Effective date: 1st November 2026
This Privacy Policy explains how CoinArtz Limited, a company registered in Hong Kong and trading as CoinArtz ("CoinArtz", "we", "us"), collects, uses, holds and discloses personal data. It covers https://coinartz.com, related art services, and communications with us through email, Instagram, other social media platforms and WhatsApp (the "Services"). It applies to visitors, account holders, collectors, buyers, artists, sellers, representatives, newsletter subscribers and people whose information appears in artist profiles or artwork records.
CoinArtz operates an art discovery and transaction platform. We may facilitate a sale as an intermediary or disclosed seller's agent, or sell an artwork ourselves. Accounts are required for purchases and artwork inquiries; general contact messages and newsletter subscriptions can be submitted without an account. This policy describes our handling of personal data. Our Terms and Conditions govern use of the Services and transactions: https://coinartz.com/en/terms. Reading this policy or using the Services does not, by itself, give consent to processing that requires your consent.
The organisation responsible for the processing described here is CoinArtz Limited, of Rm A1, 20/F, Goodwill Ind Bldg 36-44 Pak Tin Par St Tsuen Wan Hong Kong. We act as a data user under Hong Kong's Personal Data (Privacy) Ordinance and, where applicable, as a controller under the EU and UK GDPR.
Contact our Privacy Officer at privacy@coinartz.com for privacy questions, rights requests and complaints. Contact support@coinartz.com for account closure, artist-profile removal, orders and other service matters. A request received through either mailbox will be directed to the appropriate team.
This policy covers processing for which CoinArtz is responsible. Independent sellers, payment and wallet providers, authentication services, social platforms and linked websites may determine their own purposes and means of processing. Their own notices govern that independent processing; contact them about their practices. CoinArtz does not control those practices, but remains responsible for its own processing and disclosures.
Accounts and authentication. We process your email address, account identifier, password-based authentication information, sign-in and session information, and account details you provide. If you sign in through Google, we receive the account information authorised through that service, such as an identifier, email address, name or profile image. We do not receive your Google password.
Inquiries and communications. We receive your email address, message, relevant artwork references and any contact details, attachments or other information you choose to supply. This includes general contact messages, artwork inquiries, support requests, complaints and communications through email, Instagram or WhatsApp. We also process relevant message-delivery information where supplied by our communications providers. Please avoid sending unrelated sensitive information.
Artist applications and profiles. Applications request an artist name, email address, country or region, Instagram handle and portfolio website; legal name and gender are optional. We may also receive biographies, photographs, business or gallery affiliations, locations, artwork images and descriptions, and documents supporting ownership or authority.
Orders and fulfilment. We process buyer and seller identities, contact and billing details, delivery addresses, artwork and order details, quotations, amounts paid, invoices, payment status, delivery instructions, relevant customs information, seller bank or payout details where supplied, and refund, damage, non-delivery and dispute records. These records may arise before a sale becomes binding or where a purchase does not complete.
Stripe payments. Payments through CoinArtz's Stripe account use Stripe Checkout. Stripe processes the payment details entered there. CoinArtz can receive customer and transaction information, including name, email, billing or shipping details where collected, amounts, currency, payment status, transaction identifiers and limited payment-method details such as card brand and last four digits.
USDT and wallet connections. We accept USDT on the Ethereum and Solana networks into wallets controlled by CoinArtz. Users may connect through MetaMask or WalletConnect. We process the wallet addresses and network information shared through the connection, transaction hashes, amounts, timestamps, confirmation status, payment quotations and relevant refund information. We may associate these records with your account and order. Connecting a wallet does not by itself authorise a transfer. CoinArtz does not need your private keys, recovery phrases or wallet password; do not send them to us.
Preferences and subscriptions. We process newsletter choices and preferences saved through available features, such as favourites, follows or saved searches. Section 6 explains recommendations and related choices.
Technical and usage information. We process technical information for website operation, authentication, security and troubleshooting, such as IP addresses, device and browser details, requested pages, access times, referring pages, session identifiers, and error or security logs. Google Analytics processes website-usage information as described in section 6.
