Privacy and Data Protection (UAE)

The Platform entity established in the UAE acts as the primary controller of personal data collected through the Platform for users located in the UAE. Contact details for privacy enquiries, including email address and postal address, will be provided in the detailed Privacy Notice accessible from the Platform footer.

• Account and profile data such as name, contact details, password, and account preferences.
• Transaction and payment data such as billing information, delivery addresses, order history, and payment confirmation (note that payment card details are typically processed directly by third-party payment processors and are not stored in full by the Platform).
• Usage data such as log files, device identifiers, IP address, browser type, and interactions with the Platform.
• Artist-specific data such as biography, education, exhibitions, portfolio details, ID documentation where required for verification, and payout information.

• To provide and operate the Platform, including processing orders, arranging delivery, and facilitating payments.
• To communicate with users about their accounts, orders, support requests, and marketing (where permitted by law).
• To improve and personalise the user experience, including through analytics, recommendations, and content curation.
• To comply with legal obligations in the UAE, including anti-money laundering, sanctions, tax, and consumer protection requirements.

Processing is based on one or more legal bases permitted under UAE data protection frameworks, which may include user consent, the necessity of processing for performance of a contract, compliance with legal obligations, and the Platform's legitimate interests in operating and protecting its services.

Personal data may be transferred to and processed in other countries where the Platform's service providers or group companies are located. Where such transfers occur, appropriate safeguards will be implemented in line with applicable UAE data protection requirements.

Subject to applicable law, users may have rights to access, correct, or delete their personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

Requests to exercise these rights can be submitted via the contact channels indicated in the Privacy Notice.

The Platform implements technical and organisational measures designed to protect personal data against unauthorised access, loss, or misuse.

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory, or risk management obligations.