Privacy Policy

1. Introduction

Privacy is at the heart of what we do.

Vaultier provides private collection-management services designed to support the documentation, protection, care and continuity of valuable collections.

We recognise that information relating to private collections may be particularly sensitive. Details of ownership, valuations, provenance, insurance, custody and location can reveal significant information about individuals and their personal affairs.

We approach the handling of this information with discretion, care and respect for confidentiality.

This Privacy Policy explains how Vaultier collects, uses, stores, shares and protects personal information in connection with our website, private enquiries, prospective memberships and collection-management services.

For the purposes of this policy, "Vaultier", "we", "us" and "our" refer to VAULTIER FZ-LLC, trading as Vaultier.

Our website is https://vaultier.co.

This policy applies to collectors, prospective members, authorised representatives, trustees, personal assistants, family office personnel, professional advisers and other individuals whose personal information we process.

2. Information We Collect

The information we process depends on the nature of an individual's relationship with Vaultier.

2.1 Website visitors and private enquiries

When you visit our website or submit a private enquiry, we may collect:

• Your name and contact information.
• Your professional role or relationship to a collection.
• Information you choose to provide in an enquiry or correspondence.
• Records of communications with Vaultier.
• Technical information associated with your use of our website, such as IP address, browser information and relevant security or diagnostic logs.

We ask that you do not include unnecessary confidential collection information in an initial enquiry.

2.2 Members and collection representatives

Where collection-management services are provided, we may process information relating to:

• Collector and representative identities and contact details.
• Ownership and acquisition records.
• Collection inventories, photographs and descriptions.
• Provenance and supporting documentation.
• Purchase prices, valuations and insurance information.
• Storage locations, custody arrangements and movement histories.
• Condition assessments, restoration and maintenance records.
• Specialist appointments, instructions and correspondence.
• Authorised users, access permissions and delegated responsibilities.
• Other information reasonably required to administer the agreed services.

Some collection records may contain personal information about individuals other than the collector, including previous owners, beneficiaries, advisers and professional representatives.

We seek to limit the information collected to what is relevant and necessary for the services concerned.

3. How We Use Personal Information

We process personal information for purposes connected with the operation of Vaultier and the delivery of our services.

These may include:

Private enquiries and membership applications

To receive enquiries, communicate with prospective members, assess service suitability and arrange confidential discussions.

Collection documentation

To establish, organise, maintain and update records relating to individual objects and collections.

Collection management

To support the administration of valuations, insurance, conservation, restoration, storage, transport, custody and other agreed collection-related activities.

Authorised representation

To enable appropriately authorised trustees, personal assistants, family offices and other representatives to act on behalf of collectors within their assigned permissions.

Professional coordination

To communicate with relevant insurers, brokers, valuers, restorers, conservators, custodians and other specialists where necessary for authorised services.

Operational security

To administer our systems, manage access, investigate suspicious activity and protect the integrity of information entrusted to us.

Legal and regulatory obligations

To comply with applicable laws, lawful requests, contractual obligations and legitimate legal requirements.

Service improvement

To evaluate and improve our operations, provided such processing has an appropriate lawful basis and respects applicable confidentiality obligations.

We do not treat a private enquiry as permission to disclose collection information to unrelated third parties.

4. Legal Bases for Processing

Where the UK General Data Protection Regulation applies, we process personal information on one or more of the following lawful bases:

Contractual necessity: Where processing is necessary to take steps requested before entering into an agreement or to perform a contract with an individual.

Legitimate interests: Where processing is necessary for legitimate business purposes, including responding to professional enquiries, administering authorised collection relationships, maintaining service security and coordinating services, provided those interests are not overridden by the rights and freedoms of affected individuals.

Legal obligation: Where processing is required to comply with applicable legal or regulatory requirements.

Consent: Where we request and obtain consent for a specific processing activity, including where consent is required for optional communications or technologies.

The applicable lawful basis depends on the purpose and circumstances of the processing.

Where consent is the lawful basis, it may be withdrawn at any time. Withdrawal does not affect processing already carried out lawfully.

We will assess and document the appropriate lawful basis for each processing activity.

5. Confidentiality of Collection Information

Collection information is central to the relationship between Vaultier and its members.

We recognise that collection records may contain commercially, financially or personally sensitive information, including details that could create privacy or security risks if disclosed without authorisation.

Our approach is guided by the following principles:

Discretion: Information should be handled only for legitimate and authorised purposes.

Proportionality: Access and disclosure should be limited to what is reasonably necessary.

Controlled representation: A collector's appointment of an adviser or representative does not automatically authorise unrestricted access to every aspect of the collection.

Purpose limitation: Information provided for collection management should not be repurposed for unrelated activities without an appropriate lawful basis and, where required, authorisation.

Continuity: Collection records should be managed with appropriate consideration for changes in representatives, ownership and long-term stewardship.

Specific confidentiality commitments, access arrangements and responsibilities may be further defined in membership or service agreements.

6. Sharing Information with Third Parties

Vaultier may need to share limited information with third parties to fulfil authorised services or operate its business.

Depending on the services requested, recipients may include:

• Insurers and insurance brokers.
• Independent valuers and appraisers.
• Conservators, restorers and maintenance specialists.
• Storage, transport and custody providers.
• Legal, financial and professional advisers.
• Technology, hosting and operational service providers.
• Regulators, courts and public authorities where disclosure is legally required.

Information should be shared only where there is a legitimate purpose and an appropriate legal basis.

Where practicable, we seek to limit disclosures to the information relevant to the particular service or instruction.

