Version 1.0 · Effective 12 November 2026
Privacy Notice
This notice explains how London Art Exchange Ltd uses personal information when you visit www.thelax.art, contact us, attend an event, or buy or enquire about an artwork. It explains your choices and how to raise a concern. It is information about our processing, not a request for blanket consent.
1 Who is responsible
London Art Exchange Ltd is the controller responsible for the personal information covered by this notice. We are registered in England and Wales under company number 12874213. Our registered office is London Art Exchange, 156 New Cavendish Street, London W1W 6YW, United Kingdom.
For a privacy question, rights request or data protection complaint, email info@thelax.art with “Privacy” in the subject line, or write to the address above. You can also raise a concern with our team in person; you do not have to use a special legal form.
Separate platforms, payment providers and other sellers may act as controllers for their own services. Their notices apply to that processing. We remain responsible for processing we control, including when we use a service provider to help us.
2 Information we collect and where it comes from
We collect information you provide, including your name, contact details, correspondence, delivery address, order and payment information, artwork preferences, and information about works you own or ask us to assess. Payment services may provide transaction references, payment status and fraud indicators; avoid sending full card details to us by email.
Where required for identity, anti-money laundering or sanctions checks, we may collect date of birth, identity and address documents, nationality, information about beneficial owners or representatives, and evidence about ownership or source of funds. The information requested depends on the legal requirement and risk involved.
We may receive information from a person acting for you, an artist, seller, courier, payment provider, identity-check provider, public register or other lawful source. Provenance research may include public sale records and information from previous owners. Where we obtain information indirectly, we will provide the information required by law, subject to any applicable exception.
Website use can generate IP addresses, device and browser details, security logs and cookie or similar identifiers. Our Cookie Notice explains technologies that store or read information on your device and how to control them.
If a particular service involves recording a call, filming an event or using CCTV, we will give a clear notice at the relevant point explaining its purpose and use. This notice does not itself authorise undisclosed recording. If you ask for an adjustment that involves health or other sensitive information, we will seek only what is needed and explain the applicable basis for using it.
3 Enquiries orders and services
We use enquiry and order information to answer requests, discuss a possible purchase, accept and administer orders, arrange payment and delivery, and provide aftercare. Where you are the customer, the legal basis is taking steps at your request before a contract or performing our contract with you.
Where you act for a business or another buyer, we rely on our legitimate interests in communicating with the representative and administering the transaction, unless a legal obligation applies. We consider the impact on your rights before relying on legitimate interests.
Certain information is needed to complete a contract, deliver goods or satisfy a legal requirement. If you do not provide it, we may be unable to proceed. We will explain what is required and why where legally permitted. Optional marketing information is not a condition of an enquiry or purchase.
4 Legal checks records and protection of the business
We use information to meet applicable anti-money laundering, sanctions, accounting, tax and other legal duties. The legal basis is compliance with the relevant legal obligation. Where a check is not legally required, we assess whether our legitimate interests in preventing fraud, protecting property and managing risk justify it.
We use relevant records to handle complaints, investigate security incidents, establish ownership and deal with legal claims. We rely on legal obligations where they apply and otherwise on legitimate interests in resolving disputes, protecting rights and maintaining reliable business records.
If processing involves special category information or criminal offence information, we must also identify the additional condition or legal authority required by data protection law. We will not collect such information simply because it might be useful. A separate explanation will be provided where the law requires one.
5 Marketing and your choices
We use contact details and relevant preferences to send marketing only where permitted by law. For marketing by email or text to individuals, we obtain consent unless the specific existing-customer exception applies. That exception requires, among other things, details collected during a sale or genuine negotiations for a sale, our own similar products or services, and an opportunity to opt out both when details are collected and in every message.
Where we rely on consent, you may withdraw it at any time. Where the existing-customer exception lawfully applies, we rely on legitimate interests for the associated personal data processing. We do not treat downloading a catalogue, accepting sale terms or acknowledging this notice as general marketing consent.
You can unsubscribe using a message’s unsubscribe link or contact info@thelax.art. You have an absolute right to object to use of your personal information for direct marketing, including related profiling. We may retain a minimal suppression record to respect your choice. Essential order and service messages may still be sent without promotional material.
Any telephone or postal marketing must meet the rules applicable to that channel, including relevant objections and preference-service registrations. Permission for one channel is not automatically permission for another.
6 Website measurement and personalisation
We use necessary website and security information to operate the service and prevent misuse, relying on legitimate interests or another applicable basis. Optional measurement, advertising and personalisation depend on the choices and legal basis explained in our Cookie Notice.
