Last updated: October 2026
On this page · 25 sections
1. Data Controller and Contact
The 5000 YEARS platform (the “Platform”) is operated by 5000 YEARS AG, Grafenaustrasse 11, 6300 Zug, Switzerland (the “Company”, “we”, or “us”).
The Company is the data controller of the personal data processed in connection with the Platform. 5000 YEARS AG is registered in the Swiss commercial register under number CHE-226.173.689. For any question relating to this Privacy Policy or to the processing of your personal data, you may contact us:
- by e-mail: privacy@5000years.io (data protection requests) or contact@5000years.io (general enquiries)
- by post: 5000 YEARS AG, Data Protection, Grafenaustrasse 11, 6300 Zug, Switzerland
In this Privacy Policy, “User” or “you” means any person who visits or uses the Platform, including visitors, buyers, collectors, sellers, galleries and their representatives, and “personal data” means any information relating to an identified or identifiable natural person.
2. Scope of this Privacy Policy
This Privacy Policy explains how the Company collects, uses, discloses, stores and protects personal data when you access the website 5000years.io, its back-office (bo.5000years.io), any related applications, smart contracts, newsletters, events and communication channels, and when you contact us.
It applies to personal data of Users and of persons whose data are provided to us by Users (for example, employees of a gallery, artists, former owners mentioned in provenance records). This Privacy Policy does not apply to third-party websites, services, wallets, blockchains or marketplaces that may be linked to or accessible from the Platform. The Company is not responsible for the privacy practices of such third parties, and Users are invited to read their privacy policies.
Where a gallery or seller processes personal data of buyers for its own purposes (for example, invoicing, delivery, after-sale service, its own anti-money laundering obligations), that gallery or seller acts as an independent controller and is solely responsible for such processing.
3. Personal Data We Process
We process account, transaction, and artwork interaction data to provide marketplace, profile, and security services. This includes:
- account and profile data (name, email, role),
- transaction and artwork interaction data (listings, offers, provenance records),
- wallet addresses and on-chain activity linked to a User’s account,
- communications and support requests.
We process personal data in accordance with:
- EU GDPR,
- the Swiss Federal Act on Data Protection,
- applicable US privacy laws (including CCPA/CPRA where applicable).
In addition, depending on how you use the Platform, we may process the following categories of personal data:
Swipe sideways to view the full table →
| Category | Examples |
|---|---|
| Identification and contact data | first and last name, gallery or company name, job title, postal address, e-mail address, telephone number, country of residence, language |
| Account and authentication data | login, encrypted password, account settings, user role (buyer, gallery, seller, expert, administrator), account history |
| Professional and gallery data | gallery details, VAT and company registration numbers, bank details for invoicing, subscription plan, contract and invoices, signatory details |
| Identity verification (KYC) data | copy of identity document, date and place of birth, nationality, proof of address, beneficial owner information, sanctions and politically exposed person (PEP) screening results, where required by law or by our anti-money laundering policy |
| Transaction data | artworks bought, sold or listed, prices, offers, commissions, invoices, payment status, sale declarations by galleries, shipping country |
| Artwork and provenance data | images, descriptions, condition reports, scans, digital twins, provenance history, names of former owners, exhibitions, literature, vetting results and expert opinions |
| Blockchain data | public wallet addresses, transaction hashes, token identifiers, smart contract interactions, royalty payments |
| Communication data | e-mails, messages, support requests, feedback, survey answers, recordings of calls or video meetings where you have been informed beforehand |
| Technical and usage data | IP address, device and browser type, operating system, log files, pages visited, clicks, referral source, date and time of access, approximate location derived from IP address |
| Marketing data | newsletter subscriptions, marketing preferences, event registrations, interactions with our e-mails and social media pages |
We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health or sexual orientation) and ask Users not to provide them. Where such data are nevertheless provided by a User, the User is responsible for having a lawful basis to do so.
Providing certain personal data is necessary to create an account, subscribe, buy or sell on the Platform or comply with legal obligations. If you do not provide such data, we may be unable to provide the corresponding services.