We do not sell personal information or collection records to data brokers.

We do not disclose collection information for third-party advertising purposes.

Where third parties process personal information on our behalf, we seek to establish appropriate contractual and confidentiality protections.

Independent specialists may act as separate data controllers in relation to information they process for their own professional or legal responsibilities.

7. Authorised Representatives and Access

Vaultier recognises that valuable collections are frequently administered by individuals other than their owners.

These may include personal assistants, trustees, family office personnel, estate managers and professional advisers.

Access to collection information is intended to reflect the individual's responsibilities and the authority granted to them.

Where supported by the relevant service arrangements, permissions may be assigned or adjusted to reflect changes in a representative's role.

Collectors and authorised representatives are responsible for notifying Vaultier when access arrangements or delegated authority change.

Vaultier may request reasonable evidence of identity or authority before disclosing sensitive information or acting on instructions.

8. Information Security

Vaultier recognises the importance of safeguarding personal information and confidential collection records against unauthorised access, disclosure, alteration, loss and misuse.

We seek to apply technical and organisational safeguards appropriate to the sensitivity of the information processed and the risks involved.

These may include access restrictions, authentication controls, appropriate encryption, operational monitoring, contractual confidentiality requirements and procedures for responding to security incidents, as implemented within the relevant systems and services.

No electronic system or transmission method can be guaranteed to be completely secure.

Where a personal data breach occurs, Vaultier will assess its nature and impact and make any notifications required by applicable law.

9. International Data Transfers

Vaultier may engage with collectors, representatives, advisers and service providers across different jurisdictions.

Where personal information is transferred internationally, we will assess the applicable data protection requirements and implement appropriate safeguards where legally required.

For transfers subject to UK data protection law, these may include applicable adequacy regulations or recognised contractual transfer safeguards.

Details of relevant international transfers and safeguards may be requested using the contact information below.

10. Data Retention

Vaultier retains personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, contractual and regulatory requirements.

Retention periods may vary according to the type of information and the nature of the relationship.

Private enquiry information is retained according to the period reasonably required to manage the enquiry and any subsequent relationship.

Collection-management records may require longer retention because provenance, ownership, insurance, condition and transaction histories can remain relevant throughout the life of an object.

Retention decisions take account of:

• The purpose for which information was collected.
• The duration of the relevant contractual relationship.
• The need to preserve legitimate collection records.
• Applicable legal and regulatory requirements.
• Potential disputes or legal claims.
• The sensitivity of the information and associated risks.

When information is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable requirements.

Where records must be retained, access may be restricted as appropriate.

11. Your Privacy Rights

Depending on the applicable law and circumstances, individuals may have the right to:

• Request access to personal information held about them.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal information in certain circumstances.
• Request restriction of processing.
• Object to certain processing activities.
• Request transfer of eligible personal information.
• Withdraw consent where processing relies on consent.
• Challenge certain decisions made solely through automated processing where applicable.

Right to object: You may object to processing based on legitimate interests in circumstances provided by applicable law. You have the right to object at any time to the processing of your personal information for direct marketing.

These rights are not absolute and may be subject to legal exceptions.

For example, a request to erase information may not require Vaultier to delete records that must lawfully be retained or information that is necessary for establishing, exercising or defending legal claims.

To exercise a privacy right, please contact operations@accessvaultier.co.

We may request reasonable information to verify your identity before responding.

Individuals may also lodge a complaint with the relevant data protection supervisory authority. For matters subject to UK data protection law, the relevant authority is the Information Commissioner's Office (ICO), accessible at https://ico.org.uk.

12. Cookies and Website Technologies

Our website may use technologies necessary for its operation, security and performance.

If we use optional analytics, preference or marketing cookies or similar technologies, we will provide relevant information and obtain consent where required by applicable law.

Further information about the technologies actually used, their purposes and available controls will be provided through the website or an accompanying cookie notice, where applicable.

13. Communications

Vaultier may contact individuals in response to private enquiries, membership applications, service requests and existing professional relationships.

Operational communications may include information necessary to administer an enquiry, agreement or authorised service.

Marketing communications, where undertaken, will be sent in accordance with applicable electronic marketing and data protection requirements.

Individuals may opt out of marketing communications at any time.

Opting out of marketing does not necessarily prevent Vaultier from sending communications required for an existing contractual or operational relationship.

14. Automated Processing and Technology

Vaultier's services may use technology to organise collection information, identify outstanding administrative requirements and support collection-management workflows.

Technology-assisted processing does not, by itself, determine an individual's legal rights or contractual entitlements.

If Vaultier introduces solely automated decision-making that produces legal or similarly significant effects on individuals, we will assess the applicable requirements and provide additional information and safeguards where required.

15. Information About Other Individuals

Collection documentation may contain personal information relating to individuals other than the collector or principal member.

Where a collector or authorised representative provides such information, they should ensure that the disclosure is lawful and within the scope of their authority.

Vaultier will handle personal information about third parties in accordance with applicable data protection requirements.

Where legally required, we will provide appropriate privacy information to individuals whose personal data has been obtained indirectly, subject to applicable exceptions.

16. Children

Vaultier's website and services are intended primarily for adults and authorised professional representatives.

We do not intentionally solicit personal information from children through the public website.

Where information concerning minors is relevant to legitimate collection ownership, trusts, inheritance or estate arrangements, it will be handled with appropriate care and in accordance with applicable law.

17. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, operations, legal obligations or data-processing practices.

The latest version will be made available on our website, together with its effective date.

Where changes materially affect the processing of personal information, we will provide additional notice where required by law.