Privacy Policy
Data protection statement


Note: only the German version of this privacy policy is legally valid and binding: Datenschutzerklärung

Table of Contents

1. Introduction

The protection of your privacy and your personal data is very important to us. We process your personal data confidentially and in compliance with the applicable data protection regulations, in particular the Swiss Federal Act on Data Protection and, where applicable, the European Union's General Data Protection Regulation.
In this privacy policy, we inform you about what personal data we process when you visit our website and use our services, for what purposes this is done, the legal basis on which the processing is based, and what rights you have.
It applies to all websites operated by us and to the online services offered via them.

2. Data controller

The data controller responsible for the processing of personal data within the meaning of the Swiss Data Protection Act and - where applicable - the General Data Protection Regulation is:

BB International Fine Arts GmbH
Churerstrasse 160 B, 8808 Pfaeffikon
Switzerland
Phone: +41(0)764022919
E-mail: privacy@bbifa.com
Website: www.bbifa.com

If you have any questions regarding data protection or wish to exercise your rights as a data subject, you may contact the above address directly at any time. Alternatively, you may also contact us by email.

3. Geographical scope and language

This privacy policy is intended for visitors to our website, our customers, our business partners and any other individuals whose personal data we process. Our company is based in Switzerland.
Where we process personal data of individuals in the European Economic Area (EEA) or offer our services there, we also comply with the applicable provisions of the General Data Protection Regulation (GDPR). This privacy policy also takes into account international business relationships, insofar as data protection regulations require this.
Only the German version of this privacy policy is legally valid and binding. Translations into other languages are provided solely for the sake of clarity and are not legally binding.

4. Definitions

Personal data refers to any information relating to an identified or identifiable natural person.
Processing refers to any handling of personal data. This includes, in particular, the collection, storage, use, transmission, alteration, archiving, erasure or destruction of personal data.

5. Principles of data processing

We process personal data exclusively in a lawful, transparent and purpose-limited manner, in good faith and only to the extent necessary for the respective purposes. We ensure that personal data is factually accurate and up to date, and protect it against unauthorised access, loss, misuse or manipulation by means of appropriate technical and organisational measures.

6. Purposes of data processing

We process personal data in particular for the following purposes:

7. Legal basis

Where the General Data Protection Regulation applies, the processing of personal data is carried out on the basis of your consent, for the purpose of taking pre-contractual measures, for the performance of a contract or to comply with legal obligations, and to safeguard the legitimate interests of our company.
Under Swiss data protection law, the processing of personal data is carried out in accordance with the provisions of the Federal Act on Data Protection.

8. Categories of data processed

Depending on how our website is used, we process the following categories of personal data: master data, contact details, communication data, contractual data, payment information, technical usage data, device information, browser information, IP address, log data, location information and content provided voluntarily.
Which data is processed in each individual case depends on the specific use of our website or our services.

9. Recipients of personal data

Personal data will only be disclosed to third parties where this is required by law, necessary for the performance of a contract, where you have given your express consent, or where we engage service providers to carry out specific services.
These may include, in particular, hosting providers, IT service providers, communications service providers, payment service providers, ticketing providers and other technical service providers.
All service providers are carefully selected and contractually obliged to comply with data protection requirements.

10. Validity of this Privacy Policy

We reserve the right to amend this Privacy Policy as necessary, for example in response to changes in legal requirements, technical developments or new services. The current version published on our website shall apply at all times.

11. Rights of affected persons

Provided that the relevant legal requirements are met, you have the following rights regarding the processing of your personal data:

12. Data Security

We place great importance on the protection of personal data. To this end, we implement appropriate technical and organisational measures to safeguard such data against loss, misuse, manipulation, unauthorised access or any other unlawful processing. This includes ensuring the confidentiality, integrity, availability and resilience of our systems. We continuously review our security measures in line with technological developments. However, we cannot guarantee the complete security of data transmission over the internet.

13. Confidentiality of communication

When you communicate with us by email, via a contact form or by any other electronic means, your data is generally transmitted in encrypted form, provided this is technically possible. We would, however, point out that electronic communication may be subject to security vulnerabilities. We cannot therefore guarantee complete protection against access by third parties.