Verification and enforcement information. Payment providers may supply fraud-risk or payment-authentication results. We may request proportionate evidence of identity, representative authority, artwork ownership or payment source when needed for a transaction, refund, dispute, security concern or privacy request. We explain the purpose and information needed when requesting it. We also process evidence of misuse, payment reversals and claims.
We identify information needed for a particular form or service when collecting it. If you do not provide information needed to create an account, assess an application, process an order, arrange delivery or verify a request, we may be unable to provide that function. Optional information and newsletter choices are separate from information required for the service.
We obtain information from you and your authorised representatives; your use of the Services; artists, sellers and transaction counterparties; and authentication, payment, wallet, communications and fulfilment providers. We may consult relevant public business, ownership and blockchain records to administer or investigate transactions.
Artist and artwork information may come from artists, galleries, sellers and publicly accessible professional websites, gallery pages or public social-media profiles. It may include names, photographs, biographies, professional locations and artwork details. Provenance documents and correspondence may identify previous owners or representatives. Where permitted by applicable law and relevant content rights, we may compile, edit and publish professional information for art discovery, artwork listings and editorial coverage, and use it for related promotion within the applicable permissions.
We use third-party information on an applicable lawful basis, including our legitimate interests where available and appropriately balanced, or consent where required. We may publish relevant professional information without awaiting a reply from the artist where an applicable lawful basis, required content rights and notice requirements permit this. We provide any required indirect-collection notice within the applicable period unless a lawful exception applies. Privacy grounds for processing do not confer copyright or image-use rights; publication and promotion remain subject to the relevant permissions and restrictions.
If you supply information about another person, you must have authority to disclose it for the relevant purpose, provide any required notices and obtain any required permissions. Keep information accurate and up to date and do not send unnecessary private or sensitive information. A profile, listing or editorial mention does not, by itself, mean that an artist is represented by, affiliated with or endorses CoinArtz. Artwork descriptions and editorial statements are subject to the relevant provisions of our Terms and Conditions.
For questions about a source or requests to correct, object to or remove artist information, contact support@coinartz.com or privacy@coinartz.com. We may verify identity and authority and consider the basis for the request, applicable rights, contributor arrangements and the purpose of the record. We may correct, restrict or remove material as appropriate and honour removal obligations under applicable law, binding agreements and any removal commitment already made to you. Removal from active pages does not automatically require deletion of necessary transaction, provenance, fraud-prevention or claims records, or recall of previously distributed material. We cannot directly remove copies independently held by others, but take any steps required by law to notify other recipients or controllers of a valid correction or erasure request. Where a removal request is accepted or required, we cease new promotional use of the removed material within its scope.
We use personal data for the purposes below and directly related purposes permitted by law. We may combine relevant information from the sources described in this policy for those purposes. Materially different uses require further notice and, where required, consent.
Where the EU or UK GDPR applies, the bases below apply according to the processing involved. We rely on contract only for processing necessary to perform a contract with you or take steps you request before entering one. Where we rely on legitimate interests, we consider the necessity of the processing and balance those interests against your rights and reasonable expectations.
Accounts and transactions. We use account, preference, order, payment and delivery information to provide requested features, respond to artwork inquiries, administer purchases and seller payouts, reconcile payments, arrange delivery and handle refunds. The basis is contract performance or requested pre-contractual steps. For company representatives and other non-contracting contacts, we rely on legitimate interests in administering professional relationships.
Artist participation. We use application and professional information to assess applications, manage artist and seller relationships, and publish agreed profiles and listings. The basis is contract performance or requested pre-contractual steps where you are a party, and legitimate interests in managing professional relationships where you are not. Optional information is used only for its disclosed purpose and basis.
Public profiles and editorial information. Where lawful, our legitimate interests include helping collectors discover artists, providing relevant professional and artwork information, and maintaining useful art-market and provenance records. This basis applies only where the use is necessary, proportionate and compatible with applicable requirements. We obtain consent where required; content permissions are addressed separately in section 3.
