--- title: Privacy Policy canonical_url: https://vasoriginals.com/en/legal/privacy last_updated: 2026-07-10T21:08:50.632Z --- # Privacy Policy ### Preamble This Privacy Policy describes how VAS (ڤاس) collects, uses, stores, and protects the personal data of individuals who access the VAS platform, submit inquiries, or complete acquisitions. VAS is a singular-ownership art marketplace operating in Cairo, Arab Republic of Egypt. The platform is privately held and operated as a sole proprietorship. It has no advertising partners, no affiliate data arrangements, and no commercial relationship with any third party that involves the sale, sharing, or licensing of collector personal data. This policy is governed by and constructed in compliance with the Egyptian Personal Data Protection Law (Law No. 151 of 2020) and its implementing regulations. Where applicable Egyptian legislation establishes obligations on data controllers, VAS accepts and applies those obligations in full. By accessing the VAS platform, submitting a request to acquire, or completing a purchase, the individual acknowledges that they have read and understood this Privacy Policy. --- ### 1. The Data Controller The data controller in respect of all personal data collected through the VAS platform is: **VAS (ڤاس)** Art Marketplace and Consignment Platform Cairo, Arab Republic of Egypt All data-related correspondence is directed to the curator contact channel published on the platform. --- ### 2. Data VAS Collects VAS collects only the personal data that is necessary for the operation of the platform, the fulfillment of acquisitions, and compliance with Egyptian law. VAS does not collect data speculatively or for purposes beyond those stated in this policy. **2.1 Data Collected at Checkout (Self-Serve Acquisitions)** When a Collector completes a self-serve purchase (works priced below 10,000 EGP), the following data is collected: - Full name - Email address - Delivery address within Cairo - Payment details — processed exclusively by Paymob and not stored by VAS (see Section 6) **2.2 Data Collected via Request to Acquire (Curator Close and White-Glove)** When a Collector submits a Request to Acquire form (works priced at 10,000 EGP or above), the following data is collected: - Full name - Contact telephone number - Email address - Any additional details voluntarily provided in the inquiry form **2.3 Data Collected During Curator Correspondence** During the acquisition process managed by the VAS curator, additional data may be provided by the Collector, including: - Preferred delivery address - Bank account or InstaPay details (for refund processing, where applicable) - Any communication preferences or accessibility requirements stated by the Collector **2.4 Data Collected Automatically** When the Collector accesses the VAS platform, the following data is collected automatically through standard web analytics: - IP address (anonymised after 24 hours) - Browser type and version - Device type (desktop, mobile, tablet) - Pages visited and time spent on each page - Referral source (how the visitor arrived at the platform) This data is used solely for platform performance analysis and security monitoring. It is not linked to individual identities and is not used for any form of personalised targeting. **2.5 Data VAS Does Not Collect** VAS does not collect: - Financial data beyond what is necessary to process a refund (and this is only collected where a refund is applicable) - Sensitive personal data categories as defined under Egyptian law, including political opinions, religious beliefs, racial or ethnic origin, or health data - Data from individuals under the age of 18 - Data through third-party social media plugins embedded on the platform --- ### 3. How VAS Uses Personal Data VAS uses personal data for the following specific purposes, each of which has a defined legal basis: **3.1 Fulfillment of Acquisitions** Legal basis: Performance of a contract. VAS uses the Collector's name, email address, and delivery address to process the acquisition, confirm the order, arrange delivery, and issue the Certificate of Authenticity. This data is essential to the transaction and cannot be withheld without preventing fulfillment. **3.2 Curator Communication** Legal basis: Performance of a contract. For Curator Close and White-Glove acquisitions, VAS uses the Collector's contact details to facilitate the personal acquisition process — including viewing coordination, payment confirmation, delivery arrangement, and post-acquisition follow-up. **3.3 Refund and Dispute Processing** Legal basis: Performance of a contract; compliance with legal obligations. Where a refund or dispute is initiated under the VAS Acquisition Policy, VAS uses the Collector's contact details, acquisition record, and — where applicable — bank or payment account details to process the resolution. This data is retained for the duration of the dispute and for the legally required retention period thereafter. **3.4 Certificate of Authenticity Issuance and Archival** Legal basis: Performance of a contract; legitimate interest. VAS issues a Certificate of Authenticity to the Collector upon each Confirmed Sale. The Collector's name and acquisition date are included on the Certificate as part of the formal record of ownership. VAS retains an archival copy of each Certificate in perpetuity as part of the provenance record for each work. This archival record is intrinsic to the platform's promise of singular ownership and cannot be waived. **3.5 Compliance with Legal and Tax Obligations** Legal basis: Compliance with legal obligations. VAS is required by Egyptian tax law to maintain records of transactions for a minimum of seven years. This includes the acquisition amount, VAT applied, and identifying information sufficient to satisfy audit requirements. These records are maintained securely and are not used for any purpose other than legal compliance. **3.6 Platform Security and Fraud Prevention** Legal basis: Legitimate interest. Automatically collected technical data (IP address, device type, browser) is used to monitor for fraudulent activity, bot traffic, and security vulnerabilities. This data is anonymised within 24 hours and is not retained in identifiable form beyond the immediate security function. **3.7 Optional — New Work Notifications** Legal basis: Consent. With the Collector's explicit consent, VAS may use the Collector's email address to send occasional notifications of new works entering the catalogue that align with the Collector's documented acquisition history. This communication is infrequent, curated by a human rather than an algorithm, and may be withdrawn at any time by the Collector with no consequence to their acquisition record or platform access. VAS does not send promotional emails, newsletters, or marketing communications of any kind without explicit opt-in consent. --- ### 4. Data VAS Does Not Do The following actions are categorically prohibited under VAS's data policy and will never occur: - VAS does not sell Collector personal data to any third party, under any commercial arrangement. - VAS does not share Collector personal data with advertising networks, data brokers, analytics platforms (beyond anonymised platform performance data), or any entity whose purpose is to use personal data for commercial gain. - VAS does not publish the identity of Collectors in connection with specific acquisitions without the Collector's explicit written consent. - VAS does not use Collector data to create profiles for the purpose of algorithmic targeting, behavioural advertising, or data modelling. - VAS does not transfer personal data outside the Arab Republic of Egypt except where required by law and with appropriate safeguards in place. - VAS does not use automated decision-making in any process that produces legal or similarly significant effects on Collectors. --- ### 5. Cookies and Tracking The VAS platform uses a minimal and purposeful cookie architecture. Cookies are categorised as follows: **5.1 Essential Cookies** Essential cookies are required for the platform to function correctly. They enable page navigation, secure session management, and checkout functionality. These cookies cannot be disabled without preventing the platform from operating. They do not collect personal data beyond what is necessary for platform function and are not used for tracking or analytics. **5.2 Analytics Cookies** Analytics cookies are used to understand how visitors interact with the platform — which pages are visited, how long sessions last, and where visitors arrive from. This data is collected in anonymised aggregate form. Analytics cookies are not activated without the Collector's prior consent via the cookie consent mechanism on the platform. VAS does not use: - Advertising or retargeting cookies - Social media tracking cookies - Third-party behavioural tracking cookies - Fingerprinting or device-tracking technologies The Collector may withdraw consent for analytics cookies at any time through the platform's cookie settings. Withdrawal of analytics cookie consent does not affect the Collector's access to the platform or their acquisition record. --- ### 6. Payment Data All payment processing for self-serve acquisitions (below 10,000 EGP) is handled exclusively by Paymob, VAS's designated payment gateway. Paymob is a PCI-DSS compliant payment processor operating under its own privacy and data security obligations. VAS does not at any point access, store, process, or transmit full card numbers, card security codes, or banking credentials. The only payment-related data retained by VAS is the transaction reference number and confirmed payment status, for the purposes of order fulfilment and tax record-keeping. For Curator Close and White-Glove acquisitions, payment is arranged by the curator through a secure method agreed with the Collector. Bank account or InstaPay details provided for refund purposes are retained only for the duration of the refund process and deleted upon confirmation of successful refund. --- ### 7. Data Sharing and Third Parties VAS shares personal data with third parties only in the following circumstances, and only to the minimum extent necessary: **7.1 Delivery Partners** The Collector's name and delivery address are shared with VAS's logistics and delivery partner for the sole purpose of completing the delivery of the acquired Artwork. Delivery partners are contractually prohibited from using this data for any other purpose. **7.2 Payment Processing** Transaction data is processed by Paymob under its own privacy policy and PCI-DSS obligations. VAS does not control Paymob's data practices beyond the scope of the processing agreement. **7.3 Legal and Regulatory Compliance** VAS may disclose personal data to Egyptian regulatory authorities, tax authorities, law enforcement, or courts where required by law, regulation, or court order. VAS will not disclose data beyond what is legally required and will, where legally permissible, notify the Collector of any such disclosure. **7.4 Platform Infrastructure** The VAS platform is hosted on Vercel (server infrastructure) and uses Cloudinary (image hosting). These providers operate under their own privacy and security policies. Neither provider accesses collector personal data beyond what is technically necessary for platform operation. **7.5 No Other Sharing** No other sharing of personal data occurs. VAS does not share data with the Artist in respect of the Collector's identity beyond what is necessary for the Artist to understand the provenance record of their sold work — and this sharing is limited to name and acquisition date on the Certificate of Authenticity only. --- ### 8. Data Retention VAS retains personal data for the following periods: **Acquisition records (name, contact details, delivery address, transaction reference):** Retained for seven years from the date of the Confirmed Sale, in compliance with Egyptian tax and commercial record-keeping obligations. After seven years, all personally identifiable data is permanently deleted. **Certificate of Authenticity records (name, acquisition date, work details):** Retained in perpetuity as part of the permanent provenance archive. This retention is a structural commitment of the platform — it cannot be waived — as the Certificate forms part of the legal record of singular ownership. **Curator correspondence:** Retained for three years from the date of the last communication, after which it is permanently deleted. **Analytics data:** Anonymised within 24 hours of collection and retained in aggregate, non-identifiable form for up to 24 months. **Payment data:** Transaction references retained for seven years. No card or banking credentials are retained by VAS. **Dispute and claim records:** Retained for three years from the date of resolution of the dispute. **New work notification consent:** Retained until withdrawn by the Collector, at which point it is deleted within 30 days. --- ### 9. The Collector's Rights Under Egyptian Law Under the Egyptian Personal Data Protection Law (Law No. 151 of 2020), the Collector holds the following rights in respect of their personal data: **9.1 Right of Access** The Collector has the right to request confirmation of whether VAS holds personal data relating to them, and to receive a copy of that data in a structured, legible format. Requests are fulfilled within 30 calendar days. **9.2 Right of Rectification** The Collector has the right to request the correction of any inaccurate or incomplete personal data held by VAS. Corrections are applied within 14 calendar days of the request. **9.3 Right of Erasure** The Collector has the right to request the deletion of their personal data, subject to VAS's legal retention obligations. Where retention is legally required (e.g., tax records, Certificate of Authenticity archival), the data cannot be deleted; VAS will clearly communicate which data is subject to mandatory retention and the reason. **9.4 Right to Restrict Processing** The Collector has the right to request that VAS restrict the processing of their personal data in circumstances defined under Egyptian law — for example, while the accuracy of data is disputed, or where processing is unlawful but the Collector does not wish the data to be deleted. **9.5 Right to Withdraw Consent** Where processing is based on consent (specifically, new work notification communications), the Collector has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal. **9.6 Right to Object** The Collector has the right to object to processing carried out on the basis of VAS's legitimate interests, where the Collector believes their interests override VAS's. VAS will assess any such objection and cease processing unless VAS can demonstrate compelling legitimate grounds. **9.7 Exercising Rights** All rights requests are submitted via the curator contact channel (email). VAS will respond within 30 calendar days of receiving a valid, verifiable request. VAS will not charge a fee for reasonable rights requests. VAS may request verification of the Collector's identity before processing a rights request, to prevent unauthorised disclosure. --- ### 10. Data Security VAS applies technical and organisational measures proportionate to the sensitivity of the data held and the nature of the platform: - Platform access is restricted to authorised VAS personnel only. - All data in transit between the Collector and the platform is encrypted via HTTPS/TLS. - Paymob's PCI-DSS certification covers all payment-related data security. - Collector acquisition records are stored in access-controlled systems with audit logging. - VAS does not store personal data on unprotected local devices. - In the event of a data breach that is likely to result in risk to the Collector's rights and freedoms, VAS will notify the relevant Egyptian supervisory authority and — where required — the affected Collector, within the timeframe stipulated by Egyptian law. No data security system is impenetrable. VAS's commitment is to maintain a level of security appropriate to the data held and to act swiftly and transparently in the event of any security incident. --- ### 11. Children's Data The VAS platform is not directed at individuals under the age of 18. VAS does not knowingly collect personal data from anyone under 18. If VAS becomes aware that personal data from an individual under 18 has been collected, it will be deleted immediately. If the Collector becomes aware that a minor has submitted personal data through the platform, they are asked to notify VAS immediately through the curator contact channel. --- ### 12. Changes to This Policy VAS may update this Privacy Policy from time to time to reflect changes in the platform's data practices or in applicable Egyptian law. The updated policy will be published on the platform with a revised effective date. Material changes — meaning changes that significantly affect the Collector's rights or VAS's data use — will be communicated to known Collectors via email where VAS holds email contact details. Continued use of the platform following a material update constitutes acceptance of the revised policy. --- ### 13. Contact and Complaints All privacy-related requests, rights exercises, and complaints are directed to: **VAS Curator Channel** Contact via the platform's designated curator email or contact form. VAS will respond to all privacy inquiries within 30 calendar days. If the Collector believes that VAS has not adequately addressed their privacy concern, they have the right to lodge a complaint with the competent Egyptian supervisory authority responsible for personal data protection under Law No. 151 of 2020. ## Related links ### Site - [Home](https://vasoriginals.com/en) - [Gallery](https://vasoriginals.com/en/gallery) - [Artists](https://vasoriginals.com/en/artists) - [About](https://vasoriginals.com/en/about) - [Contact](https://vasoriginals.com/en/contact) ### Localization - [Arabic edition of this URL](https://vasoriginals.com/ar/legal/privacy) ### In this section - [Terms of service](https://vasoriginals.com/en/legal/terms) - [Refunds policy](https://vasoriginals.com/en/legal/refunds) ### Retrieval (machine-readable) - [LLMs index (plain text)](https://vasoriginals.com/llms.txt) - [Semantic sitemap (Markdown)](https://vasoriginals.com/sitemap.md) - [XML sitemap](https://vasoriginals.com/sitemap.xml)