Privacy Policy

1. Scope of This Policy

This Privacy Policy applies to personal information collected through:

• castalialux.com;
• the CastaliaLux Cabinet;
• Assemblage and Acquisition functions;
• checkout;
• private requests;
• contact forms;
• email;
• WhatsApp and other direct communications;
• authenticity and object-documentation services.

It does not govern independent websites or services operated by third parties.

2. Data Controller

The data controller responsible for the processing of personal information through castalialux.com is:

CastaliaLux LLC, FZ
Meydan Hotel, Ground Floor
Nad Al Sheba
Dubai
United Arab Emirates

Headquartered in Dubai, CastaliaLux maintains an international presence in Hong Kong, London and the United States, serving collectors worldwide.

Privacy enquiries may be submitted through the Contact page available on the CastaliaLux website.

3. The Information We Collect

Depending on how you interact with CastaliaLux, we may collect:

Identity and contact information

• full name;
• email address;
• telephone number;
• country;
• delivery and billing addresses.

Account information

• account identifier;
• authentication status;
• saved objects;
• Cabinet preferences;
• account activity relevant to security and operation.

Acquisition information

• objects acquired or requested;
• order reference;
• transaction amount and currency;
• fulfilment and delivery status;
• returns or service communications;
• certificates and documentation associated with an object.

Payment-related information

Payments are processed through independent payment providers. We may receive transaction identifiers, payment status, billing details, fraud-screening results and limited payment-method information.

We do not ordinarily receive or store complete payment-card numbers or card security codes.

Communications

We may retain messages, enquiries, private requests, appointment requests, authenticity questions and other correspondence sent to us.

Technical and usage information

We may collect:

• pages viewed, including the page address, title and time of view;
• device category, operating system and browser type;
• approximate location derived from the IP address (city, region or country level), where IP data supports it;
• coarse network attributes such as network type and whether the address appears to use a VPN, proxy, hosting provider or mobile carrier, where such data is available;
• a salted, one-way hash of the IP address — the raw IP address itself is not stored;
• referring page;
• security and diagnostic information;
• cookie and consent preferences.

4. How We Collect Information

We collect personal information:

• directly from you;
• automatically when you use the website;
• from authentication and payment providers;
• from delivery and fulfilment partners;
• from fraud-prevention and security services;
• from public sources where reasonably necessary for object research, compliance or the protection of legitimate interests.

5. Why We Use Personal Information

We use personal information to:

• provide and operate the website;
• create and administer client accounts;
• maintain the Cabinet and Assemblage;
• process and fulfil acquisitions;
• arrange payment, delivery and returns;
• communicate with clients;
• respond to private requests and enquiries;
• provide authenticity certificates and associated records;
• prevent fraud and unauthorised activity;
• protect the website, clients and business;
• meet accounting, tax, customs and legal obligations;
• improve website performance and client experience;
• establish, exercise or defend legal claims;
• send marketing communications where permitted.

6. Legal Bases for Processing

Where applicable data-protection law requires a legal basis, we may process personal information on one or more of the following grounds:

Contract

Processing is necessary to take requested steps before an acquisition or to perform an agreement with you.

Legitimate interests

Processing is necessary for legitimate business interests, including operating the gallery, securing transactions, preventing fraud, answering enquiries, protecting legal rights and improving services, provided those interests are not overridden by your rights.

Legal obligation

Processing is necessary to comply with tax, accounting, customs, sanctions, regulatory or other legal requirements.

Consent

Where required, we rely on consent for particular cookies, marketing communications or other optional processing. Consent may be withdrawn at any time without affecting processing already undertaken lawfully.

7. Payments

Payment information is handled primarily by the payment provider shown during checkout.

The payment provider may independently collect and process:

• card or account details;
• billing information;
• identity-verification data;
• device information;
• fraud-prevention information.

Its handling of information is governed by its own privacy terms.

CastaliaLux receives only the information reasonably necessary to confirm, administer and protect the transaction.

8. Authentication and Account Access

Authentication may be provided through secure sign-in links or external authentication providers.

The provider may supply basic account information such as your email address, name and authentication identifier.

You are responsible for maintaining the security of the email account and device used to access CastaliaLux.

