1. Scope of This Policy

This Privacy Policy describes how M.S. Rau Antiques, L.L.C., doing business as M.S. Rau (“M.S. Rau,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you interact with:

• Our website and online services;
• Our gallery, events, exhibitions, and in-person experiences;
• Our sales, client service, and other team members;
• Our inquiry forms, newsletters, catalog requests, and marketing communications; and
• Any other service that links to this Privacy Policy.

This Policy does not apply to information processed solely in an employment context or to third-party websites and services that maintain their own privacy policies.

Residents of certain U.S. states, the European Economic Area ("EEA"), and the United Kingdom ("UK") may have additional rights described below.

2. Information We Collect

2.1 Information You Provide

We may collect information you choose to provide, including:

• Name, email address, telephone number, and mailing address;
• Account, inquiry, contact-form, and catalog-request information;
• Collector preferences, interests, wish lists, and items viewed or requested;
• Newsletter subscriptions and event registrations;
• Communications with our sales and client service teams;
• Purchase-related requests, offers, consignments, appraisals, and questions;
• Feedback, survey responses, and other information you submit; and
• Identity or authorization information needed to process a privacy request.

Information submitted through our website, browsing and engagement activity, and information provided to our team may be stored in HubSpot and Salesforce. These systems are synchronized so that client service, marketing, inquiry, transaction, and engagement information may be reflected across both platforms.

2.2 Transaction and Payment Information

When you make or discuss a purchase, we may collect:

• Contact, order, and item information;
• Shipping, delivery, customs, and billing details;
• Purchase records and transaction history;
• Payment status and limited payment-related information; and
• Information needed for fraud prevention, legal compliance, or transaction review.

Payment card information is processed by our payment service providers, including Authorize.net. We generally do not retain complete payment card numbers.

2.3 Information Collected Automatically

When you use our website, we and our service providers may automatically collect:

• IP address and approximate location;
• Browser type, operating system, device type, and device identifiers;
• Pages viewed, items viewed, referring pages, and time spent;
• Navigation paths, clicks, searches, and interaction data;
• Advertising identifiers and campaign information; and
• Cookie, pixel, tag, local-storage, and similar technology data.

We may collect this information through analytics, advertising, customer data, email, consent-management, and measurement technologies provided by third-party service providers. The particular providers we use may change as our business and technology needs evolve.

Where technically possible and permitted by law, we may associate automatically collected information with information you provide, transaction records, and engagement with our communications. For example, we may connect product views, page views, website searches, and email interactions with an existing client or prospective-client record.

2.4 Information From Other Sources

We may receive information from shipping providers, payment processors, analytics and advertising partners, social media platforms, public sources, event partners, and other parties that help us provide services, prevent fraud, understand our audience, or improve our communications.

2.5 Collector Interests, Preferences, and Profiles

We collect and combine information about interactions with M.S. Rau, including product and collection pages viewed, website searches, page visits, inquiries, purchases, event activity, catalog requests, and engagement with our emails, such as opens and clicks.

Some of this activity may be collected before we know your identity. When you later identify yourself, submit a form, click through from an email, make an inquiry, or otherwise interact with us, we may associate prior or subsequent activity with your client or prospective-client profile.

We use customer data platforms and other marketing technologies to organize this information and better understand collector interests and preferences. This may allow us to infer artists, periods, categories, objects, services, or events that may be of interest to you.

We use these insights to support client service, personalize portions of the browsing experience, recommend relevant works or objects, create audience segments, measure engagement, and improve the timing and relevance of marketing communications.

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects.

3. How We Use Personal Information

We may use personal information to:

• Respond to inquiries and provide personalized client service;
• Process, fulfill, ship, and support purchases and other transactions;
• Maintain client records, preferences, and relationship history;
• Provide catalogs, newsletters, invitations, and other requested communications;
• Recommend works, objects, exhibitions, or services that may be of interest;
• Operate, maintain, analyze, and improve our website and services;
• Measure marketing performance and conduct advertising or retargeting campaigns;
• Recognize returning visitors and remember preferences;
• Detect, investigate, and prevent fraud, security incidents, misuse, or illegal activity;
• Enforce our agreements and protect our rights, property, clients, employees, and others;
• Comply with legal, tax, accounting, sanctions, customs, and regulatory obligations; and
• Carry out other purposes disclosed when information is collected or with your consent.

