Privacy and Cookie Policy

Last updated: 30 October 2026

This notice explains how MATER Fine Art processes personal data when it operates this website (artsmater.com), including the customer area.

1. Data controller

M - Fine Art Auctions Unipessoal Lda, legal entity no. 518 686 663, with its registered office at Avenida Infante D. Henrique, 26, 1149-096 Lisbon, is the controller of the personal data collected through this site. For any data protection question, or to exercise your rights, you can contact us at privacidade@artsmater.com or by post to Rua Dom João de Castro 76 A/B, 1300-194 Lisbon.

2. Purposes, legal bases and retention periods

Newsletter (subscription through the website form).

• Legal basis: consent.
• Retention: while the subscription is active. You can unsubscribe through the link in every email and this takes effect for the following mailings.

Contact and quote requests sent through the website form.

• Legal basis: steps taken at the request of the data subject prior to entering into a contract (quote request) or our legitimate interest in analysing and answering customers' questions.
• Retention: 24 months from the request. After that period, the name, email, telephone number and message are pseudonymised; only statistical information remains (date, subject and service requested).

Handling of complaints.

• Legal basis: our legitimate interest in handling complaints; for an entry in the complaints book, compliance with a legal obligation.
• Retention: until the purpose for which the data was collected ceases; for an entry in the complaints book, 3 years.

Website security and abuse prevention (limit on requests per IP address).

• Legal basis: our legitimate interest in protecting the website, the forms and the customer area against abusive use.
• Retention: in the forms and in the customer area, the IP address is not stored — it is counted in memory for 1 hour. The Amazon Web Services protection service (AWS WAF) also counts requests per IP address, in 5-minute windows, to stop abuse; the AWS WAF request log is not switched on, and AWS keeps samples of blocked requests (which may include the IP address) for 3 hours at most.

Creating and managing the customer account; linking it to the customer record.

• Legal basis: performance of a contract or steps taken at the request of the data subject prior to entering into a contract.
• Retention: the account data is kept while the account is active and for as long as required by legal obligations.

Recording and carrying out purchase orders and telephone bids; registration for the auction and validation of the bidder.

• Legal basis: performance of a contract or steps taken at the request of the data subject prior to entering into a contract; our legitimate interest in validating bidders.

Sending the communications chosen in the customer area (newsletter, Materbook, postal mail and invitations to openings).

• Legal basis: consent.
• Retention: for as long as consent lasts; each communication can be switched off at any time in «My account» and the change takes effect for the following mailings.

Your consent may be withdrawn freely at any time, without affecting the lawfulness of the processing carried out on the basis of consent up to that moment.

2.1 Newsletter

In the newsletter sign-up form we collect your email address and the language in which you prefer to receive it. Sign-up follows a double confirmation process (double opt-in): after you submit the form you receive an email with a confirmation link, and you only start receiving the newsletter once you have confirmed it. The newsletter is sent by Brevo, a service provider acting as processor that stores the data in the European Union. The sign-up is also recorded in our systems, which store the data in the European Union; the website's pages may be served from points outside the European Union, without those points storing personal data (see section 3).

You can withdraw your consent at any time, through the unsubscribe link in every newsletter or by writing to privacidade@artsmater.com.

2.2 Contact form and quote request

When you write to us through the contact form or request a quote, we collect your name, your email address, your telephone number (optional), the subject, the service you want (only in the quote request), your message and the website language. This data is used to analyse and answer your request.

The telephone number is stored encrypted in our systems. The request is stored in our systems, in the European Union, and the MATER Fine Art team receives an email notice at info@artsmater.com, sent through Amazon Simple Email Service (AWS, European Union region — Ireland). That notice contains only the name, the subject, the service, the language, the date, a link to the request and your email, so that we can reply to you (the notice carries your email as the reply-to address); it does not contain your telephone number or your message. The replies we send you and the other correspondence exchanged with you are kept in the MATER Fine Art mailbox, handled in the house's email service (Microsoft 365).

The form does not use reCAPTCHA or any other third-party verification service. Protection against automated submissions is provided by an invisible control field and by a limit on requests per IP address.

2.3 Customer account, purchase orders and telephone bids

Customer account. To create an account on the website we collect your name, your email address, your telephone number, your nationality, your address, a password and, optionally, your tax identification number (NIF). Your email address is confirmed through a code that we send you by email. The password is stored by the Amazon Web Services authentication service (Amazon Cognito), in the European Union (Ireland); MATER Fine Art never has access to it.

Link to the customer record. If you already had a customer record at MATER Fine Art with the same email address, the account is not linked to that record automatically: it waits until a person at MATER Fine Art links it, at your request and after confirming who you are. While the account is not linked to a record, you can log in to the website but you cannot leave purchase orders or request telephone bids. If there is no record with that email address, a new record is created with the data you wrote at sign-up and the account is linked to it. If there is more than one record with that address, the link is decided by a person at MATER Fine Art, never automatically. Linking an account to a record ends the sessions that were open on that account.

Data and communication preferences. In the «My account» area you can view and correct your data and choose how you want to be contacted: newsletter, Materbook, postal mail and invitations to openings, as well as the language. Each of these communications depends on your consent, which you can give or withdraw there at any time. We keep the date and the origin of each consent, as proof.

Purchase orders and telephone bids. On a lot in an open auction you can leave a purchase order (the maximum amount up to which we bid for you) or request a telephone bid (your telephone number and the language in which you prefer to be contacted during the auction). To do so, we register you for the auction and assign you a bidder number. The first registration of each person is validated by a person at MATER Fine Art. We keep the history of changes and cancellations of each order.

