Privacy Policy

Last updated: 24 September 2026

1. Who we are

This privacy policy explains how Lullin + Ferrari ("we", "us") processes personal data. It applies to our website lullinferrari.com, our exhibitions and events, our newsletter, and our dealings with collectors, artists, institutions, press and other contacts.

The controller responsible for data processing is:

Lullin + Ferrari, Etienne Lullin and Corrado Ferrari
Limmatstrasse 214
CH-8005 Zürich
Switzerland
T +41 43 205 2607
info@lullinferrari.com

If you have questions about data protection, please contact us at the address above.

2. What data we collect

We only collect personal data that we need for the purposes described below. Depending on how you interact with us, this may include:

  • Contact details: name, email address, postal address, phone number, organisation and role.

  • Correspondence: the content of emails, messages and enquiries you send us.

  • Collector and client data: purchase history, reservations, invoices, payment and delivery information, and your interests in particular artists or works.

  • Provenance records: information on the ownership history of artworks sold through the gallery.

  • Artist data: contact details, biographical information, contracts, and payment information for artists we represent or work with.

  • Newsletter data: your email address, name, language preference, and, where the newsletter tool allows it, whether you open emails or click on links.

  • Event data: RSVPs and guest lists for openings and events. We may also take photographs and video at events (see section 6).

  • Website usage data: technical data such as IP address, browser type, date and time of access, and pages visited, recorded automatically in server logs.

3. Why we process your data

We process personal data for the following purposes:

  • to answer enquiries and correspond with you;

  • to sell, reserve, ship and insure artworks, and to issue invoices and certificates;

  • to keep provenance records for artworks, which is standard practice in the art market;

  • to represent and work with artists, including managing consignments, exhibitions and payments;

  • to send our newsletter and invitations to exhibitions, openings and art fairs, if you have subscribed or we have an existing relationship with you;

  • to document our exhibitions and events and communicate about them;

  • to operate, secure and improve our website;

  • to meet our legal obligations, including accounting, tax and, where applicable, due diligence requirements in the art trade.

If the GDPR applies to you, our legal bases are: performance of a contract (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c)), our legitimate interests in running the gallery and maintaining relationships with our contacts (Art. 6(1)(f)), and your consent where we ask for it, for example for the newsletter (Art. 6(1)(a)).

4. Newsletter

You can subscribe to our newsletter on our website or by asking us directly. We send the newsletter via ArtLogic, which processes your data on our behalf. You can unsubscribe at any time using the link in every newsletter or by writing to us.

5. Website, hosting and cookies

Our website is hosted on Squarespace, a platform operated by Squarespace, Inc. (USA) and Squarespace Ireland Limited. When you visit our website, Squarespace automatically records technical data (see section 2) to deliver the website and keep it secure. Squarespace processes this data on our behalf. More information is available in Squarespace's privacy policy.

Our domain and email are hosted by MTF Solutions AG, Ringstrasse 1, CH-8603 Schwerzenbach, Switzerland. Emails you send us are stored on their servers in Switzerland.

Our website uses cookies that are technically necessary for it to function, as well as analytics cookies that help us understand how visitors use the site. You can decline analytics cookies in the cookie banner.

Our website may contain links to or embed content from third parties such as Instagram, Vimeo or YouTube. When you click on these links or load such content, the respective provider may process your data under its own privacy policy.

6. Photography at events

We photograph and film our exhibitions, openings and events for documentation, our website, social media and press. Visitors may appear in these images. If you do not want to be photographed, please let our team know at the event. If you would like an image of you removed from our channels, contact us and we will do so.

7. Who we share data with

We do not sell personal data. We only share it where necessary for the purposes above, with:

  • service providers who process data on our behalf, such as our hosting provider, newsletter tool, IT support and accountants;

  • shipping, framing, installation and insurance companies, where needed to deliver or insure an artwork;

  • artists we represent, where appropriate, for example to inform them where their works are placed;

  • art fair organisers, when we participate in fairs;

  • institutions, museums and exhibition partners in connection with loans and exhibitions;

  • authorities, where we are legally required to do so.

8. Data transfers abroad

Our email and domain are hosted in Switzerland. Our website is hosted by Squarespace, which may process data in the United States and other countries. Other service providers, such as [newsletter tool, social media platforms], may also process data abroad. Where a country does not have an adequate level of data protection as recognised by the Swiss Federal Council, we rely on appropriate safeguards such as the EU Standard Contractual Clauses (adapted for Switzerland) or the Swiss-U.S. Data Privacy Framework.

9. How long we keep data

We keep personal data only as long as necessary for the purpose it was collected for, or as long as the law requires. Business records such as invoices and accounting documents are kept for ten years, as required by Swiss law. Provenance records for artworks may be kept for longer, as they form part of the artwork's history. Newsletter data is kept until you unsubscribe.

10. Data security

We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. However, no transmission over the internet is completely secure.

11. Your rights

Under applicable data protection law, you have the right to:

  • request information about the personal data we hold about you;

  • have incorrect data corrected;

  • have your data deleted, unless we are legally required to keep it;

  • object to processing, including for direct marketing;

  • withdraw your consent at any time, with effect for the future;

  • receive your data in a common electronic format (data portability).

To exercise these rights, contact us at the address in section 1. We may ask you to verify your identity.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch), or, if the GDPR applies to you, with the data protection authority in your country of residence.

12. Changes to this policy

We may update this privacy policy from time to time. The current version is always available on our website.