4. Lawful Bases for Processing

Where EEA or UK data protection law applies, our lawful bases depend on the purpose and circumstances of the processing. They may include:

• Contract: processing needed to respond to a transaction request, complete a purchase, arrange delivery, or perform an agreement with you.
• Legitimate interests: client service, relationship management, website improvement, fraud prevention, security, recordkeeping, and appropriate marketing to existing or prospective clients, provided those interests are not overridden by your rights.
• Consent: marketing, cookies, audience matching, or other processing where consent is required. You may withdraw consent at any time.
• Legal obligation: compliance with applicable legal, regulatory, tax, accounting, sanctions, customs, and law-enforcement requirements.

5. How We Disclose Personal Information

We may disclose personal information to trusted parties that support our business, including:

• CRM, customer data platform, hosting, cloud-storage, communications, email, and other technology providers;
• Analytics, marketing, advertising, and audience-measurement partners;
• Payment processors and fraud-prevention providers;
• Shipping, logistics, customs, storage, installation, and insurance providers;
• Event, exhibition, and business partners where appropriate;
• Professional advisors, including legal, accounting, audit, and insurance advisors;
• Government authorities or other parties where required or permitted by law; and
• Parties involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction.

We require service providers that process personal information on our behalf to use it only for authorized purposes and to apply safeguards appropriate to the services they provide.

We may also disclose information when reasonably necessary to comply with law, respond to lawful requests, protect rights or safety, investigate suspected wrongdoing, or enforce our agreements.

6. Third-Party Service Providers

We may use third-party providers to support functions such as customer relationship management, customer data platforms, consent management, payment processing, shipping, analytics, email delivery, marketing, advertising, cloud hosting, fraud prevention, website performance, accessibility support, and other technology services.

These providers may process personal information on our behalf or, in some cases, for their own disclosed purposes. We generally seek to use contracts and other measures intended to limit service providers' use of personal information to authorized purposes and to require safeguards appropriate to the services they provide.

Where a provider places or controls cookies or similar technologies, additional information may be available through our cookie banner, privacy preference center, or related notices.

7. Advertising, Audience Matching, and Personalization

We may use and combine browsing activity, product and collection views, website searches, email engagement, transaction history, inquiries, and stated preferences to better understand collector interests. We may organize this information into profiles or audience segments to personalize portions of our website, guide client service, recommend relevant works or objects, measure engagement, and improve our marketing.

We may use customer data platform activity and other first-party information to build advertising audiences or support audience matching through platforms such as Google and Meta. We also use Google Enhanced Conversions, which may involve transmitting hashed identifiers, such as email addresses or telephone numbers, to help measure advertising performance and improve campaign attribution.

Hashing transforms an identifier before transmission, but it does not necessarily make the information anonymous. Applicable privacy laws may still treat hashed identifiers and audience-matching information as personal information.

We do not sell personal information in exchange for money. Certain uses of advertising cookies, pixels, or audience-matching technologies may, however, be considered a "sale," "sharing," or use for "targeted advertising" under some U.S. state privacy laws.

Where required, we obtain consent before using non-essential advertising technologies or sharing identifiers for these purposes.

8. Cookies and Similar Technologies

We use, or may permit our service providers to use, cookies, pixels, tags, local storage, software development kits, server-side tracking, and similar technologies. Depending on how they are configured, these generally fall into the following categories.

Essential Technologies

These support core website functions, security, network management, shopping features, and your privacy choices.

Analytics and Performance Technologies

These help us understand how visitors use the website, identify technical issues, and improve performance and content.

Customer Insights and Personalization Technologies

These technologies may help us understand how visitors engage with our website and communications. Depending on the technology and available permissions, they may collect page views, product views, searches, email interactions, device information, and similar activity and may associate that activity with a client or prospective-client profile. We may use the resulting information to understand apparent collector interests, personalize recommendations, measure engagement, and improve marketing.

