PRIVACY POLICY

Hautology Watches Ltd.

Last updated: 29/5/2026

Your privacy matters to us. This Privacy Policy explains what personal data Hautology Watches Ltd. collects, why we collect it, how we use it, and what your rights are under Irish and EU data protection law — principally the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Data Protection Acts 1988–2018.

Please read this policy carefully. If you have any questions, you can reach us using the contact details below.

1. What Personal Data We Collect

We collect personal data in the following categories, depending on how you interact with us:

Identity & Contact Information

• Full name

• Date of birth

• Home or business address

• Email address

• Phone number

Identity Verification Documents

• Copies of government-issued photographic ID (passport, national identity card, or driver’s licence)

• Proof of address documents (e.g. utility bills, bank statements)

These are collected for anti-money laundering (AML) compliance purposes when you sell or consign a watch to us, and may also be requested when you purchase a watch from us, particularly for cash transactions of €10,000 or more or where otherwise required under our AML/KYC Policy.

Financial Information

• Bank account details (account holder name, IBAN, BIC/SWIFT) where you are selling or consigning a watch to us and payment is to be made by bank transfer

• Payment card data, where you purchase from us by card — note that card payments are processed by our third-party payment processor and we do not store full card details ourselves

Transaction Information

• Details of watches bought, sold, consigned, or serviced

• Watch identification details (brand, model, reference number, serial number, condition, accompanying items)

• Agreed prices, minimum payouts, and commission details

• Invoice and agreement records

Communications Data

• Emails, text messages, or other correspondence you send us

• Records of phone calls where notes are taken

• Contact form submissions via our website

Technical & Website Data

• IP address

• Browser type and version

• Pages visited and time spent on our website

• Referring URLs

• Cookie identifiers (see Section 8 for our Cookie Policy)

• Device information

Marketing Preferences

• Your preferences regarding receiving marketing communications from us

2. How We Collect Your Personal Data

We collect personal data in the following ways:

• Directly from you — when you complete a consignment agreement, purchase agreement, or sales agreement with us; when you contact us by email, phone, text, or via our website contact form; or when you visit our premises

• Through our website — via cookies, analytics tools, and contact forms

• From third parties — such as watch authentication databases (including The Watch Register), payment processors, and couriers, where relevant to a transaction

3. Why We Use Your Data and Our Legal Basis

We only process your personal data where we have a lawful basis to do so under Article 6 of the GDPR. The purposes for which we use your data, and the legal basis for each, are set out below:

To carry out a sale, purchase, or consignment agreement with you

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). We need your identity, contact, and financial details to enter into and fulfil our agreements with you.

To comply with anti-money laundering (AML) obligations

Legal basis: Legal obligation (Article 6(1)(c) GDPR). We are required by the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010–2021 to verify the identity of individuals we transact with and to retain those records, as set out in further detail in our AML/KYC Policy.

To process payments

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). We need your financial details to send or receive payment in connection with a transaction.

To manage warranty claims and after-sales service

Legal basis: Performance of a contract (Article 6(1)(b) GDPR). We use your contact and transaction details to manage warranty repairs and communicate with you about service.

To respond to your enquiries

Legal basis: Legitimate interests (Article 6(1)(f) GDPR). We have a legitimate interest in responding to questions and communications from potential and existing customers.

To send you marketing communications

Legal basis: Consent (Article 6(1)(a) GDPR). We will only send you marketing emails or messages if you have opted in to receive them. You can withdraw your consent at any time by contacting us or clicking the unsubscribe link in any marketing email.

To operate and improve our website

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) and, where cookies require it, consent. We use technical and analytics data to understand how our website is used and to improve it. See Section 8 for more on cookies.

To maintain business records and comply with tax and accounting obligations

Legal basis: Legal obligation (Article 6(1)(c) GDPR) and legitimate interests (Article 6(1)(f) GDPR).

4. Who We Share Your Data With

We do not sell your personal data to third parties. We share your data only where necessary, with the following categories of recipient:

• Payment processors — to securely process card payments on our behalf. Your payment data is handled directly by the processor under their own security standards.

