Privacy Policy - ALVAMY'S

Alvamy’s (“we,” “us,” or “our”) is a luxury art and antiques house that promotes contemporary artworks, unique objects, emerging artists, and, in particular, Western European art. We are committed to protecting the privacy and confidentiality of every collector, consignor, and visitor who interacts with our services.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, whom we disclose it to, and what rights you have regarding your information. It applies to our website, www.alvamys.com, our mobile applications, and our services. By using our services, you confirm that you have read and understood this Policy.

Questions or concerns? Contact our Data Privacy Team:

Email: privacy@alvamys.com

Postal address: 42 Mihai Viteazul Street, Bălți Municipality, Republic of Moldova

Phone: +373 794 81 777

1. Who We Are

Alvamy’s operates as a group of affiliated entities across several jurisdictions. For the purposes of data protection legislation, the data controllers are:

Alvamy’s – Republic of Moldova – the principal controller for customers.

Each entity is independently registered with the competent data protection authority. Where the General Data Protection Regulation (GDPR) applies, Alvamy’s Ltd. acts as the principal controller for residents of the European Economic Area and the United Kingdom.

2. Data We Collect

We collect data in four main ways: information you provide directly to us, information generated through your use of our services, information received from third parties, and information we infer from the above.

2a. Information You Provide to Us

Identity data: full name, title, and date of birth, where required for age verification in high-value transactions.
Contact data: email address, postal address, and telephone number.
Account login data: username and encrypted password, where you register an account.
Transaction data: purchase history, auction bids, consignment submissions, and payment method details, including card type and the last four digits. Full card numbers are never stored. Please see Section 5.
Communication data: emails, conversation transcripts, valuation requests, and survey responses you send to us.
Preferences: wish-list items, saved searches, and currency and language selections.
Consignment data: photographs, descriptions, provenance documentation, and insurance valuations for objects you submit for sale.

2b. Data Collected Automatically

Device and browser data: IP address, browser type and version, operating system, and screen resolution.
Usage data: pages viewed, time spent on the website, click paths, referring URLs, and search queries.
Cookie and tracking data: session cookies, preference cookies, and analytics identifiers. Please see Section 8.
Location data: country-level location derived from your IP address for displayed currency and compliance purposes.

2c. Data Received from Third Parties

Payment processors, including Stripe and PayPal: transaction status and fraud-verification signals.
Identity-verification providers: the results of KYC and AML checks for transactions exceeding regulatory thresholds.
Art-market databases: provenance information, authenticity records, and auction history from recognised databases.
Social media platforms: where you choose to connect a social media account or share content from our website.

2d. Sensitive Data

We do not seek to collect special-category personal data, such as racial or ethnic origin, health information, or biometric data, unless you voluntarily provide such information in correspondence.

Where such data is received, it will be handled with additional care and, where required by law, on the basis of your explicit consent.

3. How We Use Your Data

We process your personal data only where we have a lawful basis for doing so. The table below sets out our principal processing activities.

Purpose	Lawful Basis
Processing purchases, auction bids, and consignments	Performance of a contract
Creating and managing your account	Performance of a contract
Sending order confirmations and delivery updates	Performance of a contract
Responding to enquiries and valuation requests	Performance of a contract / Legitimate interests
Preventing fraud and verifying identity	Legal obligation / Legitimate interests
Compliance with anti-money laundering requirements	Legal obligation
Personalising your browsing experience	Consent / Legitimate interests
Sending marketing emails and catalogues	Consent
Analysing and improving our services	Legitimate interests
Complying with tax, export, and customs obligations	Legal obligation
Resolving disputes and enforcing our terms	Legitimate interests / Legal obligation

Where we rely on legitimate interests as our lawful basis, we have conducted a balancing assessment and concluded that our interests do not override your rights and freedoms.

You may request a copy of our legitimate-interest assessments by contacting privacy@alvamys.com.