Advertising Technologies

These help measure campaigns, limit repeated advertisements, build audiences, and show advertising that may be more relevant to your interests.

We use Consentmo as our cookie consent-management platform to present available choices regarding non-essential cookies and similar technologies, record visitor preferences, and apply those preferences through our website.

For visitors in the United Kingdom and other locations where prior consent is required, our consent configuration is designed to prevent Google Analytics, Meta Pixel, Segment, Google Ads, and Google Enhanced Conversions from operating before the visitor provides the required consent.

You may accept, reject, or customize categories of non-essential technologies through our cookie banner or privacy preference center. You can also control certain technologies through your browser settings, although disabling them may affect website functionality.

For more information about how we use these technologies and your choices, please see our Cookie Policy.

9. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide services, maintain client relationships, preserve transaction and provenance records, comply with legal and accounting obligations, resolve disputes, prevent fraud, and enforce agreements.

Retention periods vary depending on the nature of the information, the context in which it was collected, operational needs, legal requirements, and applicable limitation periods. Website and engagement event data recorded in Salesforce is generally maintained on a rolling 90-day basis. Other client, inquiry, transaction, preference, and legal records may be retained for longer where reasonably necessary for the purposes described in this Policy.

When personal information is no longer needed, we may delete, anonymize, or securely dispose of it.

10. Security

We maintain reasonable administrative, technical, and physical safeguards designed to reduce the risk of unauthorized access, loss, misuse, alteration, or disclosure. The safeguards used vary based on the nature and sensitivity of the information, the systems involved, and the risks associated with processing it.

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

11. Your Choices

Marketing Communications

You may unsubscribe from marketing emails by using the unsubscribe link in any marketing message or by contacting us. We may continue to send non-promotional communications, including transaction, service, security, and legal notices.

Targeted Advertising

You may manage advertising cookies through our privacy preference center. You may also use industry opt-out tools made available by the Digital Advertising Alliance. These tools may depend on cookies or the device and browser you use.

Opt-Out Preference Signals

Where required by applicable law, we recognize browser-based opt-out preference signals, including Global Privacy Control, as a request to opt out of certain processing for targeted advertising or the sale or sharing of personal information for the browser or device that sends the signal.

Updating Your Information

You may contact us to update certain contact details or communication preferences.

12. Privacy Rights for U.S. Residents

Depending on your state of residence and subject to applicable exceptions, you may have the right to:

• Confirm whether we process your personal information;
• Access or obtain a copy of personal information we maintain about you;
• Correct inaccurate personal information;
• Delete personal information;
• Obtain personal information in a portable format;
• Opt out of the sale or sharing of personal information;
• Opt out of targeted advertising;
• Opt out of certain profiling in furtherance of decisions producing legal or similarly significant effects;
• Limit certain uses or disclosures of sensitive personal information, where applicable; and
• Receive equal service and pricing without unlawful discrimination for exercising your rights.

How to Submit a Request

You may submit a privacy request by emailing info@rauantiques.com.

Verification

We may need to verify your identity before fulfilling certain requests. Verification may require us to match information you provide with information already maintained in our records or to request additional information. We will use information collected for verification only for verification, security, fraud-prevention, and legal-compliance purposes.

Authorized Agents

Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require proof of the agent's authority and may contact you directly to verify your identity or confirm the request.

Response Timing

We intend to respond within the period required by applicable law. We may extend that period where permitted and, where required, will notify you of the extension. We may deny, limit, or ask for clarification of a request where an exception applies or where we cannot reasonably verify the request, and we will provide an explanation when required by law.

Appeals

If we deny your request and your state provides a right to appeal, you may appeal by emailing info@rauantiques.com with the subject line "Privacy Request Appeal." We will review and respond to the appeal as required by applicable law.

13. Additional Disclosures for California Residents

This section supplements the information above for California residents. The terms used here have the meanings assigned by the California Consumer Privacy Act, as amended ("CCPA").