Erasure. When you ask for your data to be erased, the data that the law obliges us to keep (for example, what appears in tax documents) is pseudonymised instead of erased, and your account is deactivated.

3. Recipients of your personal data and transfers of personal data

Your personal data may be provided to our service providers that process personal data (processors), such as IT services, internet services and external consultants. Any processor will process the data subjects' personal data on behalf of the controller, under the strict obligation to follow our instructions and the purposes of processing stated above.

The processors that process personal data through this website are:

• Amazon Web Services — hosting of the website and of our systems, database, sending of internal email notices and of the account confirmation codes (Amazon Simple Email Service), authentication of the customer account (Amazon Cognito) and protection against abuse (AWS WAF). The data is stored in the European Union region (Ireland, eu-west-1). The website's pages are distributed through the AWS content delivery network (Amazon CloudFront), which may serve them from points of presence outside the European Union; those points handle pass-through requests and do not store personal data.
• Brevo — sending of the newsletter; the data is stored in the European Union.
• Microsoft 365 — the mailbox info@artsmater.com, where the request notices arrive and where the correspondence exchanged with those who write to us is kept.

ISSUU. The Materbook (the auction catalogue) is displayed through ISSUU, only when the visitor asks to see it (see section 5). ISSUU is not our processor: it is an independent controller for the cookies it sets and the data it processes through its reader. For the collection and transmission of data that takes place at the moment the visitor chooses to load the reader, MATER Fine Art and ISSUU are joint controllers, under the Fashion ID judgment of the Court of Justice of the European Union (case C-40/17); the processing that ISSUU carries out afterwards is its sole responsibility. ISSUU is headquartered in the United States of America. When a provider processes data outside the European Economic Area, the transfer relies on the safeguards provided for in the GDPR.

Your personal data may also be provided to service providers that process personal data but act as controllers, as may be the case for statutory auditors or law firms.

In certain situations, data subjects' personal data may also be disclosed to third parties, including competent authorities and regulators, when such disclosures are necessary or appropriate (i) under applicable law, (ii) to comply with legal or regulatory obligations and/or judicial or administrative orders, (iii) by decision of the Portuguese Data Protection Authority (CNPD) or another competent supervisory authority, or (iv) to respond to requests from public or governmental authorities, such as tax authorities and courts.

More information about international transfers can be found here: International data transfers — European Data Protection Board.

4. Your rights

As provided by law, the data subject may at any time exercise their rights regarding the personal data that concerns them (in some cases, and depending on the terms of the contract in force, these rights may be exercised through the customer, supplier or partner with which the data subject is associated):

• Access: the data subject has the right to access their personal data;
• Rectification: the data subject has the right to obtain rectification of inaccurate personal data concerning them and, where their personal data is incomplete, to have it completed;
• Erasure: the data subject has the right to ask for their data to be erased in certain cases, namely, without limitation, personal data that is no longer necessary for the purpose for which it was collected or processed, or where the data subject withdraws the consent on which the processing is based, among others;
• Data portability: in certain cases, the data subject may request the personal data concerning them that they have provided to us, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller;
• Restriction of processing: the data subject has the right to ask for the processing of their data to be restricted in certain cases, namely where the processing is unlawful and they oppose erasure, we no longer need the personal data for processing purposes but they require it for the establishment, exercise or defence of a legal claim, among others;
• Objection: the data subject may object to the processing of their data, on grounds relating to their particular situation, and in cases where the data is processed (i) for the purposes of the legitimate interests pursued by us or by third parties, or for purposes other than those for which the data was collected and without the consent of the data subject or on the basis of provisions of Union or Member State law, or (ii) for direct marketing purposes, or (iii) for scientific or historical research purposes or statistical purposes.

To exercise any of these rights, write to privacidade@artsmater.com. We reply within 1 month of receiving the request; this period may be extended by up to 2 further months where necessary, taking into account the complexity and number of requests, in which case we will inform you of the extension and of the reasons for it within the first month (article 12(3) GDPR).

We do not make decisions based solely on automated processing that produce legal effects (article 22).

You also have the right to lodge a complaint with the Portuguese Data Protection Authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).

5. Cookies and storage on your device

This website uses only the cookies and storage strictly necessary for it to work, which are exempt from consent. It does not use audience-measurement, tracking or advertising cookies.

• cookies_aviso — browser local storage. It remembers that you have closed the cookie notice, so that it is not shown again. It lasts until you clear your browser data.
• mater_sessao — essential cookie, encrypted and inaccessible to the page's scripts. It keeps you logged in to your customer account; it is only set after you log in. It lasts 30 days, or until you end the session with «Log out».
• mater_registo — essential cookie, encrypted and inaccessible to the page's scripts. It temporarily holds your sign-up while you confirm your email with the code we send you. It lasts 1 hour.

Third-party content. The Materbook is displayed through ISSUU. The ISSUU reader is only loaded when you click the button to view the catalogue; until then, the website makes no request to ISSUU. From that moment, ISSUU may set its own cookies on your device, as an independent controller and under ISSUU's privacy policy (for joint responsibility in the collection and the transfer to the United States of America, see section 3).

Maps. The map shown on the website is a static image, generated from OpenStreetMap and served by the website itself; it sends no data to third parties. The button to ask for directions is only a link: only when you click it are you sent to Google Maps, Waze or Apple Maps, which then process your data under their own policies.

Social networks. The links to MATER Fine Art's social networks are simple links; the website does not load social network buttons or modules.

You can, at any time, delete the cookies and data stored by the website in your browser settings.

6. Changes to this policy

MATER Fine Art may update this policy to reflect changes to the website or the law. The date of the last update is shown at the top. When the changes are significant, we will give notice of them on the website.