4. Marketing Communications

With your consent, we may send you:

Announcements about new arrivals and exhibitions.
Auction previews and catalogues.
Editorial content and art-market insights.
Invitations to exclusive collector events and private viewings.

You may unsubscribe at any time by clicking the unsubscribe link in any marketing email, updating your preferences in your account dashboard, or emailing privacy@alvamys.com.

We will process your request within five working days.

Please note that transactional emails, including order confirmations and shipping updates, are not marketing communications and cannot be disabled while an active contract or transaction remains in place.

5. Payment and Financial Data

Alvamy’s does not store complete payment-card numbers in its systems. All card payments are processed through PCI DSS Level 1-compliant payment processors, currently Stripe Inc. and PayPal Holdings, Inc.

We receive and retain only:

Card type, such as Visa or Mastercard.
The last four digits of the card number.
The card’s expiry month and year.
The billing postal code, for fraud-verification purposes.

For high-value transactions, generally exceeding USD 10,000, anti-money laundering regulations may require us to verify your identity.

This may involve requesting a government-issued photographic identity document and proof of address. These documents may be retained for the period required by law, generally five years following the transaction.

We do not sell your personal data.

We share personal data only in the following circumstances.

6a. Service Providers and Data Processors

We use carefully selected third-party processors that act on our instructions and are bound by data-processing agreements.

These may include:

Payment processors: FinComBank.com.
Logistics and insurance providers: specialist art carriers and insurers.
Cloud infrastructure providers: data centres located in Romania.
Email-delivery providers: transactional email delivered through SMTP services.
Analytics providers: Google Analytics, with IP anonymisation enabled.

6b. Professional Advisers

We may disclose data to lawyers, accountants, insurers, and auditors where necessary for the operation of our business and subject to appropriate confidentiality obligations.

6c. Governmental and Legal Disclosures

We may disclose personal data to competent authorities, including tax authorities, law-enforcement bodies, and courts, where required by law, a court order, or where necessary to protect the rights, property, or safety of Alvamy’s, our customers, or other persons.

6d. Business Transfers

If Alvamy’s, or a substantial part of its assets, is acquired by or merged with another entity, your personal data may be transferred as part of that transaction.

We will notify you before your personal data is transferred and becomes subject to a different privacy policy.

We may share your data with third parties in any other circumstances where you have provided explicit consent.

For example, this may apply where you ask us to share information about your collection with an independent valuer.

7. International Data Transfers

Alvamy’s operates in the Republic of Moldova and the European Union. Your personal data may be transferred between these jurisdictions in the ordinary course of our business.

For transfers of personal data from the EEA or the United Kingdom to countries not considered adequate by the European Commission or the UK Information Commissioner’s Office, we rely on appropriate safeguards, including:

European Union Standard Contractual Clauses.
United Kingdom International Data Transfer Agreements, where applicable.
Adequacy decisions, where available, including the EU–US Data Privacy Framework.

You may request a copy of the transfer safeguards we use by contacting privacy@alvamys.com.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. A cookie is a small text file placed on your device.

We use the following categories of cookies:

Cookie Type	Purpose and Duration
Strictly necessary	Session management, security, and CSRF protection. These cookies cannot be disabled. They remain active for the session or for up to one year.
Functional / Preferences	Remembering language, currency, and shopping-cart contents. Retained for up to 12 months.
Analytics	Google Analytics, used to measure page visits and user journeys, with IP anonymisation enabled. Retained for up to 24 months.
Marketing	Targeted advertising and remarketing, used only with your consent. Retained for up to 90 days.

You may manage your cookie preferences at any time through our cookie-consent banner or your browser settings.

Blocking strictly necessary cookies may affect the functionality of the website. Withdrawal of consent for analytics or marketing cookies will take effect when the page is next loaded.

We do not use device fingerprinting, tracking pixels, or cross-site tracking without your explicit consent.

