Last updated: Aug, 2026
This Privacy Policy explains how CollectWisely (“we”, “us”, “our”) collects, uses, and shares personal data when you use our website and services (the “Service”). It also sets out your rights under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR), and how to exercise them.
CollectWisely is a privately owned, independently operated business, built and run from India by a small team. It is not part of a larger group, it is not venture funded, and it is not owned by or affiliated with any auction house, dealer or gallery whose data appears on this site.
CollectWisely is the data controller responsible for the personal data described in this policy. The best way to reach us about anything in it — including exercising any of the rights in section 9 — is by email:
We answer privacy enquiries ourselves rather than through a support desk, and we aim to reply well inside the one-month period the law allows.
We only process personal data where we have a lawful basis under Article 6 GDPR:
| Purpose | Legal basis |
|---|---|
| Creating your account and providing the Service | Performance of a contract (Art. 6(1)(b)) |
| Processing subscriptions, payments and refunds | Performance of a contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c)) |
| Transactional emails (verification, password reset, billing notices) | Performance of a contract (Art. 6(1)(b)) |
| Security, rate limiting, fraud and abuse prevention | Legitimate interests in protecting the Service and its users (Art. 6(1)(f)) |
| Artist alerts and email digests you have turned on | Consent (Art. 6(1)(a)) — withdrawable at any time in your profile |
| Optional analytics cookies | Consent (Art. 6(1)(a)) — withdrawable at any time via Cookie settings |
| Responding to legal requests and enforcing our Terms | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, we have assessed that our interest in operating a secure, functioning service is not overridden by your rights and freedoms. You may object to this processing at any time (see section 9).
We set strictly necessary cookies to sign you in and keep the Service secure. Optional analytics cookies are set only after you actively accept them — nothing non-essential loads before you choose. Our login and sign-up pages also load Google reCAPTCHA, which is provided by Google and receives your IP address in order to distinguish real users from automated abuse. A full list of cookies, their purposes and durations is in our Cookie Policy, where you can also change or withdraw your choice at any time.
We do not sell your personal data and we do not share it with advertisers. We share it only with processors who help us run the Service, each bound by a written data processing agreement:
We may also disclose personal data where required to comply with law or lawful requests, to protect the rights and safety of our users, or in connection with a merger, acquisition or sale of assets (in which case we will notify you before your data becomes subject to a different privacy policy).
We implement appropriate technical and organisational measures under Article 32, including encryption in transit, hashed passwords, access controls, rate limiting and bot protection. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, notify you directly.
Some of our providers are located outside the UK and European Economic Area, principally in the United States. Where we transfer personal data internationally, we rely on one or more of the following safeguards: transfers to providers certified under the EU–US Data Privacy Framework and its UK Extension, or Standard Contractual Clauses approved by the European Commission (together with the UK International Data Transfer Addendum), supported by additional safeguards where needed. You can request a copy of the relevant safeguards by emailing us.
If you are in the UK or the European Economic Area, you have the following rights. Exercising them is free, and we will respond within one month.
How to exercise them: signed-in users can download a full copy of their data and permanently delete their account from the Your data & privacy section of their profile. Cookie consent can be changed at any time via Cookie settings. For anything else, email [email protected].
If you believe we have handled your personal data improperly, please contact us first so we can try to put it right. You also have the right to lodge a complaint with a supervisory authority:
The Service is not directed to children. We do not knowingly collect personal data from anyone under 16, or under the lower age set by your country where that applies (which may be as low as 13 in some EU member states). If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this Privacy Policy from time to time. The “Last updated” date reflects the most recent changes. Where a change materially affects how we use your data, we will notify you directly and, where the law requires it, ask for your consent again rather than relying on continued use.
Privacy questions, or to exercise any of the rights above: [email protected].