Privacy Policy (GDPR-compliant)

Last Updated: 1 November 2025
Effective Date: Immediate upon publication
Issued by: Pro Capital Art Ltd. (“PCA”, “Company”, “We”, “Us”, “Our”)
Website: https://procapitalart.com

1. PURPOSE AND SCOPE

This Privacy Policy (“Policy”) governs the manner in which Pro Capital Art Ltd., a company operating an online art and antiques marketplace, collects, processes, stores, and protects personal information provided by individuals (“Users”, “Customers”, or “You”) when visiting or interacting with our website or services.

This Policy applies to all personal data collected through our website, mobile interfaces, email communications, online forms, social media accounts, or any other digital means controlled by the Company.

This Policy is intended to fulfill the Company’s obligations under:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”);

• UK Data Protection Act 2018;

• UK General Data Protection Regulation (UK-GDPR); and

• Applicable international data protection and e-commerce legislation.

By using our website or purchasing Products, you acknowledge that you have read and understood this Policy and agree to the processing of your personal data as described herein.

2. DATA CONTROLLER INFORMATION

The entity responsible for data processing (“Data Controller”) is:

Pro Capital Art Ltd.
Registered in the United Kingdom
Email: info@procapitalart.com
Website: https://procapitalart.com

For any data protection inquiries, complaints, or data-subject rights requests, you may contact our Data Protection Officer (DPO) at the email address above, marked “GDPR Inquiry”.

3. CATEGORIES OF PERSONAL DATA PROCESSED

We process personal information that falls within the following categories:

(a) Identification and Contact Data

Full name, postal and billing address, email address, telephone number, and country of residence.

(b) Transactional and Financial Data

Purchase records, order history, invoicing information, payment method (excluding full card details, which are handled by certified payment processors).

(c) Technical and Usage Data

IP address, browser type and version, operating system, time zone setting, device identifiers, log files, clickstream data, and cookies as defined in our Cookie Policy.

(d) Communication Data

Correspondence between You and PCA, customer service inquiries, or feedback submitted through our website or social media.

(e) Marketing and Preference Data

Newsletter subscription status, marketing communication preferences, and consents related to promotional materials.

We do not intentionally collect special categories of personal data (sensitive data) as defined under Article 9 GDPR.

4. LEGAL BASES FOR PROCESSING PERSONAL DATA

All processing of personal data by PCA is conducted on one or more of the following legal bases, pursuant to Article 6 of the GDPR:

Legal Basis	Description
Contractual Necessity	Processing required to fulfill an order or service contract (Art. 6(1)(b)).
Legal Obligation	Compliance with laws, tax rules, accounting, and AML regulations (Art. 6(1)(c)).
Legitimate Interest	Operation, development, and protection of PCA’s business and fraud prevention (Art. 6(1)(f)).
Consent	Marketing communications, cookies, and non-essential analytics (Art. 6(1)(a)).
Public Interest	Cooperation with competent authorities or legal enforcement (Art. 6(1)(e)).

We ensure that all data processing is proportionate, justified, and limited to legitimate purposes.

5. PURPOSES OF DATA PROCESSING

We process personal data for the following purposes:

1. To identify and register Customers, manage accounts, and verify identity.

2. To process orders, manage payments, arrange shipping, and deliver artworks or antiques.

3. To issue invoices, comply with tax and accounting obligations, and maintain transactional records.

4. To provide customer support, respond to inquiries, and handle complaints or returns.

5. To conduct analytics for improving website usability, performance, and marketing efficiency.

6. To manage communication preferences and send marketing or informational updates where consent has been granted.

7. To ensure the integrity, authenticity, and security of our platform, including fraud prevention and system monitoring.

8. To comply with applicable legal, regulatory, or enforcement obligations.

6. DATA RETENTION PERIODS

We retain personal data only for as long as necessary to fulfill the purposes described above. Standard retention periods include:

• Customer and order records: 7 years from transaction date (statutory accounting period).

• Marketing and newsletter data: until consent withdrawal.

• Contact forms and communication logs: 2 years from last interaction.

• Web analytics data (cookies, logs): as defined in the Cookie Policy.

Once retention periods expire, all data is securely deleted or anonymized.

7. DATA SHARING AND THIRD-PARTY DISCLOSURE

Your personal data may be shared only with the following categories of recipients, under strict confidentiality agreements:

• Payment processors (e.g., Stripe, PayPal) for transaction authorization;

• Shipping and logistics partners for order delivery;

• IT and hosting providers ensuring Website operation and maintenance;

• Auditors, accountants, and legal advisors under confidentiality;

• Government authorities or regulators, where required by law (e.g., AML, tax compliance).

PCA does not sell, rent, or lease personal information to third parties for profit.

8. INTERNATIONAL DATA TRANSFERS

If personal data is transferred to recipients outside the United Kingdom or European Economic Area (EEA), PCA ensures adequate data protection standards through:

• Adequacy decisions issued by the European Commission or the UK ICO;

• Standard Contractual Clauses (SCCs) approved under Article 46 GDPR;

• Additional contractual and technical safeguards (encryption, limited access).

By using our Website, You acknowledge that such transfers may occur to jurisdictions offering equivalent data protection measures.

9. DATA SECURITY MEASURES

PCA employs advanced technical and organizational measures to maintain the confidentiality, integrity, and availability of Your personal data, including:

• Encrypted (SSL/TLS) data transmission;

• Encrypted storage and restricted access controls;

• Two-factor authentication for administrative accounts;

• Continuous monitoring for suspicious activity;

• Secure data disposal and anonymization practices.

While we strive to maintain the highest standards of protection, no system can guarantee absolute security. You acknowledge the inherent risks of online data transmission.

10. DATA SUBJECT RIGHTS

Under the GDPR and UK-GDPR, You have the following rights:

1. Right of Access – to receive confirmation of whether PCA processes Your data and to obtain a copy.

2. Right to Rectification – to correct inaccurate or incomplete information.

3. Right to Erasure (“Right to be Forgotten”) – to request deletion of personal data under lawful conditions.

4. Right to Restrict Processing – to limit data use under specific circumstances.

5. Right to Data Portability – to receive data in structured, machine-readable form.

6. Right to Object – to oppose processing based on legitimate interest or direct marketing.

7. Right to Withdraw Consent – at any time, without affecting prior lawful processing.

8. Right to Lodge a Complaint – with the Information Commissioner’s Office (ICO) or any relevant supervisory authority.

All requests must be submitted in writing to info@procapitalart.com. PCA will respond within 30 calendar days as required by law.

11. MARKETING COMMUNICATIONS

With Your explicit consent, PCA may send marketing communications, newsletters, and promotional offers.
You may opt out at any time by clicking the “unsubscribe” link or emailing info@procapitalart.com.

Opting out does not affect legally required transactional or service communications (e.g., order confirmations).

12. AUTOMATED DECISION-MAKING AND PROFILING

PCA does not employ automated decision-making or profiling systems that produce legal or significant effects on Users, as defined in Article 22 GDPR.

13. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to analyze traffic, improve website performance, and personalize content.
For detailed information regarding types, duration, and purposes of cookies, please refer to our Cookie Policy available at https://procapitalart.com/cookie-policy.

14. CHILDREN’S DATA PROTECTION

Our Website and services are intended for persons aged 18 years and older.
We do not knowingly collect or process data from minors. If such data is inadvertently collected, it will be promptly deleted upon notification.

15. AMENDMENTS TO THIS POLICY

PCA reserves the right to modify or update this Policy at any time to reflect legal, technical, or business developments.
Any changes will take effect immediately upon publication, with the “Last Updated” date revised accordingly.
Where material amendments occur, Users will be notified through Website banners or direct email communication.

Continued use of the Website constitutes acceptance of the updated Policy.

16. LIABILITY AND LEGAL DISCLAIMER

Nothing in this Policy limits PCA’s obligations under applicable data protection laws.
However, PCA shall not be held liable for:

• Unauthorized access resulting from factors beyond its reasonable control;

• Security incidents arising from third-party software, browsers, or network vulnerabilities;

• Any indirect or consequential damages related to data misuse by external parties.

Our liability, if established, shall be limited to the extent permitted by law.

17. CONTACT INFORMATION AND COMPLAINT PROCEDURES

For all inquiries regarding this Privacy Policy or data protection matters, please contact:

Pro Capital Art Ltd.
Email: info@procapitalart.com
Website: https://procapitalart.com