Privacy Policy
S.Greenstein & Co Ltd
This policy sets out how S.Greenstein & Co Ltd ("we", "us", "our") collects, uses and protects personal data when you visit our website, visit our showroom, or purchase from us. We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Where we offer goods to, or monitor the behaviour of, individuals located in the European Union (EU) or European Economic Area (EEA) — for example, shipping to EU customers or running EU-targeted online advertising — we also process personal data as a controller under the EU General Data Protection Regulation (EU GDPR) (Regulation (EU) 2016/679), in accordance with Article 3(2). Throughout this policy, "GDPR" refers to both regimes unless stated otherwise; where they differ, this is noted.
Last updated: 27.8.2026. This policy replaces all earlier versions. We will update this page whenever our processing changes and will highlight material changes.
1. Who we are
Data controller: S.Greenstein & Co Ltd, company number 11843272, registered office at Lynwood House, 373-375 Station Road, Harrow, Middlesex, United Kingdom, HA1 2AW.
Contact for data protection queries: Saul Greenstein, saul@saulgreenstein.co.uk, 322 Grays Antiques Market, London W1K 5LP.
2. Information we collect
• Identity data: name, title, date of birth (where required for age verification or high-value sales)
• Contact data: address, email, phone number
• Financial and transaction data: order and payment details (card data is processed by our payment provider — we do not store full card numbers)
• Due diligence data: proof of ID and address, source-of-funds evidence, where required under money laundering rules for high-value transactions
• Item data: descriptions, photographs and valuations of items purchased, repaired or commissioned
• Technical and usage data: IP address, browser type, pages visited, via cookies (see section 6)
• Marketing preferences: how you like to be contacted and what you've consented to
3. How and why we use your information
UK GDPR requires us to have a valid lawful basis for every use of personal data. The table below sets out our main processing activities.
Purpose
What we process
Lawful basis (UK GDPR Art. 6)
Retention
Processing a sale or order
Name, contact details, delivery/billing address, order and payment details
Contract (Art. 6(1)(b))
6 years from end of tax year of sale (accounting requirements)
Customer due diligence / anti-money laundering checks
Proof of identity, proof of address, source-of-funds information, transaction records
Legal obligation (Art. 6(1)(c)) — Money Laundering Regulations 2017
5 years from the end of the customer relationship or the transaction, as required by the MLR 2017
Repairs, valuations, bespoke commissions
Contact details, item description, images of items, appointment records
Contract (Art. 6(1)(b))
6 years from completion of the work
Marketing communications
Name, email address, purchase history used to personalise offers
Consent (Art. 6(1)(a)), or soft opt-in under PECR reg. 22 for existing customers
Until you withdraw consent or unsubscribe
Website analytics and improving our service
Usage data via non-essential cookies (see Cookies section)
Consent (Art. 6(1)(a))
As set by the cookie's own duration; see cookie table
Security of premises and stock
CCTV footage where fitted, visitor logs
Legitimate interests (Art. 6(1)(f)) — crime prevention and stock security
30 days unless needed for an investigation
Responding to enquiries and complaints
Contact details and the content of your enquiry
Legitimate interests (Art. 6(1)(f)) / Contract where pre-contractual
2 years from resolution
4. Marketing communications
We will only send you marketing emails or texts if you have opted in, or if you are an existing customer and are being offered similar products under the PECR 'soft opt-in' — in which case we give you a clear chance to opt out at the point we collect your details and in every message we send.
You can withdraw consent or unsubscribe at any time using the link in any marketing message, or by contacting us using the details in section 1. We will stop sending marketing within a reasonable period of your request.
We do not sell personal data to third parties, and we will not use your data for marketing on behalf of third parties unless you have separately agreed to this.
5. Anti-money laundering and customer due diligence
As a dealer in high-value goods, we are subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. For cash transactions and certain other transactions above the relevant threshold, we are legally required to verify your identity and, where relevant, the source of funds, and to retain these records for at least five years. This processing is carried out under our legal obligation, not your consent, so it cannot be opted out of for transactions where the law requires it.
