Part of the Crestox Legal Framework. By creating an account or participating in any capacity — as a Collector, Artist, Curator, or Owner — you agree to be bound by this document together with the other documents that make up the Crestox legal framework (Terms of Use, Risk Disclosure, Privacy Policy, Artist Agreement, and Secondary Marketplace Terms).
Effective Date: [Date]
Last Updated: [Date]
3.1 Introduction
Crestox is committed to protecting your privacy and handling your personal data with transparency, care, and respect. This Privacy Policy explains what information we collect about you, how we use it, who we share it with, and how you can exercise your rights in relation to it.
By using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where your use of the Platform requires your consent to any data processing, we will seek that consent separately and expressly.
3.2 Information We Collect
We collect information about you in the following categories:
Account Information
- Full name
- Email address
- Phone number
- Country of residence
- Username and password (stored in encrypted form)
- Government-issued identification documents (where required for verification)
Profile Information
- Biographical information you provide
- Profile photograph
- Social media links and website URLs
- Artist or Curator credentials and supporting documentation
Transaction Information
- Records of Fractal purchases and sales
- Payment method details (processed and stored by our payment providers; we do not store full card or bank details)
- Transaction history and confirmation records
- Ownership Certificate records
Platform Usage Information
- Pages visited, features used, and time spent on the Platform
- Search queries and browsing behaviour within the Platform
- Device type, operating system, browser type, and IP address
- Cookies and similar tracking technologies (see Section 3.5)
Communications
- Messages submitted through our support channels
- Correspondence with Crestox staff
3.3 How We Use Your Information
We use the information we collect for the following purposes:
Account Creation and Management. To register your Account, verify your identity, and manage your access to Platform services.
Marketplace Operation. To facilitate the listing, purchase, and sale of Fractals, process payments, issue ownership Certificates, and maintain accurate transaction records.
Verification and Compliance. To verify the identity of Users and the authenticity of Artworks, conduct know-your-customer and anti-money-laundering checks where required, and meet our legal and regulatory obligations.
Customer Support. To respond to your enquiries, resolve disputes, and provide assistance with Platform-related issues.
Security Monitoring. To detect, investigate, and prevent fraud, market manipulation, unauthorised access, and other prohibited activities.
Platform Improvement. To understand how Users interact with the Platform and to improve our features, design, and services.
Communications. To send you service-related notifications, including transaction confirmations, Account updates, approval notifications, and security alerts.
Marketing. With your consent where required by law, to inform you about new features, Artworks, and Crestox developments. You may opt out of marketing communications at any time.
3.4 Information Sharing
We do not sell your personal data. We share your information only in the following circumstances:
Service Providers. We share information with trusted third-party providers who assist us in operating the Platform, including payment processors, identity verification providers, cloud hosting providers, and analytics services. These providers are contractually required to process your data only on our instructions and in accordance with applicable data protection law.
Payment Partners. Payment information is processed by our payment partners in accordance with their own privacy policies. We recommend that you review those policies before completing any transaction.
Legal Obligations. We may disclose your information where required to do so by law, court order, regulatory authority, or law enforcement agency, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Crestox, our Users, or the public.
Business Transfers. In the event of a merger, acquisition, or sale of Crestox's assets, your information may be transferred to the relevant successor entity, subject to equivalent privacy protections.
With Your Consent. We may share your information in other circumstances where we have obtained your explicit consent to do so.
We do not share your personal data with advertisers or third parties for their own marketing purposes.
3.5 Cookies and Tracking Technologies
We use cookies and similar technologies to operate the Platform, maintain your session, understand usage patterns, and improve your experience.
Essential Cookies are required for the Platform to function and cannot be disabled.
Analytics Cookies help us understand how Users interact with the Platform. These may be disabled through your browser settings or our cookie preference centre, where available.
Marketing Cookies are used, with your consent, to present relevant content. You may withdraw consent at any time.
For further detail on the cookies we use, please refer to our Cookie Policy, available on the Platform.
3.6 Data Retention
We retain your personal data for as long as your Account remains active and for a reasonable period thereafter to meet our legal, regulatory, and operational obligations.
Specific retention periods include:
- Transaction records: Retained for a minimum of [X] years following the date of the transaction, in accordance with applicable financial record-keeping requirements.
- Identity verification records: Retained for the period required by applicable anti-money-laundering and know-your-customer regulations.
- Account information: Retained for the duration of your Account and for [X] years following closure, unless a longer period is required by law.
Where you request deletion of your personal data, we will action that request to the extent permitted by our legal obligations. Some data cannot be deleted where retention is required by law.
3.7 Your Rights
Depending on your jurisdiction, you may have the following rights in relation to your personal data:
- Access: The right to request a copy of the personal data we hold about you.
- Correction: The right to request correction of inaccurate or incomplete personal data.
- Deletion: The right to request deletion of your personal data, subject to applicable legal retention obligations.
- Restriction: The right to request that we restrict the processing of your personal data in certain circumstances.
- Portability: The right to receive a copy of your personal data in a structured, machine-readable format.
- Objection: The right to object to processing based on legitimate interests or for direct marketing purposes.
- Withdrawal of Consent: Where processing is based on your consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please contact us at privacy@crestox.com. We will respond within the timeframe required by applicable law.
3.8 Security
We implement technical and organisational measures designed to protect your personal data against unauthorised access, disclosure, alteration, and destruction. These include encryption of data in transit and at rest, access controls, regular security assessments, and staff training.
No system is entirely secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant regulatory authority in accordance with our legal obligations.
3.9 International Data Transfers
Where your personal data is transferred outside your country of residence, we ensure that appropriate safeguards are in place in accordance with applicable data protection law, including standard contractual clauses or equivalent mechanisms recognised by the relevant regulatory authority.
3.10 Children
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with personal data, please contact us and we will take steps to delete that information.
3.11 Contact
For all privacy-related enquiries, requests, or complaints, please contact our Privacy Team at: privacy@crestox.com
If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.
Related Documents
This document is part of the Crestox Legal Framework. For the complete framework, also see: