, for the period required to address any potential liabilities arising from it.
  
• 
  Newsletter and marketing communications: for as long as the data subject maintains consent. If the data subject unsubscribes or withdraws consent, those communications will stop, without prejudice to retaining the minimum information necessary to evidence the opt-out and prevent further unsolicited messages.
  
• 
  Customers, orders and purchases: for the time necessary to manage the contractual relationship and, subsequently, for the retention periods required by tax, accounting, commercial and other applicable legislation.
  
• 
  Special projects, commissions and monumental works: for the duration of the project and, if a contractual relationship is formalised, for the periods applicable to that relationship.
  
• 
  Exercise of rights and claims: for the time necessary to manage the request and for the periods during which legal liabilities may arise.
  

When data is no longer required for the purposes for which it was processed, it will be deleted or, where legally required, blocked for the applicable liability periods.

Data that has been irreversibly anonymised so that it no longer permits a natural person to be identified may be used for statistical, analytical or service-improvement purposes.

Bernard Rives may maintain official profiles on different social networks and digital platforms in order to promote his work, communicate news, interact with followers and respond to enquiries relating to his sculptures, projects and services.

When a User interacts with Bernard Rives’s profiles, for example through comments, private messages, mentions or other platform functions, personal data that the User provides or makes accessible through that interaction may be processed.

Purposes: to manage Bernard Rives’s presence on social networks, respond to enquiries and messages, interact with Users, communicate news and content relating to his artistic activity and, where applicable, handle requests relating to the possible acquisition of a work or a project.

Legal basis: Bernard Rives’s legitimate interest in managing his official profiles and responding to interactions received; steps taken at the User’s request before entering into a contract where the User requests information relating to a possible purchase or engagement; and consent where it is required for a specific purpose.

Bernard Rives will not use information obtained through social networks for purposes incompatible with those for which it was provided.

Social-network platforms themselves may process personal data in accordance with their respective terms and privacy policies. Users are advised to consult the privacy information and configure their preferences directly on each platform.

If a conversation started through a social network requires the management of a purchase, quotation, shipment, special project or other contractual relationship, certain data may be incorporated into the systems used by Bernard Rives to manage that request in accordance with this Privacy Policy.

Bernard Rives will process Users’ personal data confidentially and will take reasonable measures to prevent unauthorised access, use or disclosure.

Access to personal data will be limited to those persons, collaborators or suppliers who need to process it in order to fulfil the purposes described in this Privacy Policy or to provide the corresponding services.

Where suppliers or authorised third parties are involved, data will be processed in accordance with the applicable legal and contractual obligations concerning data protection and confidentiality.

Personal data may be disclosed to third parties only where there is a lawful basis permitting it or where disclosure is necessary to perform a contractual relationship, provide a requested service, comply with a legal obligation or respond to requests from competent authorities.

Bernard Rives will adopt technical and organisational measures appropriate to the risk in order to preserve the confidentiality, integrity and availability of the personal data processed.

This Privacy Policy applies from [date of last update]. It may be amended in response to regulatory, doctrinal or internal changes. Users are advised to review it periodically.