Privacy & GDPR Policy

Data Controller

The Data Controller responsible for your personal data is Julia Woodward, conducting business under the registered trading name Julia Woodward Antykwariat, registered in the Central Registration and Information on Business (CEIDG) under NIP: 8542461078, REGON: 545140621, with the correspondence address at ul. Stanisława Moniuszki, nr 14/2, 73-110 Stargard, Zachodniopomorskie, Poland.

For all matters relating to privacy, data management, or the exercise of your statutory rights, you may contact: info@antykwariat-woodward.com.

Right to Lodge a Complaint

If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a formal complaint with the competent supervisory authority. In Poland, this is the President of the Personal Data Protection Office:

Prezes Urzędu Ochrony Danych Osobowych (PUODO)
ul. Stanisława Moniuszki 1A, 00-014 Warsaw
uodo.gov.pl

Purposes of Processing

Julia Woodward processes personal data strictly in connection with requests, catalogue reservations, price quotations, invoices, purchases, processing payments, international shipping, insurance arrangements, export/import procedures, official customs documentation, and cultural-property registrations. Processing also extends to regulatory obligations including anti-money laundering (AML) checks, international sanctions screening, tax and accounting frameworks, provenance due diligence, and other lawful business or compliance purposes.

Categories of Personal Data

The personal data collected and maintained under these terms may encompass:

• Full names, residential and commercial billing addresses, verified shipping coordinates, email correspondence addresses, and telephone contacts.
• Institutional or corporate profiles, official tax identification credentials (NIP, REGON, VAT numbers), and national identity identifiers (PESEL, passport numbers, or state ID cards).
• Beneficial-ownership disclosures, authenticated source-of-funds declarations, financial transaction histories, and specialised provenance files.
• Regulatory tracking metrics mandatory for cultural-property authorities, customs clearance, banking compliance, and specialised transit insurance.

Lawful Bases for Processing

Under the European General Data Protection Regulation (GDPR), personal data is processed exclusively under the following lawful bases:

Contractual Necessity

To execute pre-contractual steps or fulfil binding Sales Agreements (Art. 6(1)(b)).

Legal Obligation

To satisfy statutory tax laws, historical monument protections, and international AML frameworks (Art. 6(1)(c)).

Legitimate Business Interests

To protect against transactional fraud, establish immutable provenance trails, and manage internal collection archives (Art. 6(1)(f)).

Legal Defence

To establish, execute, or defend against civil or regulatory legal claims (Art. 6(1)(f), and where special categories arise, Art. 9(2)(f)).

Consent

Where a data subject has explicitly authorised processing for an isolated purpose (Art. 6(1)(a)).

Personal data will be processed only where there is a lawful basis for doing so, including where processing is necessary for the performance of a contract or pre-contractual steps, compliance with legal obligations, protection of legitimate business interests, establishment or defence of legal claims, fraud prevention, due diligence, cultural-property compliance, anti-money-laundering and sanctions compliance, tax and accounting compliance, or where consent has been given for a specific purpose.

Disclosure of Personal Data

Personal data may be shared, where necessary, with professional advisers, accountants, banks, payment providers, insurers, shipping companies, customs agents, freight forwarders, storage providers, conservators, photographers, IT and email service providers, governmental authorities, customs authorities, cultural-property authorities, tax authorities, law-enforcement bodies, courts, regulators, and the relevant owner, consignor, principal, purchaser, intermediary, or institution involved in a transaction. Personal data will never be sold or rented to third-party marketing brokers.

International Transfers

Where necessary for a transaction, enquiry, shipment, consignment, legal obligation, or due-diligence process, personal data may be transferred outside Poland or outside the European Economic Area, including to the United Kingdom or to the purchaser's, seller's, owner's, consignor's, carrier's, insurer's, bank's, adviser's, or institution's country. Where required by applicable data-protection law, appropriate safeguards or lawful transfer mechanisms are used, such as adequacy decisions, Standard Contractual Clauses, contractual necessity, legal-claims necessity, or other mechanisms permitted by GDPR.

Retention

Personal data will be retained only for as long as reasonably necessary for the purposes for which it was collected, including to complete transactions, maintain accounting and tax records, comply with cultural-property and anti-money-laundering record-keeping obligations, document provenance and title, resolve disputes, enforce agreements, and comply with applicable legal or regulatory requirements. Accounting and tax records are generally retained for the period required by Polish tax and accounting law. Transaction, provenance, title, export/import, customs, insurance and due-diligence records may be retained for longer or indefinitely where necessary to document title, authenticity, provenance, legal compliance, dispute protection, or cultural-property obligations.

Obligation to Provide Data

Providing certain data may be necessary to respond to enquiries, conclude or perform a contract, issue invoices, arrange shipping or insurance, comply with legal obligations, or complete due-diligence checks. If required data is not provided, we may be unable to proceed with the enquiry, reservation, sale, consignment, shipment, or payment. We do not use personal data for automated decision-making, including profiling, within the meaning of Article 22 GDPR.

Your Rights

Individuals whose personal data is processed may have rights under applicable data-protection law, including the right to request access to their personal data, correction of inaccurate data, erasure, restriction of processing, objection to processing, data portability, and withdrawal of consent where processing is based on consent. These rights may be subject to legal limitations, including where retention or processing is required for contractual, legal, tax, accounting, anti-money-laundering, cultural-property, provenance, or legal-claims purposes.

Contact

Requests relating to personal data, privacy, or data-protection rights should be directed to:

Julia Woodward
Szczecin, Poland
info@antykwariat-woodward.com

Scope of This Notice

This privacy notice is intended to satisfy the information obligations under Articles 13 and 14 GDPR for customers, consignors, suppliers, correspondents, and transaction counterparties of Julia Woodward.