4. Sources of Personal Data
We collect personal data:
- directly from you, when you create an account, subscribe, list or buy an artwork, contact us, register for an event or subscribe to our newsletter;
- automatically, through cookies, log files and similar technologies when you use the Platform;
- from galleries and sellers, who provide data about their staff, artists, artworks and provenance (including names of former owners);
- from public blockchains, which record wallet addresses and transactions;
- from third parties, such as identity verification and sanctions screening providers, payment providers, experts and vetting committee members, business partners, public registers and publicly available sources (press, auction records, websites, professional social networks).
A User who provides personal data relating to another person (for example, a former owner, an artist or an employee) confirms that it has the right to do so and that it has informed that person of this Privacy Policy, where required by law.
5. Purposes and Legal Bases
We process personal data only for the purposes below. Where the GDPR or UK GDPR applies, each purpose relies on the legal basis indicated. Under Swiss law, processing is carried out in accordance with the principles of the Federal Act on Data Protection, and is justified by your consent, an overriding private or public interest or the law, where required.
Swipe sideways to view the full table →
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and managing accounts, subscriptions and gallery spaces | Performance of a contract (Art. 6(1)(b)) |
| Listing, displaying and promoting artworks, digital twins and provenance records | Performance of a contract; legitimate interest in operating a curated marketplace (Art. 6(1)(f)) |
| Vetting artworks and verifying authenticity and provenance | Legitimate interest in the integrity of the Platform and protection of buyers; performance of a contract |
| Facilitating transactions, invoicing subscriptions, commissions and scans, collecting sale declarations | Performance of a contract; legal obligation (accounting and tax, Art. 6(1)(c)) |
| Minting NFTs and executing royalties via smart contracts | Performance of a contract |
| Identity verification, anti-money laundering, sanctions and fraud prevention | Legal obligation; legitimate interest in preventing fraud and protecting the Company |
| Customer support and communications | Performance of a contract; legitimate interest |
| Security of the Platform, logging and incident detection | Legitimate interest in IT security |
| Analytics and improvement of the Platform | Consent where required (cookies); otherwise legitimate interest |
| Newsletters, marketing, events and personalised advertising | Consent; legitimate interest for existing business customers, where permitted by law |
| Compliance with legal obligations and requests from authorities | Legal obligation |
| Establishing, exercising or defending legal claims, enforcing our Terms and contracts | Legitimate interest in protecting our rights |
| Corporate transactions (financing, merger, sale of assets) | Legitimate interest |
Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. Where processing is based on legitimate interest, you may object to it as described in section 12.
We may use anonymised or aggregated data, which no longer identify you, for any purpose, including statistics, market studies and the development of our services.
6. Blockchain, Wallets and NFTs
The Platform uses public blockchains to mint NFTs and digital twins and to execute royalties. By their nature, public blockchains are decentralised networks that the Company does not own, operate or control.
You acknowledge and accept that:
- wallet addresses, transaction hashes, token identifiers and transaction data recorded on a public blockchain are publicly visible, permanent and cannot be modified or deleted by the Company or by anyone else;
- your rights to rectification, erasure and restriction cannot be exercised with respect to data recorded on a blockchain; we will, however, delete or de-link the off-chain data that associate your identity with a wallet address, where legally possible;
- a wallet address may become linked to your identity by third parties through publicly available information, without the Company’s involvement;
- you should not record any personal data in on-chain metadata, token names or descriptions;
- the Company never has access to, stores or controls your private keys or seed phrases, and will never ask you for them. You are solely responsible for the security of your wallet.
The Company is not responsible for any loss, disclosure or misuse of data resulting from the operation of a blockchain, a third-party wallet, a smart contract vulnerability, a fork, a network attack or the loss of your private keys.
7. Cookies and Tracking Technologies
7.1 Use of Cookies
The Platform uses cookies and similar technologies to:
- ensure functionality and security,
- analyze usage (analytics),
- personalize content and advertising (with consent where required).
