Privacy Policy

Derfanil's Collections ("we", "us", "our"), a luxury gold jewelry house established in Geneva, respects your privacy and is committed to protecting the personal data you entrust to us. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the choices and rights you have.

This Policy applies to our website, our boutique retail services, online store, concierge and bespoke commissions, vault and storage services, and buy-back programmes. It is aligned with the EU General Data Protection Regulation (GDPR), the Swiss Federal Act on Data Protection (nFADP/FADP), and, for our customers in the Philippines and across Asia-Pacific, the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations.

Where we refer to "personal data" we mean any information relating to an identified or identifiable person. Where we refer to "special category" or "sensitive" data this includes the financial and identity-verification data described below.

Derfanil's Collections is the data controller for the personal data described in this Policy.

Controller: Derfanil's Collections — Rue du Rhône 12, 1204 Genève, Switzerland.

Privacy contact: privacy@derfanil-collections.com.

We are registered as a controller with the relevant supervisory authorities in Switzerland and, where applicable, in the European Economic Area.

We collect only the data necessary to provide our luxury services, comply with law, and keep our platform secure. Depending on how you interact with us, this may include:

• Identity data — full name, date of birth, passport or government-issued identity document details, nationality, and photographs (required for high-value purchases, precious-metal transactions, and buy-back).

• Contact data — postal and billing address, email address, telephone number, and delivery details.

• Account data — email address, password (securely hashed), purchase history, wishlist, and saved preferences.

• Financial & transaction data — payment method, billing details, purchase amounts, currency, order references, invoices, and, where required by law, source-of-funds information.

• Verification & KYC/AML data — identity documents, proof of address, source of funds, beneficial ownership, and compliance screening results. This is special category data subject to heightened safeguards.

• Technical data — IP address, browser type and version, device identifiers, time-zone settings, and cookies. See our Cookie Policy.

• Usage data — pages viewed, products browsed, time spent, click behaviour, and the referring URL.

• Communication data — enquiries via our contact form, support tickets, chat, and email correspondence.

• Marketing & preference data — your subscription choices and how you respond to our communications.

We process your personal data for the following purposes, relying on the legal bases described below:

• To provide and manage your orders, payments, delivery, and after-sales services (performance of a contract).

• To authenticate your account and keep your account and data secure (legitimate interest; performance of a contract).

• To verify identity and conduct anti-money-laundering (AML) and know-your-customer (KYC) screening, including screening against sanctions and watchlists, where required by Swiss and international law (legal obligation; legitimate interest).

• To run buy-back, appraisal, vault, and storage services (performance of a contract).

• To respond to enquiries, provide concierge support, and manage complaints (legitimate interest; performance of a contract).

• To send marketing communications, where you have opted in, including our heritage journal and bespoke commissions (consent).

• To comply with legal, tax, customs, and regulatory obligations (legal obligation).

• To monitor, analyse, and improve our website, products, and services (legitimate interest).

• To prevent and detect fraud, and to protect our and others' rights, property, and safety (legitimate interest; legal obligation).

• To establish, exercise, or defend legal claims (legitimate interest; legal obligation).

Where GDPR applies, we rely on the following legal bases:

• Consent — for marketing, optional profiling, and certain cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

• Performance of a contract — for order fulfilment, account management, and the services you request.

• Legal obligation — for bookkeeping, tax, customs, anti-money-laundering, sanctions, and identity-verification obligations.

• Legitimate interest — for security, fraud prevention, site optimisation, and support, balanced against your rights and interests.

• Vital interest — where necessary to protect the life or safety of a person.

Where processing is based on legitimate interest, you can object to it at any time unless we demonstrate compelling legitimate grounds that override your rights, or we need it to establish, exercise, or defend legal claims.

Because our products are high-value and are bought, sold, and traded across borders, we are required to verify the identity of our customers and to comply with anti-money-laundering and counter-terrorist-financing (AML/CTF) rules.

What we collect: identity documents (passport, national ID), proof of residence, date and place of birth, nationality, source-of-funds declarations, beneficial ownership information where applicable, and the results of sanctions, watchlist, and politically-exposed-person (PEP) screening.

Why: to prevent money laundering, terrorist financing, fraud, and to comply with our regulatory obligations in Switzerland and other jurisdictions where we operate.

Heightened safeguards: KYC/AML data is access-restricted, encrypted in transit and at rest, processed under a strict need-to-know principle, logged for audit, and retained no longer than required by law. It is never used for marketing. Where required we apply enhanced due diligence for higher-risk transactions or customers.

Your cooperation: we may not be able to complete a high-value transaction, buy-back, or certain services if you decline to provide the verification data required by law.

Automated decision-making: we may use automated systems to screen against sanctions and watchlists. You have the right to request human review of any automated decision that produces legal or similarly significant effects. In practice, a member of our compliance team reviews all verification outcomes before they affect you.

