Privacy Policy

SCOPE

Welcome to the Sotheby's group of companies. This is the Privacy Policy of Sotheby's Inc, together with the wider Sothebys group of companies, details of which can be found here ("Sotheby's" or "we"). From its beginnings in 1744, Sotheby's has built its business on the trust of its customers, clients and visitors. We endeavor to understand their interests in art and design and, at the same time, protect their privacy. Those values remain essential to us even as we have grown into a global network of offices in approximately 40 countries. Sotheby's publishes this Privacy Policy to let you know how we collect, use, and disclose your personal information in the course of operating our business. It also describes your rights in relation to this information. In some circumstances, such as for certain events, we may provide additional information regarding our data practices. This Privacy Policy applies to any Sotheby's service, event, website, mobile application or other digital or non-digital service, and any hard copy (paper) form which provides a link to or refers to this Privacy Policy.

If you register with or transact on any of our apps or other group websites the relevant privacy policy will be linked to on such sites.

For those who reside in the United Kingdom, Switzerland or the European Economic Area, United Arab Emirates, Dubai International Financial Centre ("DIFC") and the Kingdom of Saudi Arabia, please see the end of this Policy for additional information regarding our practices. For California residents and residents of other US states that have enacted comprehensive privacy laws, please see the section titled "Additional Information for California and US Residents".

If you reside in mainland China or transact or consign there or use any of our Chinese apps, website or digital properties, please see the section below titled "Additional Information for China Customers" for additional information that applies to you.

And please note that the Sotheby's Watch Service website and services are available only to customers and clients in the United States, subject to the Watch Services Terms of Use.

INFORMATION SOTHEBY'S COLLECTS ABOUT YOU

Personal information is information, or a combination of pieces of information, that could reasonably allow you to be identified. As described in more detail below, we collect personal information about you from a variety of sources, including information we collect from you directly, information we collect about you from other sources, and information we collect automatically from you.

Information We Collect Directly From You

We collect information that you submit to us face to face, over the telephone, on a paper form, by email or online or provide to us on forms available on third party websites. The types of information that we collect directly from you include: personal details (e.g., name, date of birth, alias and/or avatar alias), contact details (e.g., phone number, email address, postal address), transaction information (e.g., bidding or purchase records, shipping details, information about items you purchase or wish to sell or consign), details about your collection, financial information (e.g., tokenized payment information in connection with your purchases, wire instructions, bank account or bank transfer details, digital wallet details and address), username and password, user ID, unique device ID, information on forms required for certain transactions (e.g. social security number), insurance details, and identification information (e.g. photo ID and proof of address).

We rely on the information you provide to us or that we collect or observe about your individual interactions with us, for example, if you attend a live event, sell or consign property, participate in one of our auctions or sales, become a client, register or bid online.

Information We Collect From Other Sources

We may collect information about you from external sources, including social media sites and data supplementation services. The types of information we collect about you from other sources include your public profile information, family relationships, organizational affiliations, results of verification checks, nature of your connection to an organisation, your source of wealth, whether you are subject to sanctions, a PEP or a family member or close associate of a PEP. We may work to expand our customer base by acquiring names, contact data, financial information, affiliations, and demographic information from other sources such as private companies, public registers, and social media sites, where permitted by law. We may also generate information such as appraisals, profiles, and a history of our relationships with you based on the information you have provided or that we have obtained from other sources, as permitted under applicable law.

Information We Collect Automatically

We may make video recordings of our auctions (including for security reasons and to monitor bidding), gallery spaces, and certain live events.

Live streaming of our auctions and certain events is available on our websites and on social media for certain auctions. Cameras and microphones recording images and sounds for live streaming focus primarily on auctioneers, presenters and our specialists but it is possible that background sound and images may be captured.

We use CCTV at our sales rooms and offices for the protection of our staff, our visitors and the property we sell.

We record calls made to our customer care and telephone bidding lines for quality assurance, compliance purposes, and recordkeeping purposes.