• Couriers and shipping providers — to deliver watches and other items. We share your name and delivery address for this purpose.

• Third-party marketplaces — such as Chrono24, where you have opted in to listing on such platforms. Your watch details (but not your personal identity data) may be shared in the context of a listing.

• Watch authentication and registry databases — including The Watch Register, for the purpose of verifying provenance and checking watches against stolen goods registers.

• Our watchmaker — where a watch requires service or warranty repair. We share relevant watch details and, where necessary, contact information to facilitate the return of the watch to you.

• CRM and business software providers — we use software to manage stock, customer records, and business operations. These providers act as data processors on our behalf and are bound by data processing agreements.

• Professional advisors — including our accountant, solicitor, and any other advisors, where necessary for the operation of the business. These parties are bound by professional confidentiality obligations.

• Law enforcement and regulatory authorities — including the Garda Síochána and the Revenue Commissioners, where we are required by law to report suspicious activity or comply with a legal obligation. We are not required to notify you before making such a disclosure.

Where we share data with third-party processors, we ensure appropriate data processing agreements are in place in accordance with Article 28 GDPR.

5. International Data Transfers

Some of the third-party services we use — such as CRM software, analytics tools, or cloud storage providers — may store or process data outside of the European Economic Area (EEA). Where this is the case, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data in accordance with GDPR requirements.

If you would like more information about the specific safeguards in place for any international transfers, please contact us.

6. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are as follows:

• Transaction records, identity verification documents, and AML-related records: 6 years from the date of the transaction. This reflects the minimum 5-year period required by the Criminal Justice (Money Laundering and Terrorist Financing) Acts 2010–2021, extended to 6 years to align with the general limitation period for contract claims under the Statute of Limitations 1957.

• Accounting and tax records: 6 years, in line with Irish Revenue requirements.

• Warranty records: 6 years from the date of sale or completion of service, in line with the general limitation period for contract claims under the Statute of Limitations 1957.

• Marketing preferences and consent records: for as long as you remain opted in, plus a reasonable period after you unsubscribe to demonstrate compliance.

• General correspondence and enquiry records: up to 2 years, unless a longer retention period is required in connection with a transaction.

• Website analytics data: as set out in the relevant tool’s data retention settings, typically no longer than 26 months.

When data is no longer required, it is securely deleted or anonymised.

7. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, please contact us using the details in Section 12. We will respond within one month of receiving your request, as required by GDPR. In complex cases we may extend this by a further two months, in which case we will notify you.

We do not charge a fee for handling data subject requests, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request.

8. Cookies

Our website uses cookies — small text files stored on your device — to help the site function and to understand how it is used. The types of cookies we use are:

• Essential cookies: necessary for the website to function correctly. These cannot be disabled.

• Analytics cookies: used to collect information about how visitors use our site (such as pages visited and time spent). This data is aggregated and anonymous. We use this to improve our website. These cookies are only set with your consent.

• Marketing cookies: used to track visits to our website and may be used to show you relevant advertising. These are only set with your consent.

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You can change your preferences at any time via the cookie settings on our website.

You can also control cookies through your browser settings. Please note that disabling certain cookies may affect how our website functions.

9. Children

Our services are not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete it.

10. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or alteration. These include, but are not limited to, secure storage of physical documents, password-protected systems, and access controls.

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. If you have concerns about a specific data security issue, please contact us.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of it, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we do, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

Where changes are material, we will take reasonable steps to bring them to your attention — for example, by displaying a notice on our website.

12. Contact Us & How to Complain

If you have any questions about this Privacy Policy, want to exercise any of your rights, or have a concern about how we handle your data, please get in touch:

We will do our best to address your concern promptly. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission (DPC), which is the supervisory authority for data protection in Ireland:

Hautology Watches Ltd. — Registered in Ireland — 5 Gardiner Row, Dublin 1, D01 R3K1