14. Retention and erasure of personal data

We only store personal data for as long as is necessary to fulfil the relevant purposes or for as long as statutory retention periods apply.
Once the relevant purpose no longer applies or the statutory retention periods have expired, the data will be deleted or anonymised.
In certain circumstances, processing may be restricted or the data blocked instead of being deleted, if statutory obligations or other legal grounds prevent immediate deletion.

15. Automated decision-making and profiling

As a general rule, no decisions with legal effect or which have a comparable significant adverse impact are made solely on the basis of automated processing. Should we use automated decision-making processes or profiling in individual cases, data subjects will be informed of this separately, where required by law.

16. Protection of Minors

Our websites are generally intended for adults. Persons under the age of 16 should only provide personal data with the consent of their legal guardians. Should we become aware that personal data relating to minors has been processed without the necessary consent, such data will be deleted.
We are committed to protecting minors and take appropriate measures to protect underage users from unsuitable content.

17. Exercising your rights

You may contact us at any time to exercise your data protection rights. Please use the contact details provided for this purpose. We will process your request within the time limits laid down by law.

18. Website hosting and server log files

To ensure the secure and reliable operation of our website, we work with specialist hosting providers. When you access our websites, the web server automatically records technical information in what are known as server log files. This includes the IP address, the date and time of access, the browser type, the browser version, the operating system, device information and the referrer URL.
This processing is carried out solely for the purpose of providing the relevant website, ensuring system security, analysing errors and defending against attacks. This data is not combined with any other personal data.
Where external hosting service providers are used, their involvement is based on a data processing agreement.

19. Access Security

We implement appropriate technical security measures to protect our website and our IT infrastructure. These may include, in particular: firewalls, intrusion detection and intrusion prevention systems, access restrictions, regular security updates, encryption methods, data backups, and monitoring and logging systems. These measures are intended solely to ensure the secure operation of our online services.

20. SSL/TLS Encryption

For security reasons, our websites use SSL/TLS encryption. You can recognise an encrypted connection by the address bar in your browser and the padlock icon. The encryption protects the transmission of confidential content between your device and our web servers from unauthorised access.

21. Use of JavaScript and scripting functions

We use JavaScript to add interactive elements to our websites, provide certain functions and ensure the security of our IT infrastructure. It runs directly on your device. In particular, we use JavaScript for the dynamic display of content, smooth navigation, the prevention of automated access, and the real-time validation of user input. You can disable JavaScript at any time in your web browser's security settings. Please note, however, that in this case, significant parts of our website or security features will no longer be available.

22. Cookies

We do not use cookies ourselves when operating our website. However, if you use or activate individual third-party services embedded on our website (such as external map, font, analytics or multimedia services), these external providers may store their own cookies or similar technologies on your device.
Cookies are small text files used to ensure the technical functionality of the respective services, to save settings, to enhance user-friendliness and to enable statistical analysis. We have no direct influence over the nature, scope or exact functioning of the cookies set by third-party providers. In this respect, the data protection and cookie policies of the respective service providers apply. These can be found in the appendix (List of services used and privacy policies).

23. Cookie settings

You have full control over whether cookies are stored on your device. You can configure your web browser to either reject third-party cookies altogether or to allow them on a case-by-case basis. Alternatively, you can set your browser to automatically delete or block cookies at the end of your browsing session. You can delete cookies that have already been stored at any time via your browser's security settings. Please note that disabling third-party cookies may mean that certain features or services integrated into our website (e.g. interactive maps or embedded videos) no longer work properly or are only available to a limited extent.

24. Local storage

Our websites may make use of browser functions such as local storage or session storage. These are used to store user settings, enhance the user experience and ensure the secure operation of the website. Unlike cookies, this data is not automatically transmitted to servers. You can delete the stored data at any time via your browser settings.

25. Embedding of external content

Our websites may embed content or technical resources from external providers. When you access this content, your IP address may be transmitted to the relevant provider, as this is technically necessary to deliver the content to your browser. Further information on the services used can be found in the following sections.