We may use common data collection technologies as you visit our websites or apps or interact with our emails. For example:

• Our logs gather date, time, information about your browser and system or device configuration, information about how you interact with our digital properties, and an IP address for all visitors to our sites.
• We use data collection technologies to collect information that indicates your individual interests in our websites, online platforms and apps, and your response to our emails, events, invitations and marketing campaigns.
• The Cookies and similar technologies on our digital platforms can also read and collect data about your browsers as you visit and interact with those platforms: please read our Cookie Policy for more detailed information about what cookies are, what kinds are used on our sites, and what choices you have. As described further in our Cookie Policy, we use these technologies to enable you to use our digital platforms, learn how you and others interact with our digital platforms, personalize the content on our digital platforms, and to deliver advertising based on your interests, including those inferred from your activities over time and across digital platforms operated by us and others and from your event acceptance and attendance.
• In general, our app will communicate data you provide about yourself, for example, registration, purchase, or bidding data, to our databases and systems. An app may, however, rely on other data collection technologies to recognize the device you use for viewing and to personalize your experience. If our app relies on additional data collection technologies that collect or use data about individual users, we will include additional notice either within the app or in a policy that accompanies it.
• We also use and allow certain other companies to use technologies that are similar to cookies (for example pixels and gifs) when we send you emails.

HOW SOTHEBY'S USES INFORMATION ABOUT YOU

Sotheby's uses data about you for the following purposes, as permitted by applicable law:

• To provide you with the requested services. For example, bidding, selling, valuation, storage, shipping, loans and loan referral, restoration and expert advice.
• To manage and assure the integrity of our auctions.
• To on-board you as a client, verify your identity and sources of wealth and to satisfy our know your client obligations, to enter into and fulfill contracts with you, to fulfill your orders and purchases, facilitate sales or consignments, provide the publications, catalogs, and information you request, to manage your account, enquiries and requests and your relationship with us.
• To identify products, services, and offers you may be interested in based on your transactions and interactions with us, including but not limited to consignments, bidding histories, payment histories and events attended.
• To where you consign or sell property with us, advertise and sell your property on any of our international and country specific apps, websites and digital properties.
• To send you information about upcoming auctions, events, types of property and content that you may be interested in.
• To improve and personalize based on your inferred interests from our website and services.
• To match online ads to your interests, arrange for Sotheby's and other companies' ads to reach you after you have left our sites, and help advertisers show you ads that are more relevant to your interests.
• To expand our online audiences.
• To provide, maintain, and protect our digital offerings.
• To monitor the performance of our websites, apps and digital properties and improve your user experience.
• To satisfy legal obligations and compliance requirements under laws and regulations applicable to Sotheby's Inc, and members of the wider Sothebys group of companies (both within your jurisdiction and internationally). For example, know your client, to check and verify your identity and to protect against the risk of fraud and to detect and prevent money laundering or other financial crime.
• To carry out anti money laundering checks, risk screening, crypto wallet and transaction screening and monitoring and blockchain analytics.
• To create and maintain records of art objects to assist us (and in the case of our public records including our online lot pages and online and printed catalogues to assist the public) with checks on authenticity, provenance, title and object value and to prevent fraud, theft or other unlawful activities.
• To provide you (where required) with a digital wallet to enable you to receive an NFT that you have purchased.
• To identify an alternative third party auction or sale house where your property does not meet our requirements or is not suitable for consignment with or sale by us. In the event you choose to consign or sell your property with such third party auction or sale house such third party will provide us with details of any sale to enable us to confirm and audit any introductory commission that may be due to us.
• To protect and defend our rights and property, you, or third parties.
• To keep you, our staff and property on our premises secure.
• To comply with legal obligations and regulations to which Sotheby's Inc and/or the wider Sothebys group of companies are subject and cooperate with regulators, other appropriate agencies or authorities and law enforcement bodies, both within your jurisdiction and internationally.
• To develop, improve and test certain of our products and services.
• To monitor the use of our services, train our staff and improve your client or your user experience and to enhance or improve our platforms, digital offerings and our services. For example, through survey, interview or market research.
• For other purposes that we tell you about specifically when you register or provide data about yourself to us.

HOW SOTHEBY'S DISCLOSES INFORMATION ABOUT YOU

Your personal information will be processed by the Sotheby's entity that initially receives it. We also share information within the Sotheby's group of companies for the purposes set out in this privacy policy. Details of these entities may be found here.