9. Delivery and Fulfilment

To fulfil an acquisition, we may share relevant information with:

• delivery carriers;
• fulfilment partners;
• customs brokers;
• insurers;
• regional service providers;
• customs and governmental authorities where required.

The information shared may include the recipient’s name, address, telephone number, email address, order value and customs description.

10. Authenticity Certificates and Object Records

Where an object includes a CastaliaLux Certificate of Authenticity, we may retain a secure record linking:

• the object;
• its identifying characteristics;
• the certificate number or digital identifier;
• the date of issue;
• the relevant acquisition or holder record where appropriate.

This record is used to preserve the integrity of the certificate, prevent fraudulent duplication and support future verification requests.

Certificate records may be retained for an extended period because their purpose may continue beyond the original acquisition.

Public certificate verification, where available, should not display unnecessary private client information.

11. Marketing Communications

We may send editorial updates, collection announcements or private-offer communications where:

• you have requested them;
• you have consented where consent is required;
• another lawful basis permits the communication.

Every electronic marketing message should provide a practical means of unsubscribing.

Service messages concerning an account, acquisition, security matter or requested communication are not marketing messages.

12. Cookies and Similar Technologies

We use cookies and similar technologies to:

• operate essential website functions;
• maintain secure sessions;
• remember relevant preferences;
• understand website performance;
• detect abuse and technical problems;
• measure engagement where permitted.

Non-essential cookies should not be activated before valid consent where applicable law requires such consent.

More information is available in the Cookie Policy.

13. Analytics and IP Information

We measure how the public website is used and enrich that measurement with coarse network information. This section describes exactly what our current implementation does.

Google Analytics 4

When analytics are active, we use Google Analytics 4 (“GA4”) to understand visits to castalialux.com. Page views are recorded by Google’s standard automatic tracking: one when a page first loads and, as the website’s address changes while you browse — including navigation within the website and movements Back and Forward — further page views containing the page address (including any search, filter or sorting choices shown in the address), page title and time of the view. Changing filters or sorting can therefore be recorded as an additional page view. Visitors who are signed in, including administrators, are measured in the same way on public pages. GA4 also records your device category, operating system and browser.

Where available, page views may include a small set of coarse network attributes — network type (for example ISP, business, hosting or mobile) and yes/no indicators for VPN, proxy, hosting and mobile-carrier use. These are recorded as custom dimensions in GA4 named “net_type”, “net_is_vpn”, “net_is_proxy”, “net_is_hosting” and “net_is_mobile”.

Precise coordinates, venue names, organisation names and raw IP addresses are never sent to GA4. GA4 is not loaded on preview environments or when a visit begins on an administrative screen, and measurement is switched off while administrative screens are open, so their addresses are not sent to Google.

Which interactions Google records automatically — such as page changes, scrolls and outbound clicks — is governed by GA4’s Enhanced Measurement settings in our Google Analytics account rather than by this website’s code.

IP enrichment (IPinfo)

Separately from GA4, and only on our servers, we may pass your IP address to IPinfo, an IP intelligence service, to obtain coarse information about the network you are using — for example the network type, and where our IPinfo subscription supports it, whether the address is associated with a VPN, proxy, hosting provider or mobile carrier, an approximate city- or region-level location, and possible venue matches.

We do not store the raw IP address. The address is used only for the lookup and is replaced by a one-way hash created with a secret salt, so the stored record cannot be reversed to recover your IP.

For each day of activity, one record is stored containing: the salted IP hash; the visit date and timestamps; a session count; approximate city, region and country where IPinfo provides them; the network or organisation name where provided; the coarse network flags; any venue name and type matched by IPinfo, where available; and the first page opened that day.

Approximate location, network attributes and venue matches are available only where IPinfo’s data supports them and may be absent for any visit.

Records are deleted automatically 90 days after the visit day. Access to stored records is restricted to authorised administrators, and the administration screen distinguishes clearly between an approximate location derived from IP and a venue matched by IPinfo.

The raw IP address, precise coordinates and full IPinfo responses are never sent to your browser, to GA4 or to any other recipient.

Consent

In the European Union, the European Economic Area, the United Kingdom and Switzerland — and wherever the visitor’s country cannot be determined — analytics storage is denied by default and a notice offers Accept or Decline before analytics operate. Your choice is stored in a first-party cookie for one year. Advertising-related purposes are always denied. Outside these regions, analytics operate by default without a prompt. You may change your choice at any time by deleting the consent cookie, after which the notice appears again.

The server-side IP enrichment described above sets no cookies or advertising identifiers on your device and operates independently of the analytics consent choice.

14. How We Share Information

We may share personal information with carefully selected service providers that assist with:

• website hosting and infrastructure;
• database and account services;
• authentication;
• payment processing;
• fraud prevention;
• delivery and fulfilment;
• communications;
• analytics;
• professional advice;
• legal and regulatory compliance.

Our analytics providers include Google (Google Analytics 4) and IPinfo, each described in Section 13.

Service providers should receive only the information reasonably required for their role and may not use it for unrelated purposes where they act on our behalf.

We may also disclose information:

• where required by law or lawful authority;
• to prevent fraud or protect safety and legal rights;
• in connection with a merger, restructuring, investment, sale or transfer of all or part of the business;
• with your direction or consent.

CastaliaLux does not sell personal information in the ordinary meaning of selling client data for monetary consideration.

15. International Transfers

CastaliaLux operates internationally, and service providers or fulfilment partners may process information in countries other than the country in which you are located.

Where required, we use appropriate legal and organisational measures for international transfers, which may include contractual safeguards, adequacy mechanisms or another permitted transfer basis.

No internet-based system or international transfer can be guaranteed to be entirely risk-free.

16. Data Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to:

• maintain an active account;
• complete and document acquisitions;
• provide certificates and verification;
• meet legal, tax and accounting obligations;
• resolve disputes;
• prevent fraud;
• enforce agreements.

Retention periods differ according to the type of information. Visitor analytics records described in Section 13 are deleted automatically 90 days after the visit day.

Transaction, accounting, customs, fraud-prevention and certificate records may be retained longer than general enquiries or optional marketing information.

When information is no longer required, it may be deleted, anonymised or securely archived as appropriate.

17. Data Security

We use reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• unlawful use;
• alteration;
• disclosure;
• destruction.

These measures may include access controls, secure authentication, encrypted transmission, restricted database permissions, logging, monitoring and service-provider review.

No system can guarantee absolute security. You should contact us promptly if you believe your account or personal information has been compromised.

18. Your Rights

Depending on your location and applicable law, you may have the right to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of information;
• object to certain processing;
• request restriction of processing;
• withdraw consent;
• request a portable copy of eligible information;
• complain to an appropriate data-protection authority.

Some rights are subject to legal limitations. For example, we may need to retain certain transaction, certificate, fraud-prevention or legal records even after an account-deletion request.

To make a privacy request, contact CastaliaLux through the Contact page and clearly identify the nature of the request.

We may request reasonable information to verify identity before acting on a request.

19. Account Deletion

A request to close or delete an account does not necessarily require deletion of every related record.

We may retain information where reasonably necessary to:

• comply with law;
• preserve transaction history;
• protect certificate integrity;
• prevent fraud;
• resolve disputes;
• establish or defend legal claims.

Information no longer required may be deleted or de-identified.

20. Children’s Privacy

CastaliaLux is not directed to children, and the website is intended for adults capable of entering into binding transactions.

We do not knowingly seek to collect personal information from children.

If you believe that a child has provided personal information without appropriate authorisation, please contact us so that the matter can be reviewed.

21. Third-Party Websites

The website may contain links to external platforms, social networks, payment services or other third-party websites.

Their privacy practices are governed by their own policies. CastaliaLux is not responsible for the independent privacy or security practices of third parties.

22. Automated Security Decisions

Fraud-prevention or payment systems may use automated signals to identify unusual or potentially unauthorised activity.

A transaction may be delayed, declined or referred for additional verification on the basis of these signals.

Where applicable law provides a right to challenge a qualifying automated decision, you may contact us to request further review.

23. Changes to This Policy

We may update this Privacy Policy to reflect changes in the website, services, technology, legal requirements or business operations.

The latest version will be published on this page with a revised “Last updated” date.

24. Contact

For privacy questions or requests concerning personal information, please contact CastaliaLux through the Contact page.