26. Protection against misuse

Technical security mechanisms may be used to protect our websites against spam, automated access, malware and other forms of misuse. In particular, IP addresses, information on technical devices, browsers, times of use and connection data may be processed. This processing is carried out solely to ensure the security and integrity of our website.

27. Changes to the technical infrastructure

We reserve the right to change the hosting provider, security mechanisms or technical components at any time, provided this is necessary to improve the security, performance or availability of our website. This may result in changes to the technical services used.

28. Contacting us

If you contact us via our forms or by email, we will process the data you provide solely for the purpose of dealing with your enquiry, carrying out pre-contractual measures or fulfilling an existing contract. The mandatory fields in the forms are used solely to enable us to process your enquiry. Your data will be deleted as soon as your enquiry has been fully resolved and provided there are no statutory retention obligations to the contrary. Please note that unencrypted email communication may be vulnerable to security breaches.

29. Contact by telephone

When you contact us by telephone, we only process the personal data necessary to deal with your enquiry. Telephone calls are not, as a rule, recorded. Should a call be recorded in exceptional circumstances, you will be expressly informed of this before the call begins and asked for your consent.

30. Communication by post

If you contact us by post, we will use the personal data you provide solely to deal with your enquiry and to fulfil legal or contractual obligations.

31. Informational letters/newsletters

You have the option to subscribe to our informational letters and similar information regarding events, exhibitions, services and news from our company.

32. Informational letters/newsletters: Required data

For this purpose, we generally require your email address or your postal address. Further details are provided on a voluntary basis and are used solely to address you personally or to tailor our information to your needs.

33. Informational letters/newsletters: Distribution

Distribution takes place exclusively on the basis of your consent, within the framework of an existing business relationship, or on another legal basis. The newsletter contains information about our company, events, services, projects or similar topics.

34. Informational letters/newsletters: Performance measurement

We do not measure the performance of the email newsletter. Neither the click-through rate nor any other technical details relating to recipients are recorded or processed. Where required by law, any such analysis would be carried out solely on the basis of your consent.

35. Informational letters/newsletters: Unsubscribing

You may unsubscribe from the informational letters or the newsletter at any time with future effect. Each newsletter contains a corresponding unsubscribe link. Alternatively, you may also unsubscribe at any time using the contact details provided by us. Once you have successfully unsubscribed, your address will no longer be used for sending these communications.

36. Storage of communication data

We store communication data only for as long as is necessary to process your enquiry, to comply with legal obligations, to fulfil the terms of a contract, to establish, exercise or defend legal claims, or in accordance with statutory retention obligations. Once these periods have expired, the data will be deleted or anonymised.

37. Applications

If you apply to us electronically or by post - for example, for an exhibition stand, to take part in an event or to work with us - we will process your personal data solely for the purpose of conducting the application process. This data includes, in particular, personal details, contact details, application documents, qualifications and all correspondence. The data will only be made available to those involved in the process and will be deleted once the process has been completed, unless explicit consent has been given for longer retention or statutory obligations prevent this.

38. Legal bases (communication)

The processing of personal data in the context of communication is carried out on the basis of your consent, for the purpose of taking pre-contractual measures, for the performance of a contract or to fulfil legal obligations, or on the basis of our legitimate interest in efficient communication. Processing is carried out in accordance with Swiss data protection law within the framework of the statutory provisions of the Federal Act on Data Protection.

39. General information on external map, font and design services

We use various external services to ensure that our website is visually appealing, user-friendly and technically sound. Depending on how these are technically integrated, a connection to the respective provider's servers may be established when you access a relevant page. In doing so, your IP address, date, time, browser type, operating system, referrer URL and technical device information may be processed.

40. Google Maps

Our websites may use interactive maps provided by Google Maps. Google Maps is used to display geographical information and makes it easier to locate our company. When you access the maps, IP addresses, location data, information about the browser and device used, usage data and the referrer URL may be processed. This data is processed solely for the purpose of providing the map function. Where required by law, the integration will only take place after you have given your consent.