Sotheby's may disclose personal information to other companies or entities as follows:

• To business partners, service providers and vendors that work on our behalf to provide services such as property shipments, mailings, customer account and technology support, platform providers, secure payment processing, experts who help us authenticate or value your property, fraud prevention, digital marketing management, and data and property storage or warehousing. One such entity is Stripe who is a payment processor. For details of how Stripe uses your personal information please see Stripe's privacy notice at https://stripe.com/privacy. Shopify is another service provider, which acts as platform provider for our Sotheby's wine website and at certain of our salon locations. For details of how Shopify uses your personal information please see Shopify's privacy notice at https://www.shopify.com/legal/privacy.
• To our auction or sales partners in association with auctions or sales. For example, when we offer auctions or sales with our group or third-party partners, we may share auction or sale related data with those partners subject to the privacy policy or policies made available to you when registering for or bidding in association with the auctions or sales.
• To consigners, sellers, buyers, customs authorities and others as needed to facilitate a consignment, sale or purchase, including to arrange the collection, delivery or shipment of property.
• To organizations we partner with to host events and those who are involved in such events such as caterers and the event venues.
• To digital wallet and cryptocurrency providers as required to complete your sale or purchase. Please see their privacy policies for details of how they use your personal information. Note that as part of the process of minting NFTs, your digital wallet details will be made available on the public blockchain to enable the NFT to be made available to you and will be a permanent record of the transaction, along with the details of the NFT's you purchase.
• To law enforcement or other entities that present valid legal process or in our discretion, unless otherwise prohibited by law, to protect human safety, our rights, or the rights of others.
• To meet certain legal compliance requirements, for example under anti-money laundering laws or customs laws and regulations.
• To US, UK, EU, Asian and other domestic and overseas regulators, law enforcement agencies and authorities and other appropriate agencies or authorities in connection with their duties, such as preventing, investigating or detecting crime or to conduct money and trade sanction checks and to meet our compliance, legal and health and safety obligations.
• To identity checking and verification, AML, fraud and risk screening services, including for sanctions and/or negative media purposes. One such provider is Refinitiv Limited who check your data against various public data sets. Please see their World-Check privacy policy here for details of how Refinitiv uses your personal information. Some of these screening services, such as Chainalysis Inc, may aggregate your data (such as cryptocurrency hashes and output addresses which are available publicly and user IDs) with their datasets to enable illicit activity to be identified. Further details can be obtained from Chainalysis' website here.
• To an alternative third party auction or sale house where your property does not meet our requirements or is not suitable for sale by us to identify if you would like to consign or sell certain items with such third party.
• As part of a sale, merger, liquidation, or transfer of our business assets.
• We may share information with digital advertising and analytics firms so that they may recognize your devices and deliver interest-based content and advertisements to you. The information we share may include your name, postal address, email, device ID, or other identifier. These firms may collect additional information from you, such as your IP address and information about your browser or operating system; may combine information about you with information from other companies in data sharing cooperatives in which we participate; and may place or recognize their own unique cookie on your browser. To learn about certain choices you may have with regard to such sharing, please see our Cookie Policy or click here.
• We may disclose information about you to Sotheby's International Realty, a company outside of the Sotheby's corporate group and a business partner that we coordinate our activities with from time to time

All of these recipients and third parties may be located outside of the UK, the EEA and Switzerland, including the US, and potentially in any country in the world.

YOUR CHOICES

You have a choice about and control over:

• Receiving marketing messages from us. We may contact you by email, text, or SMS messaging. You may stop email marketing by using the "opt out," or "unsubscribe" mechanism at the bottom of our email marketing messages. In most cases, we will give you a choice about stopping just one kind of email or opting out of all email marketing from us.
• Whether cookies can be set or read on your browser. You can learn more about controlling cookies placed on your device as you visit our sites in our Cookie Policy.
• Whether your account is up to date. You may review and edit the personal information that is stored in your user account on our website (e.g., your passwords and other contact information) by visiting the "Profile" area of your account on our website or by contacting Sotheby's via the email address at the end of this Policy. We will endeavor to respond to your request as soon as practicable. Before we are able to provide you with any information, correct any inaccuracies, or delete any information, however, we may ask you to verify your identity and to provide other details to help us to respond to your request.

INFORMATION SECURITY AND STORAGE

Sotheby's is a global company. We receive data collected locally by members of the Sotheby's group and collect data online directly from individuals in countries around the world. Sotheby's may in the normal course of its business transfer your personal information internationally to Sotheby's salesrooms, offices and representatives, and to other organisations who need to process your data in connection with the services that Sotheby's provides. We may process that data on servers globally. Your data will also be held on our servers in the USA. We have put recognized protections in place for the transfer of data from members of the Sotheby's group in the UK, the EEA and Switzerland to regulate the processing of personal data outside of these countries.

We protect your information using physical, technical, and administrative security measures to reduce the risks of loss, misuse, unauthorized access, disclosure, and alteration. Please be aware, though, that no security measures are perfect or impenetrable. You remain responsible for protecting your username and password and for the security of information you transmit to us over the Internet.