Support and protection of our business. We use relevant communications, transaction and verification records to answer inquiries, investigate complaints, establish transaction history, collect amounts lawfully due, address chargebacks and payment reversals, enforce our agreements, and establish, exercise or defend legal claims. We rely on contract for necessary service administration and otherwise on legitimate interests in resolving disputes, preventing loss and protecting CoinArtz's lawful rights and those of others.
Security and fraud prevention. We use relevant account, technical, payment and incident information to protect accounts, funds and systems; investigate suspected fraud or misuse; assess transaction risk; and enforce lawful account or listing restrictions. The basis is our legitimate interest in securing the Services and preventing harm and loss. Section 10 addresses automated decisions.
Compliance and records. We keep necessary tax, accounting and transaction records and respond to lawful requests. We rely on a legal obligation where recognised by the applicable EU or UK regime, or on a separately assessed legitimate interest in lawful business administration where permitted, including for relevant overseas requirements.
Newsletters and service improvement. We rely on subscription consent for promotional email and consent for tracking where required. Analytics helps assess website performance and improve the Services, subject to section 6. Any personalised recommendations use the basis identified there. We may use effectively anonymised information for business analysis where individuals can no longer be identified.
Transaction participants. We share relevant identity, contact, artwork, order and payment-status information with the identified seller, buyer and authorised representatives to handle inquiries, assess and complete transactions, arrange settlement and resolve related issues. Carriers, customs agents, insurers and specialists receive information relevant to delivery, inspection, customs, insurance and claims. Recipients acting independently are responsible for their own processing. Receiving transaction information does not authorise unrelated marketing.
Public profiles and listings. Artist names, photographs, biographies, professional locations and artwork details may appear on the website and in promotional material within the relevant rights and permissions. Public material may be indexed, copied or retained by others. Supplying private provenance documents, invoices, account details, payment information or correspondence does not make them public; disclosure remains limited to the relevant transaction, authorised purpose or lawful requirement.
Service providers. We use providers for hosting, storage, authentication, communications, payments, wallet connectivity, analytics, security and administration. Providers acting on our behalf are subject to appropriate purpose and security restrictions and any additional contractual requirements of applicable law. A provider may also act independently for its own fraud-prevention, legal or service purposes, as described in its notice.
Amazon Web Services supports our principal hosting and storage in Singapore. Google supports Google-account sign-in and Google Analytics. Stripe processes checkout payments and related refunds, disputes and fraud screening. MetaMask and the applicable WalletConnect services support wallet connections. Instagram and WhatsApp are used for communications you initiate or otherwise authorise with us. Relevant provider notices include https://aws.amazon.com/privacy/, https://policies.google.com/privacy, https://stripe.com/privacy, https://consensys.io/privacy-notice, https://privacycenter.instagram.com/policy/ and https://www.whatsapp.com/legal/privacy-policy.
Legal and business recipients. We may disclose information reasonably necessary to professional advisers, insurers, authorised recovery providers, affected counterparties, courts, regulators and law enforcement to comply with applicable requirements, investigate suspected fraud or misconduct, recover amounts lawfully due, enforce agreements or protect rights, property and safety. Financing, due diligence, restructuring, a merger, insolvency or a business or asset sale may involve relevant disclosure to prospective or actual counterparties and their advisers, subject to appropriate confidentiality and privacy safeguards and further notice where required.
Other organisations' marketing. We do not provide customer contact lists to artists, galleries or other organisations for their own direct marketing. Providers sending CoinArtz newsletters on our instructions act as service providers for that purpose. Section 11 addresses any separate classification of tracking disclosures under US sale, sharing or targeted-advertising rules.
We use cookies, local storage and similar technologies for website functions and Google Analytics. Necessary technologies may support sign-in, security and requested preferences. Analytics helps us understand website use and performance. The data collected depends on our configuration and may include device and browser information, page interactions, identifiers and approximate location information.
