Privacy
Privacy Notice
Effective 2 November 2026 · ATRIO Art Advisory · operated by Cristóbal López Mansilla · Triq L-Ilma 17, Swieqi, SWQ 4431, Malta · hello@atrioagency.com
This notice explains how ATRIO Art Advisory ("ATRIO", "we", "us") processes personal data submitted through atrioagency.com or provided in connection with an enquiry. ATRIO Art Advisory is a trading name operated by Cristóbal López Mansilla, of Triq L-Ilma 17, Swieqi, SWQ 4431, Malta, who is the controller for the processing described here. Privacy requests can be sent to hello@atrioagency.com.
1. Data we collect
Depending on the enquiry, we may collect your name, email address, telephone number, country or city, professional or company information, portfolio and website links, artwork or artist interests, acquisition or asking-price ranges, project details, property preferences and budget, and the content of messages you send us. Website and security providers may also process limited technical data such as IP address, browser or device information, timestamps and request metadata. If you accept optional marketing cookies, Meta Pixel may process page, event, device and identifier information relating to your visit and successful enquiry submission. If a private-sale transaction progresses, we may also request identification, provenance, ownership, payment, source-of-funds or other due-diligence information where appropriate. Please do not provide special-category or highly sensitive personal data unless ATRIO has specifically requested it and there is a clear reason to do so.
2. Why we use it and legal bases
- Enquiries and potential engagements — Article 6(1)(b) GDPR: to review and respond to Art Advisory, Artist Representation, Private Sales, Projects and other requests, and to take steps you ask us to take before entering into a possible professional or contractual relationship.
- Administration, security and record-keeping — Article 6(1)(f) GDPR: to administer enquiries, prevent misuse or fraud, maintain proportionate business records and protect ATRIO's legitimate business, legal and security interests, where those interests are not overridden by your rights and freedoms.
- Legal and compliance obligations — Article 6(1)(c) GDPR: where processing is necessary to comply with applicable legal, regulatory, accounting, tax, anti-money-laundering or similar obligations.
- Off-Market Residences — Article 6(1)(b) GDPR: to assess your request and, where appropriate, take the steps you have requested to introduce you to an independent associated broker. The intended referral is made explicit in the form before submission and only information reasonably necessary for that referral is shared.
- Meta Pixel — Article 6(1)(a) GDPR and applicable ePrivacy rules: optional marketing measurement is activated only after you choose to accept marketing tracking. You can withdraw that choice through Cookie settings.
3. Who may receive your data
We use or may use service providers necessary for the operation of ATRIO, including Netlify for website hosting and form submissions; Microsoft services for business email and communications; Google Drive or similar secure storage where an enquiry is progressed into a working case file; and AI-assisted technology providers, where appropriate safeguards and contractual terms are in place, to help organise, summarise or classify material for human review. If you accept optional marketing cookies, event and technical data may be sent to Meta Platforms Ireland Limited through Meta Pixel. For Off-Market Residences, relevant enquiry and contact information may be shared with an appropriate independent associated luxury real estate broker where needed to carry out the introduction you requested. Information may also be disclosed to professional advisers, payment or compliance providers, or competent authorities where reasonably necessary or legally required.
4. International transfers
Some technology providers or their subprocessors may process personal data outside the European Economic Area. Where this occurs, the relevant provider is expected to use a lawful transfer mechanism or safeguard, such as an adequacy decision or the European Commission's Standard Contractual Clauses, as applicable. ATRIO will use processors only where appropriate contractual and data-protection safeguards are available. You may contact hello@atrioagency.com for further information about the safeguards relevant to a particular transfer.
5. Retention
Enquiry data is retained only for as long as reasonably necessary for the relevant purpose. Where no relationship or transaction develops, ATRIO's working policy is to review and ordinarily delete or anonymise enquiry records within 12 months after the last meaningful contact. Records connected with an ongoing representation, project, transaction, dispute, compliance check or legal/accounting obligation may be retained for longer where necessary. Netlify submissions should be periodically deleted once they are no longer needed.
6. Your rights
Subject to the GDPR and applicable law, you may have rights to access, rectify or erase your personal data, restrict processing, object to certain processing, receive portable data where applicable, and withdraw consent at any time where processing relies on consent. Withdrawal does not affect processing already carried out lawfully. Contact hello@atrioagency.com to exercise these rights.
7. Required information
Fields marked as required are information ATRIO needs in order to assess or respond to the relevant enquiry. If you do not provide them, we may be unable to process the request.
8. Complaints
If you believe your data has been handled unlawfully, you may lodge a complaint with the Information and Data Protection Commissioner (IDPC) in Malta. Information is available at idpc.org.mt.
9. AI-assisted processing, automated decisions and marketing
ATRIO may use AI-assisted tools to help organise, summarise or classify enquiries and supporting material for internal review. These tools support ATRIO's workflow and do not make decisions producing legal or similarly significant effects solely by automated processing. Relevant enquiries and decisions remain subject to human review. ATRIO will use external technology providers for this purpose only where appropriate contractual and data-protection safeguards are in place. Submitting an enquiry does not subscribe you to a marketing newsletter. Any future direct-marketing programme requiring consent will be handled separately.
10. Changes
We may update this notice when our services, providers or legal obligations change. The effective date above identifies the version currently in force.