We do not sell personal data. We only share it with trusted parties who help us provide services, and only to the extent necessary, under appropriate contractual safeguards:

• Payment providers — Stripe and other payment processors (for card payments, Klarna BNPL, GCash, and BDO regional payments), who handle payment data under their own privacy policies.

• Identity & compliance partners — identity-verification, sanctions-screening, and AML service providers, where required for regulatory compliance.

• Delivery & logistics partners — insured couriers and shipping providers, who receive name, address, and contact details solely to deliver orders.

• IT & hosting providers — infrastructure, cloud hosting, email, and analytics providers who process data on our behalf.

• Professional advisers — auditors, accountants, insurers, lawyers, and regulators, where necessary.

• Group and business partners — where we expand, data may be shared within an affiliated group, always in accordance with this Policy.

• Legal authorities — where required by law, regulation, legal process, or to protect our rights and the safety of others.

We operate globally and your personal data may be transferred to, and processed in, countries outside the European Economic Area and Switzerland (including the United States, the Philippines, and other jurisdictions where our partners and group entities are based).

Where your data is transferred outside the EEA or Switzerland, we ensure an adequate level of protection is maintained by relying on recognised safeguards, such as:

• Adequacy decisions by the European Commission or the Swiss Federal Council (where the destination country is recognised as providing adequate protection).

• Standard Contractual Clauses (SCCs) / the EU–US Data Privacy Framework, supplemented where required by UK and Swiss Addendums.

• Binding Corporate Rules (BCRs) where applicable to our group.

Whenever we transfer data globally, we take steps to protect it with the same standards described in this Policy, and we will provide you with information about the safeguards in place upon request.

Depending on your location and the applicable law, you have the following rights:

• Right of access — to obtain a copy of the personal data we hold about you.

• Right to rectification — to correct inaccurate or incomplete data.

• Right to erasure ("right to be forgotten") — to request deletion of your data where no legal or contractual basis for retention exists.

• Right to restrict processing — to limit how we process your data in certain circumstances.

• Right to data portability — to receive your data in a machine-readable format and to transfer it to another controller.

• Right to object — to object to processing based on legitimate interest or to direct marketing.

• Right to withdraw consent — to withdraw consent to processing based on consent at any time.

• Right to lodge a complaint — to a supervisory authority (GDPR) or the National Privacy Commission (Philippine Data Privacy Act, RA 10173).

• Rights regarding automated decision-making — to request human review of automated decisions, as described in Section 6.

Where the Philippine Data Privacy Act applies, you additionally have rights to be informed, to access, to object, to correct, to erasure or blocking, to data portability, and to damages, as provided by RA 10173.

We will respond to your request within the timeframes prescribed by applicable law and will never charge a fee unless the request is manifestly unfounded or excessive.

We keep personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required or permitted by law.

• Account data — retained for as long as your account is active, plus a reasonable period after closure.

• Transaction & order data — retained for the statutory period required by tax, customs, and civil law (typically up to 10 years in Switzerland and the EU).

• KYC/AML data — retained for the minimum period required by anti-money-laundering law (commonly 5 to 10 years after the business relationship ends).

• Marketing data — retained until you unsubscribe or withdraw consent, and reviewed periodically.

• Contact & support data — retained for the duration of the enquiry plus a reasonable follow-up period.

When we no longer need your data, we delete or anonymise it securely. Hard copies are destroyed using secure shredding.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, including:

• Encryption in transit (TLS/HTTPS) and at rest for sensitive data, including passwords and payment data.

• Access controls based on the principle of least privilege, with role-based permissions.

• Multi-factor authentication for our administration and support personnel.

• Regular security reviews, vulnerability assessments, and audit logging.

• Staff training on data protection and confidentiality.

• Secure destruction of records at the end of their retention period.

While we take reasonable steps to protect your data, no method of transmission over the internet is 100% secure. We encourage you to use strong, unique passwords and to keep your account credentials confidential.

Our website uses cookies and similar technologies to provide, secure, and improve our services. These may include essential cookies (required for the site to function), analytics cookies (to understand usage), and, where you consent, marketing cookies.

We use a consent banner to obtain your preferences where required by law. You can adjust your cookie preferences at any time, and essential cookies cannot be disabled.

For full details, see our Cookie Policy, which forms part of this Privacy Policy.

Our services are designed for adults and are not directed to children under the age of 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with their personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will update the "last updated" date above and, where appropriate, notify you by email or by posting a prominent notice on our website.

This version was last updated on 1 September 2025.

If you have any questions about this Policy or how we handle your data, or to exercise any of your rights, please contact:

Derfanil's Collections — Data Protection Office.

Rue du Rhône 12, 1204 Genève, Switzerland.

Email: privacy@derfanil-collections.com.

For European / Swiss concerns you may contact your local supervisory authority. For customers in the Philippines you may contact the National Privacy Commission (www.privacy.gov.ph).