We may use interests you have shared, previous enquiries and permitted interaction data to make communications more relevant. You may object to marketing profiling. We do not use this information to assess investment suitability.
Our proposed process for decisions about accepting or refusing a sale includes human review. Screening tools may identify a potential match or risk that needs checking. Any use of solely automated decisions with legal or similarly significant effects requires a specific explanation of the processing, its consequences and the safeguards available, before that processing is introduced.
7 Who receives information
We share only information relevant to the purpose with service providers helping us run the website, manage enquiries and customer records, communicate with customers, process payments, verify identity, store records, provide security, or deliver and care for artworks. Those acting as processors must act under appropriate contracts and instructions.
We may share necessary information with artists, sellers or specialists involved in an agreed transaction or authenticity enquiry, and with professional advisers, insurers, courts, regulators or law enforcement where lawful and necessary. We do not routinely disclose a buyer’s identity to a future buyer merely because provenance may be useful; we assess necessity, confidentiality and the lawful basis first.
If a genuine business transfer is proposed, limited relevant information may be shared with advisers and prospective parties under appropriate safeguards. Any new controller must use the information lawfully and provide the required notice. These statements do not authorise unrestricted sale of customer records.
8 International transfers
Some service providers may process information outside the UK. Before making a restricted transfer, we must have a lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards with the required assessment and supplementary measures where needed.
You can contact us for information about relevant destinations and a copy or explanation of the safeguards, with confidential details redacted where appropriate. We will provide any further transfer information required for the particular processing. Using a globally available service is not, by itself, a sufficient safeguard.
9 How long we keep information
We retain information only for as long as needed for the stated purpose, legal obligations or a justified claim period. We consider the type and sensitivity of the data, the transaction, applicable law and whether less identifiable information would meet the need. We delete or anonymise information when it is no longer needed, subject to lawful retention and backup arrangements.
Core transaction and accounting records are normally retained for six years after the relevant transaction or accounting period, as appropriate, with longer retention only where a specific legal or documented need justifies it. This does not mean keeping every identity document, recording or marketing profile for six years.
Records required under the Money Laundering Regulations are normally retained for five years after the relevant occasional transaction is complete or the business relationship ends. Specific statutory rules and exceptions apply, including the limit for certain transaction records within a relationship. We remove the personal data when required unless a permitted basis for longer retention applies.
We review enquiry and marketing records against whether the enquiry remains active, the length of inactivity, your preferences and the need to evidence consent or honour objections. Security logs, recordings and CCTV, where used, need shorter, purpose-specific schedules disclosed at the relevant point. A record needed for a live complaint or legal claim may be retained until the matter and applicable claim period are resolved.
Limited artwork history may be retained for longer to support title or provenance, but unnecessary contact details, identity documents and financial information are not part of a permanent public provenance record. We assess whether the individual needs to remain identifiable and whether disclosure is justified.
10 Your rights
Subject to the applicable legal conditions, you can ask to access your information, correct inaccuracies, erase information, restrict processing or receive certain information in a portable form. You may object to processing based on legitimate interests and may always object to direct marketing. You can withdraw consent without affecting the lawfulness of earlier processing.
Rights concerning significant automated decisions include the safeguards required by applicable law, such as information, an opportunity to make representations, human intervention and contesting the decision where those provisions apply.
Contact us using the details above. We may ask for proportionate information to establish identity or understand the request. We respond without undue delay and normally within one month, applying any lawful extension or timing adjustment only where its conditions are met and explaining it to you. Requests are normally free; any fee or refusal must have a lawful basis that we explain. Some information may be withheld where an exemption applies, including where disclosure is legally restricted.
11 Complaints security and updates
If you are concerned about our handling of personal information, please tell us. We will acknowledge a data protection complaint within 30 days, investigate without undue delay, keep you informed and communicate the outcome without undue delay. A complaint and a request to exercise a data right have separate requirements and time limits.
You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. Our complaints process does not remove that right.
We use appropriate organisational and technical measures to protect information, with access limited according to need. No system can be guaranteed completely secure. Please do not send passwords, full card details or unsolicited identity documents by ordinary email; contact us to agree an appropriate route.
Our sales are intended for adults. If a child’s information is involved in an enquiry or event, we must use an appropriate lawful basis and provide information suited to the circumstances; we do not assume adult consent covers every use.
We will date material updates to this notice and provide additional information or seek new consent where required. An update does not retrospectively authorise a different use of your information.