6. Cookies
Our website uses cookies and similar technologies. For UK visitors, this is governed by the Privacy and Electronic Communications Regulations (PECR); for visitors in the EU/EEA, the equivalent rules derive from the ePrivacy Directive as implemented in each member state's national law. Both regimes require the same core approach: strictly necessary cookies do not require consent because the site cannot function without them, and all other categories are switched off by default and only activate if you accept them through our cookie banner. You can change your choice at any time via the cookie settings link in the site footer.
Category
Purpose
Consent required?
Typical duration
Strictly necessary
Basket, checkout, security, load-balancing
No — exempt under PECR
Session
Analytics
Understanding how visitors use the site
Yes — opt-in via banner
Up to 24 months
Marketing / retargeting
Showing you relevant adverts elsewhere
Yes — opt-in via banner
Up to 12 months
Preferences
Remembering settings such as currency
Yes — opt-in via banner
Up to 12 months
Most browsers also let you block or delete cookies directly — see your browser's help pages for instructions. Blocking non-essential cookies will not affect your ability to browse or buy from the site.
7. Who we share your data with
We share personal data only where necessary, with:
• Payment processors and card acquirers, to take payment
• Delivery and courier companies, to fulfil orders (high-value items are typically sent via insured, signature-required services)
• IT, hosting and website service providers, under data processing agreements
• Insurers and valuers, where needed for repairs, insurance valuations or claims
• Regulators, law enforcement or HMRC, where we are legally required to report or disclose information (including under money laundering law)
We do not sell personal data. Any third party acting on our behalf is bound by a written contract requiring them to protect your data and use it only for the purpose we specify.
8. International transfers
Transfers from the UK: where any supplier we use (for example, a cloud hosting or email marketing provider) stores or processes data outside the UK, we ensure an adequate level of protection — for example, via the UK's International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, UK adequacy regulations, or equivalent safeguards.
Transfers from the EU/EEA: where we process personal data of individuals in the EU/EEA and that data is transferred outside the EEA (including to the UK, which the European Commission has recognised as adequate, or to other third countries), we rely on the European Commission's adequacy decisions, the EU Standard Contractual Clauses (SCCs) approved by the European Commission, or another safeguard recognised under Chapter V EU GDPR, together with a transfer impact assessment where required.
Details of the specific safeguards used for any transfer are available on request from the contact details in section 1.
9. How we keep your data secure
We maintain appropriate technical and organisational measures to protect personal data, including access controls, encryption of data in transit, staff training on data handling, and secure storage of physical due diligence records (e.g. locked, access-restricted filing for ID documents). We review these measures regularly.
10. Your rights
Under UK GDPR and EU GDPR alike, you have the right to:
• Access the personal data we hold about you
• Have inaccurate data corrected
• Ask us to erase your data, where there is no overriding legal reason for us to keep it (this does not apply to records we must keep for AML or accounting purposes)
• Restrict or object to certain processing, including direct marketing
• Receive certain data in a portable, machine-readable format
• Withdraw consent at any time, where consent is our lawful basis
These rights, and the one-month response timeframe (extendable by a further two months for complex requests), apply equally under UK GDPR and EU GDPR. We will not normally charge a fee for exercising them, and we may need to verify your identity before actioning a request.
If you are in the UK, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113. If you are in the EU/EEA, you have the right to complain to the supervisory authority in your own member state, regardless of where the alleged infringement took place.
11. Automated decision-making
We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on individuals without human involvement.
12. Children
Our products and website are aimed at adults. We do not knowingly collect personal data from children, and if we discover we hold data of this kind without appropriate parental consent, we will delete it.
13. Changes to this policy
We may update this policy to reflect changes in our practices or the law. The 'last updated' date at the top shows when it was last revised. Significant changes will be brought to your attention, for example via a notice on our website or by email.
14. Contact us and complaints
Questions, requests or complaints about how we handle your data should be sent to saul@saulgreenstein.co.uk or by post to 322 Grays Antiques Market, 58 Davies Street, London W1K 5LP. EU-based individuals may also contact our EU representative named in section 1. If you remain unhappy with our response, you have the right to complain to the ICO (UK) or your local supervisory authority (EU/EEA), as set out in section 10.