Cookies are small text files stored on your device. We use the following types:
Swipe sideways to view the full table →
| Type | Purpose | Consent |
|---|---|---|
| Strictly necessary | login, session, security, load balancing, storing your cookie choices | Not required |
| Analytics | measuring audience and use of the Platform (e.g. Google Analytics) | Required where the law so provides |
| Functional | remembering preferences such as language | Required where the law so provides |
| Marketing and social media | personalised advertising, social media plugins and sharing | Required |
Cookies are kept for a maximum of 13 months, after which your consent is requested again where required.
7.2 User Rights
Users may configure cookie preferences via:
- browser settings,
- the cookie banner displayed on first visit.
Blocking essential cookies may impair Platform functionality.
You may withdraw your consent at any time through the cookie settings link at the bottom of each page.
7.3 Third-Party Tools
The Platform may integrate:
- Google Analytics,
- social media plugins,
- blockchain analytics tools.
These are governed by third-party privacy policies.
Where such tools are used, data such as your IP address may be transferred to the providers concerned, including outside Switzerland and the EEA (see section 9). We configure these tools, where possible, to limit the data collected (for example, IP anonymisation). The Company is not responsible for the processing carried out by these third parties under their own responsibility.
8. Recipients and Processors
We do not sell your personal data. We share personal data only to the extent necessary, with the following categories of recipients:
- service providers acting on our behalf (processors): hosting and cloud providers, software developers and IT maintenance, e-mail and newsletter tools, analytics providers, identity verification and sanctions screening providers, customer support tools, scanning and digitisation partners. They are bound by contract to process data only on our instructions and to protect it;
- banks and payment providers (including Wise), for invoicing and payments;
- other Users, to the extent necessary for a transaction or for the display of artworks (for example, a gallery’s public profile, or buyer details transmitted to the gallery concerned to complete a sale);
- experts and members of the vetting committee, for the assessment of artworks and provenance, under a duty of confidentiality;
- professional advisers: lawyers, auditors, fiduciary, accountants and insurers;
- public authorities, courts and regulators, where required by law or to protect our rights, including the Money Laundering Reporting Office Switzerland (MROS) and tax authorities;
- potential acquirers, investors or successors, in the context of a financing, merger, acquisition or sale of all or part of our business, under a duty of confidentiality;
- public blockchains, for wallet addresses and transactions (see section 6).
The list of our main processors is available on request at privacy@5000years.io.
9. International Data Transfers
Personal data hosted on our production servers and databases are stored in Switzerland, with Infomaniak, a Swiss hosting provider. Personal data may be transferred to the following countries: member states of the European Union and the European Economic Area, the United Kingdom and the United States of America, and, for public blockchains, any country where network nodes are located.
Switzerland, the EU/EEA and the United Kingdom recognise each other as providing an adequate level of data protection. For transfers to the United States, we rely on the certification of the recipient under the Swiss-US and EU-US Data Privacy Frameworks where available, or on the standard contractual clauses approved by the European Commission and recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC), supplemented where necessary by additional safeguards.
In exceptional cases, personal data may be transferred without such safeguards where permitted by law, in particular where the transfer is necessary for the performance of a contract with you or at your request, for the establishment, exercise or defence of legal claims, or where you have given your explicit consent.
Data recorded on a public blockchain are replicated worldwide by the network itself; such replication is outside the Company’s control and is not a transfer carried out by the Company. You may obtain a copy of the safeguards used by contacting privacy@5000years.io.
10. Data Retention
We keep personal data only for as long as necessary for the purposes for which they were collected, then delete or anonymise them, subject to legal retention obligations and to the defence of our rights.
Swipe sideways to view the full table →
| Data | Retention period |
|---|---|
| Account and profile data | duration of the account, then 3 years after its closure |
| Gallery subscription contracts, invoices, accounting records and sale declarations | 10 years after the end of the financial year (Swiss Code of Obligations, art. 958f) |
| KYC and anti-money laundering records | 10 years after the end of the business relationship or the transaction |
| Artwork, provenance and vetting records | duration of the listing, then up to 10 years, as provenance records serve the traceability of artworks and the prevention of trafficking in cultural property |
| Communications and support requests | 3 years after the last exchange |
| Marketing data (prospects, newsletter) | until withdrawal of consent or unsubscription, or 3 years after the last contact |
| Cookies and technical logs | 13 months maximum (cookies); 12 months (security logs) |
| Data relating to a dispute | until the end of the dispute and the expiry of the limitation periods |
| Blockchain data | permanent, outside the Company’s control (see section 6) |
Where a longer period is required or permitted by law, or where data are needed to establish, exercise or defend legal claims, we may retain them for that longer period.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration or disclosure, taking into account the state of the art, the costs and the risks involved. These measures include encryption of data in transit, access restricted on a need-to-know basis, password protection, regular backups, logging and confidentiality obligations for our staff and service providers.
No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal data, the Company cannot guarantee absolute security. You are responsible for keeping your login credentials, devices and wallets secure and for informing us immediately at privacy@5000years.io of any suspected unauthorised use of your account. In the event of a data breach likely to result in a high risk to your rights, we will notify the competent supervisory authority and, where required by law, the persons concerned, within the legal deadlines.
12. Data Subject Rights
Subject to applicable law, Users may request access to, rectification, deletion, or portability of their personal data, and may object to or restrict certain processing.
For data access, deletion, or privacy enquiries, please contact our Data Protection team at privacy@5000years.io.
In particular, and subject to the conditions of applicable law, you have the right to:
- obtain confirmation of whether we process your personal data and a copy of them (access);
- have inaccurate or incomplete data corrected (rectification);
- have your data deleted (erasure), subject to section 6 for blockchain data;
- receive the data you provided in a structured, commonly used format, or have them transmitted to another controller (portability);
- object at any time to processing based on our legitimate interest, and to direct marketing without giving reasons (objection);
- obtain the restriction of processing in certain cases (restriction);
- withdraw your consent at any time, with effect for the future;
- lodge a complaint with a supervisory authority (see section 18).
Procedure. To protect your data, we may ask you to prove your identity before responding. We respond within one month (30 days under Swiss law), which may be extended where permitted by law given the complexity or number of requests. Requests are free of charge, unless they are manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or refuse to act on them.
Limits. These rights are not absolute. We may refuse or restrict a request, in particular where we must retain data to comply with a legal obligation (accounting, anti-money laundering), to establish, exercise or defend legal claims, to protect the rights of other persons (for example, confidential vetting opinions or the identity of other Users), where the request concerns data recorded on a blockchain, or where the law otherwise allows. Exercising the right to erasure or objection may make it impossible to continue providing certain services.
13. Automated Decisions and Profiling
The Company does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Curation, vetting, content moderation and account decisions are taken through human review. We may use limited profiling, for example to adapt content or advertising to your interests, subject to your consent where required, and automated screening tools to detect fraud or sanctions risks, whose results are reviewed by a person.
14. Minors
The Platform is reserved for persons aged 18 or over. We do not knowingly collect personal data from minors. If we learn that a minor has provided personal data, we will delete them and close the account. Parents or guardians may contact us at privacy@5000years.io.
15. Marketing Communications
We send newsletters and marketing communications only with your consent or, where permitted by law, to existing business customers about similar services. Each message contains an unsubscribe link, and you may unsubscribe at any time by writing to privacy@5000years.io. Unsubscribing does not affect service messages relating to your account, subscription, invoices or transactions.
16. Your Responsibilities and Data of Third Parties
You are responsible for the accuracy of the personal data you provide and for keeping them up to date. Galleries and sellers that upload data relating to third parties (staff, artists, former owners, collectors mentioned in provenance records) warrant that they have collected and transmitted these data lawfully, that they have informed the persons concerned where required, and that the publication of these data on the Platform does not infringe any right.
You agree to indemnify and hold the Company harmless from any claim, loss, fine or cost (including reasonable legal fees) arising from personal data you provided in breach of applicable law or of this Privacy Policy.
17. Point of Contact for Users in the EU and the United Kingdom
The Company is established in Switzerland and has not designated a representative in the European Union or in the United Kingdom. 5000 YEARS AG, Grafenaustrasse 11, 6300 Zug, Switzerland, is the sole point of contact for all Users, wherever they are located, and for supervisory authorities, on any matter relating to the processing of personal data. Requests may be sent to privacy@5000years.io or contact@5000years.io, or by post to the above address, in English or French.
18. Supervisory Authorities
You may lodge a complaint with the competent supervisory authority, in particular in your country of residence, place of work or place of the alleged infringement:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch
- France: Commission Nationale de l’Informatique et des Libertés (CNIL), www.cnil.fr
- other EU countries: the data protection authority of your member state
- United Kingdom: Information Commissioner’s Office (ICO), www.ico.org.uk
We invite you to contact us first at privacy@5000years.io, so that we can try to resolve your request.
18.1 Swiss Federal Act on Data Protection (Switzerland)
The Company is established in Switzerland, and the Swiss Federal Act on Data Protection of 25 September 2020 (FADP / nLPD) and its Ordinance (DPO / OPDo) apply to all processing carried out by the Company. For Users located in Switzerland, the rights described in section 12 are exercised in accordance with the FADP, in particular the right of access (art. 25 FADP), the right to data portability (art. 28 FADP) and the right to have data rectified or deleted (art. 32 FADP). Access requests are answered within 30 days. The competent supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. Where the GDPR does not apply, the legal bases indicated in section 5 are to be read as the justifications provided for by the FADP (consent, overriding private or public interest, or law).
18.2 CNIL and GDPR Compliance (France)
For users located in France, personal data is processed in accordance with the General Data Protection Regulation (GDPR) and the guidance and recommendations issued by the French data protection authority (CNIL).
Users located in France may also give instructions regarding the storage, deletion and communication of their personal data after their death, in accordance with the French Data Protection Act.
19. Users in the United States and California
The Company does not sell personal data and does not share personal data for cross-context behavioural advertising within the meaning of the California Consumer Privacy Act, as amended by the CPRA (CCPA/CPRA), except where you have consented to marketing cookies, which you may refuse or withdraw at any time. Where the CCPA/CPRA applies, California residents have the right to know, access, correct and delete their personal information, to opt out of any sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Requests may be sent to privacy@5000years.io; we will verify your identity before responding. The categories of personal information collected, their sources, purposes and recipients are described in sections 3, 4, 5 and 8.
20. Users in the United Kingdom
For Users located in the United Kingdom, personal data are processed in accordance with the UK GDPR and the Data Protection Act 2018. The rights described in section 12 apply to them.
21. Limitation of Liability
To the maximum extent permitted by applicable law, the Company shall not be liable for any damage resulting from: (i) the processing of personal data by third parties acting under their own responsibility, including galleries, sellers, buyers, payment providers, wallet providers, social networks and analytics providers; (ii) data recorded on public blockchains or the operation of blockchains and smart contracts; (iii) unauthorised access to your account resulting from your failure to protect your credentials, devices or private keys; (iv) inaccurate or unlawful data
provided by Users; or (v) events beyond its reasonable control, including cyber-attacks despite appropriate security measures. Nothing in this Privacy Policy excludes or limits liability that cannot be excluded or limited under applicable law, in particular for wilful misconduct or gross negligence, nor the rights of consumers under mandatory law. The limitation of liability set out in the Terms and Conditions of Use applies in addition.
22. Changes to this Privacy Policy
The Company may amend this Privacy Policy at any time, in particular to reflect changes in the law, in our services or in our processing activities. The version published on the Platform, with its date of last update, is the version in force. Users will be informed of material changes by appropriate means (e-mail, banner or notification on the Platform). Where the law requires consent to a change, we will obtain it.
23. Relation to the Terms
This Privacy Policy forms an integral part of the Terms and Conditions of Use of the Platform. It also applies to gallery subscription contracts concluded with the Company. In case of conflict between this Privacy Policy and a specific data processing agreement signed with a User, the specific agreement prevails.
24. Governing Law and Jurisdiction
This Privacy Policy is governed by Swiss law, without prejudice to the mandatory data protection and consumer protection rules of the User’s country of residence. Subject to such mandatory rules, the courts of Zug, Switzerland, have exclusive jurisdiction.
25. Contact
For any question, request or complaint relating to your personal data: privacy@5000years.io or contact@5000years.io – 5000 YEARS AG, Data Protection, Grafenaustrasse 11, 6300 Zug, Switzerland.