We use the following strictly necessary cookies and local storage technologies to support the operation of our platform: sessionId (provided by CoinArtz) stores a random session identifier to keep you signed in after login and expires after 7 days; cc_cookie (provided by CoinArtz) records your cookie preferences, including accepted categories, consent version and date, and expires after 6 months; and wagmi.* (provided by CoinArtz's wallet library) uses local storage to remember your connected cryptocurrency wallet, including the wallet connector, wallet address and network, until you disconnect your wallet or clear your browser storage.
We also use two optional Google Analytics cookies provided by Google: _ga, which stores a random client identifier to distinguish visitors, and _ga_<ID>, which stores session identifiers and counts to help measure website visits. Both analytics cookies have a duration of up to 2 years. We rely on your consent for the use of these analytics cookies and the associated processing of personal data.
Where prior consent is required, we use optional technologies only after consent. You can refuse or withdraw that consent through the “Cookie settings” link at the bottom of every page. Browser settings also allow you to manage cookies; blocking necessary storage may affect sign-in or other requested features. Section 11 describes applicable US opt-out choices.
Saved favourites, follows and searches support the features you request. Related and similar works are selected based on the attributes of the artwork you are viewing, such as artist, gallery, medium and subject. We do not use your browsing history, purchases or profile to personalise recommendations.
We send newsletters to people who deliberately subscribe, including registered users who select the newsletter subscription box. We use your email address and any subscription preferences you provide to send CoinArtz news and promotions about art, artists, galleries, collecting, exhibitions and related Services. We require your consent for this marketing use; registration, an inquiry or a purchase alone does not subscribe you. Marketing consent is separate from acceptance of the Terms or acknowledgement of this policy.
To stop promotional emails, reply to a newsletter asking to unsubscribe, or email privacy@coinartz.com or support@coinartz.com. Opting out is free and does not require an account login or a reason. We may need enough information to identify the subscribed address. We honour opt-outs within the applicable legal deadline.
We may retain a minimal suppression record to prevent further marketing and evidence of subscription consent. Necessary account, order, payment, security and complaint communications may continue. Unsubscribing does not cancel an order or close an account.
USDT transfers on Ethereum and Solana create public blockchain records, including wallet addresses, assets, amounts, transaction hashes and timing. Other people may view, copy and analyse those records and associate them with information obtained elsewhere. Cryptocurrency use is not necessarily anonymous. Wallet-connection services may process technical and connection metadata under their own notices.
CoinArtz cannot change or erase records maintained by public blockchain networks or copies independently held by network participants. We assess requests concerning account information, wallet-to-account links and other records under our control separately. Do not include names, delivery addresses, identity documents or unrelated personal information in public transaction messages.
CoinArtz is established in Hong Kong and uses AWS hosting in Singapore. Our personnel, providers and transaction participants may process data in Hong Kong, Singapore and other countries, including the United States, depending on the service, destination and provider. Hosting in Singapore does not limit all processing to Singapore.
Where EU or UK transfer restrictions apply, we use the protection applicable to the recipient and transfer, such as a valid adequacy decision or appropriate contractual safeguards with required additional measures.
Contact privacy@coinartz.com for information about applicable transfer safeguards and a copy where available by law, subject to appropriate redactions.
We retain personal data for as long as reasonably needed for the purposes described here, taking account of the nature of the record, our relationship with you, unresolved transactions or disputes, legal requirements and applicable claim periods. Account closure, a failed or refunded purchase, profile removal or withdrawal of marketing consent does not automatically erase records needed for a separate lawful purpose.
Account records remain while the account is active and afterwards to the extent needed to complete outstanding services, address misuse or resolve legal and transaction matters. Inquiry and application records remain until the matter and necessary follow-up are complete, with relevant evidence retained where needed for a complaint or claim. We assess continued retention against those purposes rather than retaining all records indefinitely.