Categories of Personal Information

In the preceding 12 months, we may have collected the following categories of personal information: identifiers; customer-record information; characteristics protected under applicable law when voluntarily provided or otherwise relevant; commercial information; internet or other electronic-network activity; approximate geolocation information; audio, electronic, visual, or similar information; professional information when relevant to an interaction; and inferences drawn from other information.

We collect these categories from you, your devices, service providers, advertising and analytics partners, transaction partners, public sources, and other sources described in this Policy.

Business and Commercial Purposes

We use these categories for the purposes described in Sections 3 and 4, including client service, transaction fulfillment, website operation, personalization, advertising, analytics, security, fraud prevention, recordkeeping, and legal compliance.

Categories Disclosed

We may disclose the categories listed above to the service providers, contractors, advertising and analytics partners, payment and logistics providers, professional advisors, authorities, and transaction participants described in Section 5.

Sale and Sharing

We do not sell personal information in exchange for money. Our use of certain advertising, customer-data, audience-building, and audience-matching technologies may be considered "sharing" for cross-context behavioral advertising and may also be considered a "sale" under the CCPA. The categories potentially shared for these purposes include identifiers, internet or electronic-network activity, approximate geolocation information, commercial information, and inferences.

You may opt out through our privacy preference center, through a recognized opt-out preference signal where required, or by contacting us.

Sensitive Personal Information

We do not use or disclose sensitive personal information for purposes that require a right to limit under the CCPA. We do not intentionally collect sensitive personal information beyond what is reasonably necessary for transactions, security, fraud prevention, legal compliance, or other permitted purposes.

Notice at Collection

At or before the point of collection, we provide notice of the categories of personal information collected, the purposes for collection or use, whether the information is sold or shared, and the applicable retention criteria. This Privacy Policy may serve as part of that notice when linked directly and conspicuously at the point of collection.

California Request Rights

California residents may request to know, access, correct, or delete personal information; request information about collection, use, disclosure, sale, or sharing; opt out of sale or sharing; and exercise other rights available under the CCPA. We will not discriminate against you for exercising these rights.

14. EEA and UK Privacy Rights

If you are located in the EEA or UK, and applicable law grants you these rights, you may request to:

• Access personal information we hold about you;
• Correct inaccurate or incomplete information;
• Delete personal information in certain circumstances;
• Restrict processing in certain circumstances;
• Object to processing based on legitimate interests or for direct marketing;
• Receive certain information in a structured, commonly used, machine-readable format;
• Withdraw consent at any time where processing is based on consent; and
• Complain to the relevant data protection authority.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Some rights are subject to legal limitations and exceptions.

To exercise a right, contact info@rauantiques.com. You may also lodge a complaint with the supervisory authority in the country where you live, work, or believe an infringement occurred. UK residents may contact the UK Information Commissioner's Office.

15. International Data Transfers

M.S. Rau is based in the United States. Personal information may therefore be transferred to, stored in, or processed in the United States and other countries whose data protection laws may differ from those in your country.

Where EEA or UK law applies and requires safeguards for an international transfer, we rely on an appropriate legal mechanism. Depending on the circumstances, that mechanism may include an adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful safeguard.

16. Accessibility

M.S. Rau is committed to providing a website experience that is accessible to a broad audience. We may use third-party accessibility tools and related technologies to support that effort. Some of those tools may process limited technical information, such as browser, device, interaction, or accessibility-preference information, as necessary to provide their functionality.

Information about our accessibility efforts and how to request assistance is available in our Accessibility Statement.

17. Children's Privacy

Our website and services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information online from children under 13 without legally required parental consent. If we learn that we have collected such information, we will take reasonable steps to delete it.

Parents or guardians who believe a child has provided personal information may contact us using the information below.

18. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, services, or legal obligations. When we make changes, we will revise the notice on the website or through another appropriate channel when required by applicable law.

Material changes will apply prospectively unless otherwise permitted or required by law.

19. Contact Us

For questions about this Privacy Policy or to submit a privacy request, contact: