Privacy Statement

Thank you very much for your interest in Thyssen-Bornemisza Art Contemporary (TBA21).
Protecting your privacy when using our website ( is particularly important to us. Therefore, we are providing you below with detailed information on the processing of your personal data. 

TBA21 is responsible for the following data processing: 
When using and processing personal data, TBA21 strictly adheres to the applicable data-protection laws and regulations. TBA21 is entitled to use personal and anonymous data to the extent legally permissible, subject to the data subject rights described below.

This Privacy Statement applies to (, but not to websites controlled and operated by third parties. Please review the privacy statements for websites controlled and operated by third parties, since these websites are beyond our control and TBA21 is not responsible for their content and data protection measures.

1. Data security

TBA21 has taken appropriate technical and organizational measures to protect your data against loss, manipulation or unauthorized access. The measures taken are subject to regular review and are continuously adapted to the state of the art. Should there be a violation of the protection of your personal data, which will probably result in a high risk for your rights and freedoms, we will notify you immediately and, if possible, within 72 hours.


2.1 Data provided by you

If you correspond with us or fill out a form on our website with data, you acknowledge that the data you enter onto the form will be processed for the purposes described below.

2.2. Cookies and Google AdSense

Information about cookies. We automatically collect data through the use of cookies. A cookie is a small text file which stores internet settings. Almost all websites use this technology. It is downloaded by your internet browser when you first visit a website. When this website is next visited with the same terminal, the cookie and the information stored therein is either sent back to the website that created it (first-party cookie) or to another website to which it belongs (third-party cookie). This allows the website to detect that it has already been visited with this browser and in some cases it changes the content displayed.

The user data collected by technically required cookies are not used to create user profiles. This safeguards your interest in data protection. The cookies, which are a technical necessity, are generally deleted when the browser is closed. Persistent cookies have a lifespan which varies between a few minutes and several years.

Should you not wish these cookies to be stored, please deactivate the acceptance of these cookies in your internet browser. However, this may limit the functionality of our website. You can also delete persistent cookies via your browser at any time.

Advertising service with Google AdSense. Google AdSense, an advertising service by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") is used to operate advertising (text advertisements, banners etc.) on our pages, provided that you have consented to the use of the Google AdSense cookies.. Your browser stores cookies (small text files) on your hard drive for this purpose. These cookies are used by Google to personalize content and adverts, to offer functions for social media and to analyze access to our website. Device identification is used in relation to apps. Moreover, information about your use of our website is shared with partners for social media, advertising and analysis. These partners combine this information with other data that you have provided them with or that they have collected in the context of your use of the services. For further information on Google AdSense, click here.

Your personal data are only stored for as long as you consent to them being processed. You can revoke your consent to TBA21 at any time.


General contact form

Contact form (Information on academic title, title, first name, surname, company name, home address, email, telephone number): when you submit the relevant contact form, the personal data you input are processed.

 - Purpose: answering your query.
 - Justification: legitimate interest in being able to process and reliably answer your individual queries.
 - Storage duration: 12 months.


Newsletter registration

Newsletter registration (first name, surname, email): when you submit a newsletter registration, the personal data you enter are processed for the following purpose if you actively want to be sent the newsletter.

 - Purpose: information sent quickly and regularly, invitations to future events.
 - Justification: consent.
 - Storage duration: until withdrawn.


You may assert the following rights regarding the data processing described:

5.1 Right to information

You may request confirmation of whether and to what extent your personal data are being processed.

5.2 Right to correction

If we are processing incomplete or incorrect personal data about you, then you may request that they be corrected or supplemented.

5.3 Right to deletion

You may request the deletion of your personal data as long as the purpose for which they were collected has ceased to apply, the processing is unlawful, the processing disproportionately interferes with your legitimate interests in protection, or the data processing is based on your consent, and you have withdrawn this. In this regard, it is necessary to consider that there may be other reasons that may prevent immediate deletion of your data, e.g., legally regulated retention requirements, pending proceedings, asserting, exercising or defending legal claims, etc.

5.4 Right to restricted processing

You have the right to request that processing of your data be restricted if:
 - you dispute the accuracy of your data, namely for a period which enables us to review the accuracy of the data,
 - the processing of your data is unlawful, but you reject deletion and instead request that use of the data be restricted,
 - we no longer need the data for the envisaged purpose, but you still require this data to assert, exercise or defend legal claims, or
 - you have objected to the processing of the data.

5.5 Right to data portability

You may ask us to provide your data, which you have made available to us, in a structured, common and machine-readable format, provided we are processing the data on the basis of your consent or in order to satisfy a contract between us and processing occurs with the help of an automatic process.

5.6 Right to object

If we process your data in order to perform tasks that are in the public interest, to exercise official authority or, when processing the data, we invoke the necessity of safeguarding our legitimate interest, you can object to this data processing provided there is a predominant interest in the protection of your data. At any time, you may object without providing grounds to the sending of advertising.

5.7 Right to complain

If you think we have breached Spanish or European data protection law when processing your data and have violated your rights as a result, we ask that you contact us in order to be able to clarify any questions. Of course, you also have the right to complain to the Agencia Española de Protección de datos.

5.8 Right to withdraw

All the declarations of consent you have given may be withdrawn independently from one another at any time. The result of withdrawal is that, from this date, we will no longer process the data for the purposes specified in the declaration of consent and, consequently, that the corresponding rights, benefits, etc., can no longer be used.
These rights can be asserted with TBA21 directly by sending notification to the email address



Fundación TBA21 | Thyssen-Bornemisza Art Contemporary
Amor de Dios 1
28014 Madrid, Spain
+34 915 27 59 86

Supervision & Responsibility

This Policy is reviewed and updated by the Director of Digital & Innovation and approved by the Board.
Which cookies do you accept?