41. OpenStreetMap

Our websites may use map data from OpenStreetMap. OpenStreetMap is a freely available mapping project that provides geographical information. Depending on the technical implementation, a connection may be established with the servers of the relevant map provider or with a tile server when a map is loaded. In doing so, IP addresses, information about the browser used, the date, the time and technical connection data may be processed. This is done solely for the purpose of providing the map function.

42. Google Fonts

To ensure consistent font display, our websites may use Google Fonts. Depending on the technical implementation, the fonts are either stored locally on our web server or loaded from Google's servers. Where fonts are integrated locally, no connection is made to Google's servers. If Google Fonts are loaded online, your IP address is transmitted to Google. Use is subject exclusively to your consent, where required by law.

43. Adobe Fonts

Fonts from Adobe Fonts may be used to ensure a consistent design across our websites. When you visit the relevant pages, a connection may be established with Adobe's servers. In doing so, IP addresses, information about the browser and operating system used, the time the page was accessed, and technical usage data may be processed. This is done solely for the purpose of providing the fonts used. Where required by law, the integration will only take place after you have given your consent.

44. Font Awesome

Our websites may use Font Awesome to display icons and graphical user interface elements. Depending on the technical implementation, the files used are either hosted locally or loaded via the provider's servers. When files are loaded externally, technical connection data - in particular your IP address - may be processed. This is done solely to ensure a consistent and user-friendly design.

45. Local integration of resources

Where technically feasible, we host fonts, icons and design libraries locally on our web servers. This allows us to reduce, or even completely avoid, the transfer of personal data to external providers. As a general rule, local hosting is preferred to external integration, provided this is technically and economically feasible.

46. Legal bases (map, font and design services)

Where the General Data Protection Regulation applies, the processing of your data is based in particular on your consent, our legitimate interest in a user-friendly and technically sound website, or where processing is necessary to provide functions that you have expressly requested. Under Swiss data protection law, processing is carried out in accordance with the provisions of the Federal Act on Data Protection.

47. Data transfers to third countries and safeguards (map, font and design services)

When using certain services, it cannot be ruled out that personal data may be transferred to servers outside Switzerland or the European Economic Area. Where we transfer personal data to such a third country or engage service providers to process the data there, we ensure an adequate level of data protection through the following measures:

Further details on the specific guarantees offered by the individual service providers can be found in the appendix below (List of services used and privacy policies).

48. Changes to the services used

We reserve the right to replace, add to or remove the map, font and design services used on our website at any time. The version of this privacy policy current at the time of your visit shall apply.

49. General information on embedded media

Our websites may embed videos, audio files, digital publications or similar multimedia content from external providers. This is intended to present our content in an engaging way and to enhance the information and services we offer. When you access a page containing embedded media, a connection may be established with the servers of the relevant provider. In doing so, your IP address, date, time, browser type, operating system, device information, referrer URL, content accessed and technical usage data may be processed.

50. YouTube

Our websites may embed videos from the YouTube platform. YouTube is used to provide and play back audiovisual content. Where technically possible, we use YouTube's enhanced privacy mode. A connection to YouTube's servers may be established either when a video is played or as soon as the embedded player is loaded. In doing so, your IP address, browser information, device information, usage data, referrer URL and information about the video being played may be processed. If you are logged into your YouTube or Google account at the same time, the provider may associate your usage with your user account. You can prevent this by logging out of your user account before visiting our website.

51. Vimeo

Our websites may embed videos from the Vimeo service. When you visit a page containing embedded Vimeo content, a connection may be established with Vimeo's servers. In doing so, your IP address, browser and device information, usage data, the referrer URL and information about videos played may be processed. Where technically possible, privacy-friendly embedding options are used. Where required by law, embedding takes place only with your consent.

52. SoundCloud

Our websites may embed audio files or audio players from the SoundCloud service. SoundCloud enables audio content to be played directly on our website. When loading such content, a connection may be established with SoundCloud's servers. In doing so, your IP address, browser version, device type, usage data, referrer URL and information about the audio content played may be processed. If you are logged in to SoundCloud at the same time, this information may be linked to your user account. You can prevent this by logging out of your user account before using our website.