We retain necessary invoices, receipts and business transaction records for applicable tax and accounting periods, including at least seven years for records subject to Hong Kong business-record requirements. Relevant evidence may be retained longer for a live claim, investigation or legal hold. Unrelated profile information, logs and identity evidence are assessed separately.
Public profiles and artwork records remain while needed for lawful publication and applicable contributor arrangements, subject to section 3. Private provenance and ownership history may remain where necessary for transaction evidence, title or authenticity disputes, legal obligations or claims. Any retention after removal is limited to its continuing lawful purpose.
Marketing details remain while subscribed; minimal suppression and consent records may remain to honour opt-outs and demonstrate permission. Security logs and verification evidence remain only for the relevant security, verification or dispute purpose and applicable requirements. Analytics information follows the periods in the cookie notice. Our database is backed up continuously, and backups are retained without a fixed expiry to protect against data loss. Backups are used only to restore the Services and are not used for any other purpose. Access is restricted to authorised technical personnel. Where information has been deleted from our live systems, it may remain in backups but is not restored into active use, and we re-apply the deletion if a backup is restored. We delete or effectively anonymise information when it is no longer needed, subject to lawful retention requirements.
We use technical and organisational safeguards appropriate to the data and risks, including access restrictions for personnel and providers. No transmission or storage system is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your sign-in methods and wallet credentials and notifying us promptly of suspected compromise at support@coinartz.com or privacy@coinartz.com. We assess incidents and make notifications required by law.
Send privacy requests and complaints to privacy@coinartz.com or the Privacy Officer at the address in section 1. Describe the request and provide relevant account, email or transaction details. We may request proportionate information to locate the data and verify identity or representative authority before disclosing or changing it. Do not send identity documents unless we explain why they are needed and how to provide them securely.
Where Hong Kong's Personal Data (Privacy) Ordinance applies, you may request confirmation that we hold your personal data, access to it and correction of inaccuracies. We follow the statutory procedures and deadlines, generally forty calendar days, subject to lawful exceptions or delay procedures. A permitted access fee will not be excessive and will be explained in advance; correction and marketing opt-outs are free.
Rights and requests are subject to applicable conditions and exemptions. We may retain information despite a deletion or closure request where legally justified by obligations, investigations or claims. Access or other rights may be limited only where the applicable law permits, including to protect another person's data or legally privileged information. We provide any explanation required by law. Account closure and profile requests go to support@coinartz.com. Closure does not cancel outstanding transactions or erase public blockchain records.
You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, at https://www.pcpd.org.hk. Additional regional rights and complaint routes are set out below. These sections do not limit any mandatory right available under another applicable law.
Where the EU or UK GDPR applies, you may request access, correction, erasure or restriction, subject to the applicable conditions and exceptions. You may object on grounds relating to your situation to processing based on legitimate interests. We may continue where the law permits, including for compelling overriding legitimate grounds or legal claims. Objections to direct marketing, including related profiling, are honoured without that balancing test.
Where the legal conditions are met, you may receive data you provided in a structured, commonly used, machine-readable format and have it sent to another controller where technically feasible. You may withdraw consent at any time without affecting earlier lawful processing. Information may remain for a separate purpose supported by its own lawful basis, such as necessary transaction records.
We respond without undue delay, normally within one calendar month. We may extend by up to two further months where lawfully justified by complexity or the number of requests, with notice within the initial month. Lawful verification and, in the UK, necessary clarification procedures may affect timing. Requests are normally free; we may charge a reasonable fee or refuse a manifestly unfounded or excessive request where permitted, with an explanation. Exercising a right does not require account closure.
You may complain to the competent EEA supervisory authority, including in the country of your habitual residence, work or the alleged infringement. Authority details are at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, you may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.
For UK data-protection complaints, we acknowledge receipt within thirty days, take appropriate steps to investigate and communicate progress and the outcome without undue delay.
Stripe and other payment participants may use automated fraud or authentication tools that affect whether a payment is accepted. A provider's independent decision is distinct from a decision made by CoinArtz, and we cannot guarantee that a bank or provider will reverse it. Contact privacy@coinartz.com if you have a concern so we can consider the matter within our responsibility and identify the appropriate provider route.
