PRIVACY POLICY

1. Introduction

Art Vault Asia Pte Ltd (UEN: 202615928N) (“Art Vault Asia”, “we”, “us”, or “our”) operates the website www.artvaultasia.com (the “Website”) and provides art advisory, acquisition, investment, and related services (collectively, the “Services”). We are incorporated in Singapore and are committed to protecting the privacy and personal data of every individual who interacts with us.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the Personal Data Protection Act 2012 (Singapore) (“PDPA”) and any applicable subsidiary legislation or advisory guidelines issued by the Personal Data Protection Commission (“PDPC”). It applies to all visitors, clients, prospective clients, and business contacts who use or enquire about our Website or Services.

By accessing our Website or engaging with our Services, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our Website and Services.

2. Definitions

In this Privacy Policy, the following terms have the meanings set out below:

• “Personal Data” means data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which we have or are likely to have access.
• “Sensitive Personal Data” means personal data relating to an individual’s financial information, identification documents, and other data categories that warrant heightened protection.
• “Processing” means any operation performed on personal data, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• “Data Protection Officer” or “DPO” means the individual designated by Art Vault Asia to oversee compliance with the PDPA.
• “Third Party” means any person or entity other than Art Vault Asia and the individual to whom the personal data relates.

3. Personal Data We Collect

We collect the following categories of personal data, depending on your interaction with us:

3.1 Identity and Contact Data

• Full legal name, preferred name, or alias
• Email address, telephone number, and postal address
• Nationality, country of residence, and date of birth
• Copies of identification documents (e.g., passport, NRIC) where required for client onboarding or regulatory compliance

3.2 Financial and Investment Data

• Net worth, investment objectives, risk appetite, and financial background
• Bank account and payment information for transaction processing
• Records of art acquisitions, valuations, and portfolio holdings
• Tax residency status and, where applicable, tax identification numbers

3.3 Transactional Data

• Details of artworks purchased, sold, or enquired about through us
• Invoices, receipts, and correspondence relating to transactions
• Shipping instructions and logistics information

3.4 Website and Technical Data

• IP address, browser type, and device identifiers
• Pages visited, time spent on pages, referring URLs, and clickstream data
• Cookie identifiers and session data (see Section 11 for our Cookie Policy)

3.5 Communication Data

• Email correspondence, meeting notes, and records of telephone calls
• Enquiries submitted via our Website contact forms or direct email
• Marketing preferences and opt-in/opt-out records

3.6 Data Collected from Third Parties

We may receive personal data about you from art advisors, galleries, auction houses, introducers, and other third parties who refer you to us, or from publicly available sources such as published artist records and regulatory registers. We will handle such data in accordance with this Privacy Policy.

4. How We Collect Personal Data

We collect personal data through the following means:

• Directly from you when you complete forms, register an account, or communicate with us by any means
• Automatically when you visit our Website, through cookies and similar tracking technologies
• From our business partners, art advisors, introducers, or referral sources
• From publicly available sources, including published artist records, auction results, and professional directories
• Through in-person interactions at exhibitions, events, or private viewings

5. Purposes of Collection, Use, and Disclosure

We collect, use, and disclose your personal data only for purposes that a reasonable person would consider appropriate in the circumstances and, where required, with your consent. These purposes include:

5.1 Service Delivery

• Providing art advisory, acquisition, investment placement, and storage services
• Managing client onboarding, account administration, and relationship management
• Processing payments, issuing invoices, and maintaining financial records
• Arranging logistics, insurance, and provenance documentation for artworks

5.2 Legal and Regulatory Compliance

• Conducting Know Your Client (“KYC”) and anti-money laundering (“AML”) checks as required by applicable law
• Complying with the requirements of the Singapore Financial Intelligence Unit (“STRO”), the Monetary Authority of Singapore (“MAS”), and other regulatory bodies
• Retaining records as required by the Accounting and Corporate Regulatory Authority (“ACRA”), the Inland Revenue Authority of Singapore (“IRAS”), and other authorities
• Responding to lawful requests by courts, government agencies, or law enforcement

5.3 Business Operations

• Improving, personalising, and developing our Website and Services
• Conducting internal analytics, research, and market analysis
• Managing disputes, enforcing our agreements, and exercising or defending legal claims
• Communicating changes to our policies, terms, or Services

5.4 Marketing and Communications

• Sending information about artworks, exhibitions, market insights, and events that may be of interest to you, where you have consented or where permitted under the PDPA
• Administering referral programmes, collector events, and promotional activities

You may withdraw consent to receive marketing communications at any time by contacting us at the details in Section 14. Withdrawal of marketing consent will not affect the lawfulness of processing carried out prior to withdrawal.

6. Legal Bases for Processing

Under the PDPA, we are required to have a valid basis for processing your personal data. Depending on the circumstance, we rely on one or more of the following:

• Consent — where you have given us clear, informed, and voluntary consent to process your personal data for specified purposes
• Contract — where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering such a contract
• Legal Obligation — where processing is necessary for compliance with a legal or regulatory obligation to which we are subject
• Legitimate Interests — where processing is necessary for the purposes of our legitimate business interests, provided such interests are not overridden by your interests or fundamental rights and freedoms
• Vital Interests — in exceptional circumstances, where processing is necessary to protect an individual’s vital interests

7. Disclosure of Personal Data to Third Parties

We do not sell, rent, or trade your personal data. We may disclose your personal data to the following categories of recipients, only to the extent necessary for the purposes described in Section 5:

• Service providers and vendors engaged to support our operations (e.g., IT systems, payment processors, logistics and shipping companies, art storage facilities, insurance providers)
• Art galleries, auction houses, artists’ studios, or their agents, where necessary to facilitate a transaction or service
• Professional advisors, including lawyers, accountants, and auditors, acting under obligations of confidentiality
• Regulators, law enforcement agencies, and government bodies, where required by law or court order
• Our related corporations and affiliates for internal administrative purposes, subject to equivalent data protection standards
• Prospective acquirers or investors in the context of a business sale, merger, or reorganisation, subject to appropriate confidentiality obligations

Where we disclose personal data to third-party service providers, we require them to handle such data in accordance with the PDPA and to implement appropriate security measures.