53. Yumpu

Our websites may use the Yumpu service to provide digital publications. In particular, this allows brochures, programmes, catalogues, documentation or magazines to be displayed directly on the website. When this content is accessed, a connection may be established with Yumpu's servers. In doing so, IP addresses, information about the browser used, technical connection data, information about the device used, and the date and time of access may be processed. This is done solely for the purpose of providing the embedded publications.

54. Automatic media start

Where technically possible, we do not automatically play video or audio content when our website is accessed. Multimedia content is only started by an active action on the part of the user.

55. Storage of usage information

Providers of embedded multimedia services may use their own cookies or similar technologies. This enables them, in particular, to process information regarding the use of the content, the media played, device information, browser data and technical connection data. We have no influence over the nature or scope of this data processing. In this respect, the data protection provisions of the respective provider apply.

56. Data transfers to third countries and safeguards (multimedia services)

When using integrated multimedia services, it cannot be ruled out that personal data may be transferred to servers outside Switzerland or the European Economic Area. Where we transfer personal data to such a third country or use service providers who process data there, we ensure an adequate level of data protection through the following measures:

Further details on the specific guarantees offered by the individual service providers can be found in the appendix below (List of services used and privacy policies).

57. Legal bases (multimedia services)

Where the General Data Protection Regulation applies, the processing of personal data in connection with multimedia services is carried out on the basis of your consent, our legitimate interest in presenting our content in an attractive and user-friendly manner, or where the processing is necessary to provide functions that you have expressly requested. Under Swiss data protection law, processing is carried out in accordance with the provisions of the Federal Act on Data Protection.

58. Changes to the multimedia services used

We reserve the right to adapt, replace or supplement the video, audio and publication services used on our website at any time. The version of this privacy policy current at the time of your visit shall apply.

59. Note on responsibility

If you interact directly with the relevant provider via embedded multimedia content - for example, by playing a video, sharing content or logging into a user account - any further processing of personal data is the sole responsibility of the relevant provider. We have no influence over this data processing. Only the data protection provisions of the relevant service provider apply.

60. General information about our social media presence

We maintain company profiles on various social networks and online platforms to provide information about our services, events, projects and news, and to communicate with interested parties, customers and business partners. Our social media presence complements the information we provide and serves to promote our company's image. Simply visiting our website does not, in principle, result in any personal data being transferred to social networks. A connection to the relevant provider is only established when you click on a relevant link or interact with embedded content.

61. Processing of personal data (social media)

When you visit our company profiles, personal data may be processed by the respective platform operator. This includes, in particular: IP address, device information, browser information, location data, usage data, interactions, communication content, profile information, as well as cookies and similar technologies. The nature, scope and purpose of this data processing are governed exclusively by the data protection policies of the respective platform operator. We generally have no influence over this processing.

62. Communication via social media

If you contact us via our social media profiles, we will use the personal data you voluntarily provide solely to deal with your enquiry. This may include, in particular: - name, username, message content, comments, reactions, uploaded content and the time of the communication. Please note that any information provided via social media may also be processed by the respective platform operator.
For confidential or sensitive matters, we recommend contacting us directly by email or post.

63. Facebook

We may operate a business profile on Facebook. Facebook is used in particular to provide information about our company and to communicate with interested parties. When you visit our Facebook profile, data processing is primarily carried out by the platform operator. Further information on this can be found in the privacy policy of the respective provider.

64. Instagram

We may operate a company profile on Instagram. This platform allows us to publish images, videos, information and the latest updates. When you visit our profile, personal data may be processed by the platform operator. Further details can be found in the privacy policy of the relevant provider.

65. LinkedIn

We may operate a company profile on LinkedIn. LinkedIn is used in particular for professional communication and to provide information about our company. When you visit our company profile, personal data may be processed. Further information on this can be found in the platform operator's privacy policy.

66. Pinterest

Our websites may contain links to our company profile on Pinterest. Pinterest is particularly well-suited to the publication and sharing of visual content. If you click on such links, you will leave our website. The respective platform operator is solely responsible for the subsequent processing of personal data.

67. TikTok

We may publish content on TikTok. The platform is primarily used for providing audiovisual content and communicating with users. When you visit our TikTok profile, personal data may be processed by the platform operator. Any further data processing is carried out exclusively in accordance with the data protection provisions of the respective provider.

68. X

Our websites may link to a company profile on X. When you visit this profile, personal data may be processed. This may include, in particular, usage data, device information and communication data. Further information on this can be found in the privacy policy of the respective platform operator.

69. Bluesky

Our websites may link to our company profile on Bluesky. Clicking on the relevant links establishes a connection to the servers of the respective provider. Any further processing of personal data is carried out exclusively in accordance with the platform operator's privacy policy.

70. Joint controllership

Where provided for by law or offered by individual platform operators, arrangements regarding joint controllership may apply to certain data processing activities. The relevant details can be found in the respective agreements and privacy notices of the platform operators.

71. Statistical analyses

Social network operators may provide us with anonymised or aggregated statistical information regarding the use of our company profiles. In principle, this information does not allow any conclusions to be drawn about individual persons. We use this data exclusively to improve the information we provide and our communications.

72. Social Plugins

As a general rule, our websites do not use social plugins that automatically transmit personal data to social networks as soon as a page is accessed. Where social media functions are used, this is done in the most privacy-friendly manner possible or only after the user has taken active action.

73. Links to social networks

The social network icons or buttons embedded on our websites are generally merely external links to our company profiles on these networks. A connection to the relevant social network is only established once such a link has been clicked.

74. Data transfers to third countries and safeguards (social media)

Social media operators process personal data on their own servers. These may also be located outside Switzerland or the European Economic Area. This may result in your data being transferred to third countries. Where we have influence over such data transfers or use service providers that process data in these countries, we ensure an adequate level of data protection through the following measures:

Further detailed information on the specific guarantees offered by the individual social media platforms can be found in the appendix below (List of services used and privacy policies).

75. Legal bases (social media)

Where the General Data Protection Regulation applies, the processing of personal data in connection with our social media presence is carried out on the basis of your consent and our legitimate interest in modern corporate communications, the handling of your enquiries, public relations and the external presentation of our company. Under Swiss data protection law, processing is carried out in accordance with the provisions of the Federal Act on Data Protection.

76. Changes to our social media presence

We reserve the right to amend, supplement or discontinue the social networks we use at any time. The networks currently in use can be found via the links to our company profiles embedded on our website.

77. AddToAny

Our websites may use the AddToAny service. This service provides buttons and functions that allow content from our website to be shared via various social networks, messaging services or by email. The integration is intended to provide user-friendly sharing functions and to improve the reach of our content. When you visit a page with integrated AddToAny functions, personal data may be processed, depending on the technical implementation.
This may include, in particular: IP address, date and time of the page visit, browser type and version, operating system, referrer URL, technical device information and information about the use of the sharing functions.
Where technically possible, the integration is designed to be privacy-friendly. A connection to the selected social network or communication service is only established once you actively use a sharing function. Please note that from this point onwards, the privacy policy of the selected service applies and any further processing of personal data takes place exclusively under its responsibility. Further information on data processing by AddToAny can be found in the provider's privacy policy.

78. Cloudflare

To secure our website and optimise its loading times, we use the "Cloudflare" service provided by Cloudflare, Inc. (USA). Cloudflare acts as a Content Delivery Network (CDN) and protects the website from cyber-attacks (e.g. DDoS attacks) and misuse. When you visit our website, your data traffic is technically routed via Cloudflare's servers. In doing so, technical connection data (in particular your IP address, the date and time of your visit, and device and browser information) is processed. This data is absolutely essential for the secure and efficient operation of the website. Data is transferred to the USA on the basis of the safeguards described in point 49, as the provider is certified under the Data Privacy Framework.

79. Appendix - List of services used and privacy policies

The following overview contains the privacy policies of the external services used on this website. The current privacy policies of the respective providers shall prevail.
List of services and information on data protection. Version July 2026

Service and Privacy Policy:

Notes

80. Further sources


» Continue to the Legal Notice

« To the Homepage