CoinArtz does not make decisions based solely on automated processing that produce legal or similarly significant effects. Account, artist and seller applications, inquiries and orders are reviewed by our staff.
Where applicable law provides safeguards for a significant automated decision within our responsibility, you may request information, make representations, contest the decision and seek meaningful human intervention by contacting privacy@coinartz.com. The applicable EU and UK conditions and exceptions govern these rights.
This section provides additional disclosures and rights where applicable US state privacy laws apply. The information categories below summarise our general practices described in sections 2–8 and are not limited to information collected from US residents.
US rights depend on your state and whether the relevant law applies to CoinArtz and the processing. This section supplements sections 2 to 8.
The table maps information categories to examples and recipient categories. Each disclosure depends on the recipient's role and purpose; not every recipient receives every field. We do not ask for wallet private keys or recovery phrases.
| Category | Examples | Recipient categories |
|---|---|---|
| Identifiers and customer records | Names, email, account and wallet identifiers, billing and delivery details | Hosting, authentication, communications and payment providers; relevant counterparties and fulfilment participants. |
| Commercial information | Artwork inquiries, orders, payments, refunds and saved preferences | Providers administering the relevant service; relevant buyers, sellers and fulfilment participants. |
| Internet and network activity | IP addresses, browser and device data, page interactions and logs | Hosting, security and analytics providers, according to the actual configuration. |
| Professional and visual information | Artist biographies, photographs, locations, artwork details and supplied documents | Hosting and administration providers; publication material may be public. Private documents are limited to necessary or authorised recipients. |
| Optional demographic information | Gender supplied in an artist application | Providers supporting the application. |
| Communications | Messages, attachments, support and dispute records | Communications and support providers. |
| Inferences where used | Interests inferred for personalised recommendations | Providers administering the relevant service. |
| Sensitive personal information | Account login credentials | Relevant authentication and hosting providers with restricted access. |
Sources are described in section 3. We use these categories for the corresponding purposes in section 4 and retain them using the category-specific periods or criteria in section 8. Necessary records in any category may also be disclosed to the legal and business recipients in section 5 where justified by the relevant purpose.
Where applicable, you may request confirmation and access, information about collection and disclosures, correction, deletion and a portable copy. You may also have rights to opt out of sale, sharing or targeted advertising, limit certain sensitive-data uses or disclosures, and opt out of specified profiling or automated decisions. We do not unlawfully discriminate or retaliate against you for exercising a right. Exceptions and verification requirements depend on the law and request; we will explain any applicable refusal or limitation.
Email privacy@coinartz.com to make a request. You do not need to create an account. An authorised agent may act where permitted, subject to lawful proof of authority and verification. We do not require identity verification for sale or sharing opt-outs, although minimal information may be needed to apply them.
We do not sell personal information or share it for cross-context behavioural advertising, and we do not use it for targeted advertising. We do not use sensitive personal information for purposes that require a right to limit.
Our website does not respond to Do Not Track signals, as there is no common standard for them. We do not permit third parties to track you across websites through our Services. Because we do not sell or share personal information for cross-context behavioural advertising, we do not apply Global Privacy Control signals as an opt-out of sale or sharing; Google Analytics loads only after you accept analytics cookies.
The Services are intended for people aged eighteen or over. Contact privacy@coinartz.com if you believe a minor has supplied information, registered or attempted to purchase. We may restrict inappropriate activity and remove information as required, subject to lawful retention for protective or legal purposes.
We may update this policy by posting a revised version and effective date at https://coinartz.com/en/privacy. We provide additional notice of material changes and obtain further consent where required. Updates do not retrospectively authorise a new use of previously collected information. Our Terms and Conditions address contractual disputes and liability to the extent applicable; this policy does not waive mandatory privacy rights or remedies. Privacy Officer: privacy@coinartz.com. Support: support@coinartz.com.