8. Transfers of Personal Data Outside Singapore

Art Vault Asia operates within the international art market. We may transfer your personal data to recipients located outside Singapore — including in Hong Kong, the United Kingdom, the European Union, the United States, and other jurisdictions — where it is necessary to provide our Services or comply with legal obligations.

Before transferring personal data overseas, we will ensure that the recipient country or territory provides a standard of protection for personal data that is at least comparable to the protection afforded under the PDPA, or that we have obtained your consent, or that other conditions under the PDPA permitting such transfer are satisfied. Where appropriate, we will enter into binding data transfer agreements or adopt other contractual safeguards.

9. Security of Personal Data

We implement reasonable and appropriate administrative, physical, and technical security measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include, without limitation:

• Encryption of personal data in transit and, where appropriate, at rest
• Access controls and role-based permissions restricting access to personal data on a need-to-know basis
• Regular security assessments and staff training on data protection obligations
• Password-protected and firewall-secured systems
• Physical security controls for premises where personal data is stored

Notwithstanding the above, no system of data transmission or storage can be guaranteed to be 100% secure. If you believe your personal data held by us has been compromised, please notify us immediately at the contact details in Section 14.

In the event of a data breach that is likely to result in significant harm to affected individuals, we will notify the PDPC and affected individuals in accordance with the mandatory data breach notification obligations under the PDPA.

10. Retention of Personal Data

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law, regulation, or contractual obligation. The retention periods applicable to different categories of personal data are determined by reference to our legal obligations, the nature of our relationship with you, and applicable limitation periods for legal claims.

As a general guide, client records relating to completed transactions are retained for a minimum of five (5) years following the conclusion of the relevant transaction, in compliance with the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act (Cap. 65A) and the MAS Guidelines on Prevention of Money Laundering and Countering the Financing of Terrorism. Financial accounting records are retained for a minimum of five (5) years in accordance with IRAS requirements.

Upon expiry of the applicable retention period, personal data will be securely destroyed or anonymised in accordance with our data disposal procedures.

11. Cookies and Tracking Technologies

Our Website uses cookies and similar technologies (such as web beacons, pixel tags, and local storage) to enhance your browsing experience, analyse Website usage, and support our marketing activities. Cookies are small text files placed on your device by a web server.

11.1 Types of Cookies We Use

• Strictly Necessary Cookies — essential for the Website to function and cannot be switched off. These do not require your consent.
• Performance and Analytics Cookies — allow us to count visits and measure how users interact with our Website (e.g., Google Analytics). We only deploy these with your consent.
• Functionality Cookies — enable enhanced personalisation and remember your preferences. We only deploy these with your consent.
• Targeting and Advertising Cookies — used to deliver advertisements relevant to your interests. We only deploy these with your consent.

11.2 Managing Cookies

You may control and manage cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling certain cookies may affect the functionality of our Website. You may also opt out of analytics tracking by visiting the Google Analytics opt-out page.

12. Your Rights Under the PDPA

Subject to applicable exceptions under the PDPA, you have the following rights in relation to your personal data:

12.1 Right of Access

You may request confirmation as to whether we hold personal data about you, and to access a copy of such data together with information about how it is used. We will respond within thirty (30) days of receiving a valid request, or notify you of any extension in accordance with the PDPA.

12.2 Right of Correction

You may request that we correct any inaccuracy or error in your personal data. Upon verifying the correction, we will update your personal data as soon as practicable and, where appropriate, transmit the corrected data to third parties to whom it was disclosed.

12.3 Right to Withdraw Consent

Where we process your personal data based on your consent, you may withdraw that consent at any time by notifying us in writing. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal. Please note that withdrawal of consent may affect our ability to continue providing you with certain Services.

12.4 Right to Data Portability

Where applicable under the PDPA, you may request that we transmit personal data you have provided to us in a commonly used, machine-readable format to another organisation.

12.5 Exercising Your Rights

To exercise any of your rights, please submit a written request to our Data Protection Officer using the contact details set out in Section 14. We may require you to verify your identity before processing your request. We will not charge a fee for processing access requests unless such request is clearly excessive or repetitive.

13. Privacy of Minors

Our Website and Services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe that a minor has provided personal data to us without appropriate parental or guardian consent, please contact us immediately at the details in Section 14 and we will take steps to delete such data.

14. Contact and Data Protection Officer

If you have questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please contact our Data Protection Officer:

Data Protection Officer

Art Vault Asia Pte Ltd

UEN: 202615928N

57 Tras Street, Singapore 078996

Website: www.artvaultasia.com (https://www.artvaultasia.com)

Email: advisory@artvaultasia.com

We will endeavour to respond to all enquiries within ten (10) business days of receipt. Where a matter cannot be resolved to your satisfaction, you have the right to lodge a complaint with the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.

15. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy at any time to reflect changes in applicable law, our business practices, or our Services. When we make material changes, we will update the Effective Date at the top of this document and, where appropriate, notify you by email or by posting a prominent notice on our Website. Your continued use of our Website or Services following such notice constitutes your acknowledgement of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

16. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Singapore. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Singapore.