9. How Long We Retain Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected or for as long as required by law.

Our principal retention periods are:

Data Category	Retention Period
Account and contact data	Three years after account closure or the last transaction
Purchase and transaction records	Seven years, for tax and accounting obligations
AML and KYC identity documents	Five years after the transaction, in accordance with regulatory requirements
Consignment records	Seven years after settlement
Marketing preferences	Until consent is withdrawn, plus 90 days
Anonymised website analytics	24 months
Customer-support correspondence	Three years after the case is closed
Evidence relating to legal claims	Duration of the claim, plus one year

After the applicable retention period has expired, the data will be securely deleted or anonymised so that it can no longer be attributed to you.

10. Your Privacy Rights

Depending on where you reside, you may have some or all of the following rights in relation to your personal data.

We will respond to verified requests within 30 days, or within 45 days where permitted and necessary due to the complexity of the request.

Right of access: You may request a copy of the personal data we hold about you.

Right to rectification: You may ask us to correct inaccurate or incomplete personal data.

Right to erasure, or the “right to be forgotten”: You may ask us to delete your personal data, subject to applicable legal obligations.

Right to restriction of processing: You may ask us to suspend the processing of your personal data in certain circumstances.

Right to data portability: You may receive your personal data in a structured, commonly used, and machine-readable format.

Right to object: You may object to processing based on legitimate interests or to processing for direct-marketing purposes.

Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Rights relating to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, unless you have consented or the processing is necessary for a contract.

Rights Under the CCPA and CPRA

Right to know: You may request disclosure of the categories and specific pieces of personal information collected, used, shared, or sold.

Right to deletion: You may request the deletion of personal information, subject to applicable exceptions.

Right to opt out of sale or sharing: We do not sell personal information. If this changes, you will be provided with a method to opt out.

Right to correction: You may request the correction of inaccurate personal information.

Right to limit the use of sensitive personal information: You may limit our use of sensitive personal information to necessary purposes.

Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.

How to Exercise Your Rights

You may submit a request by emailing privacy@alvamys.com or by writing to our Data Privacy Team at the postal address provided in this Policy.

We may need to verify your identity before processing your request.

There is no charge for exercising your rights unless a request is manifestly unfounded, excessive, or repetitive.

Right to Lodge a Complaint

If you are dissatisfied with our response, you have the right to lodge a complaint with the competent supervisory authority, including:

The UK Information Commissioner’s Office.
The Commission Nationale de l’Informatique et des Libertés in France.
The National Supervisory Authority for Personal Data Processing in Romania.
Your local data protection authority in the European Union.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

These measures include:

TLS encryption for all data in transit.
AES-256 encryption for sensitive data at rest.
Role-based access controls and staff permissions.
Regular penetration testing and vulnerability scanning.
PCI DSS compliance for payment-data processing.
Staff training on data protection and confidentiality.
An incident-response plan containing procedures for notifying relevant parties of a personal-data breach within 72 hours, where required by the GDPR.

Despite these measures, no internet transmission is completely secure.

If you have reason to believe that your interaction with us is no longer secure, please notify us immediately at security@alvamys.com.

12. Children’s Privacy

Our services are not intended for children under the age of 18.

We do not knowingly collect personal data from minors. If you believe that we have inadvertently collected information from a child, please contact privacy@alvamys.com, and we will promptly delete it.

13. Third-Party Links and Services

Our website may contain links to third-party websites, social media platforms, and embedded content, including gallery maps and auction feeds.

This Privacy Policy does not apply to those external services.

We encourage you to review the privacy policies of any third-party websites you visit. We are not responsible for the privacy practices of third parties.

14. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other operational reasons.

Where we make material changes, we will:

Publish the updated Policy on our website with a revised effective date.
Send an email notification to registered account holders.
Display a prominent notice on our website for 30 days following the change.

Your continued use of our services after the effective date constitutes acceptance of the updated Policy.

If you do not agree with the changes, you must stop using our services and may request the deletion of your account.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Privacy Team:

Data Privacy Team — Alvamy’s