Privacy Policy

1. Scope & Principles

• Data controller identification: WatchVault Ltd. a company incorporated in Malta, acts as the data controller under the EU General Data Protection Regulation (GDPR - Regulation 2016/679) for all personal data processed through the WatchVault platform.
• Scope of Privacy Policy: This policy applies to all web visitors, registered private buyers and sellers and professional watch dealers utilizing WatchVault platform, escrow infrastructure and laboratory authentication facilities.
• Core principles: WatchVault strictly adheres to EU data minimization and purpose limitation standards. We process personal data exclusively to facilitate high-value marketplace transactions, ensure legal and regulatory compliance and safeguard platform security.

2. Information Collected

• Private account data: Full name, email address, phone number, residential address and preferred payout currency.
• Verification & KYC data: Government-issued photo ID (Passport or EU National ID Card), Date of Birth (to verify platform age eligibility between 18 and 80 years) and selfie/liveness verification.
• Dealer corporate data: Business registration details, valid EU VIES VAT Numbers, active Company Bank Statements and identification data for Ultimate Beneficial Owners (UBOs holding 25%+ equity).
• Transaction & listing data: Timepiece details, serial numbers, high-resolution pictures, dispute reports, escrow payment records, payout history and platform message logs.
• Technical data: IP address, browser metadata, device identifiers, geolocation data, login timestamps and session security telemetry.

3. Data Processing Purposes

• Performance of contract (Art. 6(1)(b) GDPR): Processing contact details, shipping addresses, listing data and bank account information to execute purchase agreements, escrow management and logistics delivery.
• Legal compliance (Art. 6(1)(c) GDPR): Mandatory identity verification and transaction monitoring under EU Anti-Money Laundering directives (5AMLD/6AMLD), financial record-keeping laws and EU tax reporting rules (DAC7 Council Directive 2021/514).
• Legitimate interests (Art. 6(1)(f) GDPR): Preventing fraud, verifying luxury watch authenticity against stolen asset registries, securing platform infrastructure, asserting legal defenses and optimizing service performance.
• Consent (Art. 6(1)(a) GDPR): Non-essential analytics cookies, functional tracking and opt-in direct marketing communications.

4. Third-Party Data Sharing

WatchVault is required to share data to third-parties as stated:

• Escrow & banking partners: Licensed EU financial institutions and SEPA payment gateways process payments, hold escrow funds and issue seller payouts.
• Logistics & insurance services: Armored transport providers (Ex. XXX), specialized courier services (Ex. XXX) and specialized insurance companies (Ex. XXX) receive delivery addresses and shipment values for insured transport.
• Global watch registries & law enforcement: Serial numbers and metadata may be queried against global stolen watch databases or shared with competent law enforcement agencies upon valid legal order.
• Tax authorities: Seller identity and income metrics are reported to relevant EU Member State tax authorities strictly in compliance with mandatory DAC7 reporting thresholds.

5. Data Retention Periods

• Account & profile data: Retained for the duration of active account membership, plus 2 years post account closure.
• KYC/AML compliance records: Government IDs, UBO documentation and identity verification logs are retained for 5 years following the end of the business relationship, as mandated by EU Anti-Money Laundering legislation.
• Transaction & tax data: Invoices, escrow records and DAC7 reporting logs are retained for 10 years to comply with statutory EU accounting, commercial and tax obligations.
• Technical Logs: Server security logs and IP tracking data are retained for 90 days before automated purge, unless flagged for active security investigations.

6. Security Measures

• Data protection infrastructure: All data in transit is encrypted and sensitive database fields (including but not limited to identity records and payment details) are encrypted at rest using secure encryption standard.
• Access control & audits: Access to personal and corporate data is restricted strictly to authorized operational personnel under non-disclosure obligations (NDA). Regular penetration testing and vulnerability scans are conducted.
• EEA data residency: Primary data processing and database hosting are maintained on secure cloud infrastructure located within the European Economic Area (EEA).
• Cross-Border transfer safeguards: If personal data is transferred to vendors or servers outside the EEA, WatchVault ensures adequate protection through official EU Commission Adequacy Decisions or standard contractual clauses (SCCs).

7. GDPR Rights

Under articles 15–22 of the GDPR, EU users hold the following rights regarding their personal data:

• Access & portability: Request a copy of your personal data processed by WatchVault in a structured, machine-readable format.
• Rectification: Request correction of inaccurate or incomplete personal information.
• Erasure: Request deletion of your personal data, provided it is no longer required for active transactions or statutory compliance (Ex. Mandatory AML retention rules).
• Restriction & objection: Object to or restrict processing based on legitimate interests or direct marketing.
• Withdrawal of consent: Revoke consent for direct marketing or non-essential cookies at any time via your account settings.
• Right to lodge a complaint: File a dispute directly with your local Data Protection Authority (DPA) or with WatchVault lead supervisory authority, the Office of the Information and Data Protection Commissioner (IDPC) in Malta at idpc.org.mt, if you believe your privacy rights have been infringed.

8. Cookies

WatchVault uses essential cookies for platform navigation, user authentication and escrow session security. Performance and marketing cookies are deployed only with your explicit consent via our Cookie Banner.