1 FRAHM & FRAHM LTD. Privacy Policy This website is operated by FRAHM & FRAHM LTD. (“we”, “our” or “us”). Protecting the privacy of our users is extremely important to us. This policy explains in clear terms: • Who we are • The personal information we collect, use, and share • The purposes and lawful bases for processing your information • How long we keep your data • Your rights under UK data protection law • How to contact us and the UK supervisory authority 1. Who We Are FRAHM & FRAHM LTD. is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 . This means we determine how and why your personal information is processed. Contact details : Email: info@frahmandfrahm.com Post: FRAHM & FRAHM LTD., 124 City Road, London, England, EC1V 2NX, United Kingdom It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. If you have any questions about this policy, your rights, or how we use your personal data, you can contact us using the above details. 2. Personal Data We Collect We may collect and process the following types of personal information: • Information you provide to us directly : e.g., name, email address (for newsletter sign - up or contact forms). • Information you provide about third parties : If you provide information about another individual, you confirm that you have their consent or authority to do so. • Cookies and similar technologies : We may use cookies, pixels, and other tracking technologies to collect technical and usage information when you interact with our website. This helps us understand how the site is used and improve its functionality. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. • Information collected from other sources : We may also obtain information about you and/or the artworks that you own, wish to buy, sell, or collect from third - party sources. For example: o Identity and contact data, when someone introduces you to us (e.g., because they believe an artist or work may interest you). o Identity and contact data, when we research artworks and find information about you in public sources such as newspaper articles, exhibition catalogues, public auction results, or when one of our 2 contacts provides feedback relating to artworks or individuals they have heard about. 3. How We Use Your Personal Data We only process your personal information where we have a valid legal basis for doing so. In practice, this means we may use your personal data in the following ways: • To fulfil a contract : for example, where you purchase a work, engage us for services, or request something that requires us to process your details. • Where we have a legitimate business reason : such as keeping accurate client records, safeguarding artworks, or improving our services, provided your fundamental rights are not infringed. • To meet our legal and regulatory duties : including anti - money laundering checks, tax, and customs obligations. • With your consent : for example, when you sign up to receive updates or marketing communications. Specific note on Anti - Money Laundering (AML) compliance Per Article 13 UK GDPR and Regulation 41 of the Money Laundering Regulations , where personal data is collected from customers specifically for compliance with these regulations, it will be processed only: a) for the purposes of preventing money laundering, terrorist financing, or proliferation financing; or b) as otherwise permitted under Regulation 41(3). Examples of Processing Activities The table below sets out common situations where we process personal data, the types of information involved, and the legal basis we rely on. (This list is representative but not exhaustive.) Purpose / Activity Types of Data Legal Basis Adding you to our records or registering you as a client Name, title, contact details (email, address, phone) Contract performance; Legitimate interests (e.g., when you provide us with your details in a business context); Consent (where you ask to be added) Providing goods and services (e.g., sales, shipping, insurance, storage, loans) Contact details; Bank/payment details; Details of introducers; Artwork details; Contract terms Contract performance Meeting compliance requirements (e.g., anti - money laundering, taxation, customs, accessibility obligations) Identification documents; Date of birth; Transaction and shipping records; Information needed to accommodate accessibility requirements; Legal or dispute records Legal obligation 3 Purpose / Activity Types of Data Legal Basis Sending you updates about our services, artworks, or projects Contact details; Information about interests and collections; Communication preferences Legitimate interests (existing clients); Consent (new contacts requesting updates) Maintaining records on artworks (e.g., authenticity, provenance, ownership, preventing fraud or theft) Details of artworks you own or collect; Allegations or records of unlawful activity; Communications with authorities Legitimate interests; Legal obligation; Public interest Recovering sums owed to us Contact details; Financial data; Property details Contract performance; Legitimate interests (debt recovery) Managing our ongoing relationship with you and tailoring our services Contact details; Preferences and interests; Offers and responses; Purchase history Legitimate interests (long - term client relationships and tailored service) Operating and improving our website Technical data such as system logs, cookies, usage data Legitimate interests (IT and site functionality); Consent (where cookies or analytics require it) 4. Sharing Your Information We do not sell or trade your personal data. We may share your data only with: • Service providers who process data on our behalf (e.g., email or website hosting providers). • Regulators and law enforcement where required by law. 5. International Data Transfers We primarily process your data in the UK. If personal data is transferred outside the UK, we will ensure appropriate safeguards are in place, such as: • An adequacy regulation issued by the UK Government, or • An International Data Transfer Agreement (IDTA) or Addendum to EU Standard Contractual Clauses (SCCs). 6. Data Retention We keep personal data only as long as necessary for the purposes collected. For example: • Newsletter sign - up data: retained until you unsubscribe. • Contact form submissions: retained for up to 24 months for query handling. We may keep limited records beyond these periods where required for legal, regulatory, or security reasons. 7. Marketing 4 We may send you information about our products, services, or offers if you have consented. You can withdraw consent or opt out at any time by clicking “unsubscribe” in emails or contacting us directly. 8. Security We use appropriate technical and organisational measures to protect personal data, including encryption, secure servers, and access controls. While we take all reasonable steps to protect your data, transmission over the internet is never completely secure. 9. Children’s Data We do not knowingly collect data from children under 13 without parental consent. Where services are directed at children, we comply with the ICO’s Age - Appropriate Design Code (Children’s Code) 10. Your Rights Under UK GDPR, you have the right to: • Access your personal data • Rectify inaccurate data • Request erasure (“right to be forgotten”) • Restrict or object to processing • Data portability (transfer of your data to another provider) • Withdraw consent at any time (for processing based on consent) • Object to direct marketing • Request human review of automated decision - making (if applicable) To exercise these rights, contact us at info@frahmandfrahm.com . You may need to provide proof of identity. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) : Website: https://ico.org.uk/concerns/ Tel: 0303 123 1113 11. Changes to This Policy This Privacy Policy was last updated on 2 September 2025 We may update it from time to time. Where changes are significant, we will notify users by email (if subscribed to updates) or through a notice on our website. 12. Contact Us If you have questions about this Privacy Policy or how your data is handled, you can contact us at: Email : info@frahmandfrahm.com Post : FRAHM & FRAHM LTD., 124 City Road, London, England, EC1V 2NX United Kingdom