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:

• Maintain business records for analysis and/or audit purposes.
• Comply with record retention requirements under the law or other relevant legal or regulatory requirements.
• Defend or bring any existing or potential legal claims.
• Deal with any complaints regarding the services.
• Preserve historical records of transactions and property.

We will delete your personal information when it is no longer required for these purposes.

CHILDREN'S DATA

Our websites are directed to adults. We do not accept children as clients or knowingly collect data about them.

THIRD PARTY WEBSITES

Our websites may contain links to other websites not owned or controlled by Sotheby's. Those websites may collect information about you. Sotheby's is not responsible for their practices or content.

Additionally, we may work with auction partners so that you can bid on Sotheby's items from other sites or platforms. If you participate in an online auction on another company's site or platform, please note that those companies may transfer data about you to us to fulfill successful bids and that we may use that data in a manner consistent with this Policy. Please note that if you use another company's auction site, you should review the posted privacy policy applicable to that site.

Your Rights

You may ask us if you have questions about the data we hold on you. Under certain circumstances, subject to local law requirements, you may have rights under data protection laws applicable to your personal data. These may include a right to a copy of your personal information, to correct it, erase it, restrict our use of it, or to transfer it to other organizations at your request subject to local law. You may also have rights to object to some processing and, where we have asked for your consent to process your data, to withdraw this consent. Please contact us at privacycompliance@sothebys.com if you wish to exercise any of the rights that apply to you and your personal data.

For residents of:

• California or residents of other US states that have enacted comprehensive privacy laws please see the section below titled "Additional Information for California and US Residents"
• EU, UK, Switzerland, United Arab Emirates, Dubai Financial Centre ("DIFC") and Kingdom of Saudi Arabia please see the section below titled "Additional Information for EU, UK, Swiss, UAE, DIFC and Kingdom of Saudi Arabia Residents"
• China please see the section below titled "Additional Information for China Customers"

CONTACT INFORMATION

Sotheby's designated contact for privacy-related matters including requests about your personal information is:

UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. Any changes will be posted on our website and we will notify you if there are any material changes. The date of the most recent update is shown at the top of this Policy.

Additional Information for California and US Residents

For California residents and residents of other US states that have enacted comprehensive privacy laws, we provide additional information about our privacy practices. This section supplements the information contained in the rest of our Privacy Policy.

Categories of Personal Information We Collect

We may collect the following categories of personal information about you:

• Identifiers: name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers
• Personal information categories listed in the California Customer Records statute: name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information
• Protected classification characteristics under California or federal law: age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex, sexual orientation, veteran or military status, genetic information
• Commercial information: records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
• Biometric information: genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information
• Internet or other similar network activity: browsing history, search history, information on a consumer's interaction with a website, application, or advertisement
• Geolocation data: physical location or movements
• Sensory data: audio, electronic, visual, thermal, olfactory, or similar information
• Professional or employment-related information: current or past job history or performance evaluations
• Non-public education information: education records directly related to a student maintained by an educational institution or party acting on its behalf
• Inferences drawn from other personal information: profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

Sources of Personal Information

We collect personal information from the following categories of sources:

• Directly from you
• From third parties (including our business partners, affiliates, vendors, and service providers)
• From publicly available sources
• Through your interactions with our websites, mobile applications, and other digital platforms

Business or Commercial Purposes for Collecting Personal Information

We collect personal information for the business or commercial purposes described in the "How Sotheby's Uses Information About You" section above.

Categories of Third Parties With Whom We Share Personal Information

We may share your personal information with the categories of third parties described in the "How Sotheby's Discloses Information About You" section above.

Your Rights Under California Privacy Laws

California residents have the following rights under California privacy laws:

• Right to Know: You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months
• Right to Delete: You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you
• Right to Opt-Out of Sale or Sharing: You have the right to opt-out of the sale or sharing of your personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights

How to Exercise Your Rights

To exercise your rights described above, please contact us at privacycompliance@sothebys.com or call us at [phone number to be added].

We will need to verify your identity before processing your request. We may request additional information from you to verify your identity.

Additional Information for EU, UK, Swiss, UAE, DIFC and Kingdom of Saudi Arabia Residents

For residents of the European Union, United Kingdom, Switzerland, United Arab Emirates, Dubai International Financial Centre ("DIFC"), and Kingdom of Saudi Arabia, we provide additional information about our privacy practices under applicable data protection laws.

Legal Basis for Processing

We process your personal information on the following legal bases:

• Consent: Where you have given your consent to the processing
• Contract: Where processing is necessary for the performance of a contract with you
• Legal obligation: Where processing is necessary for compliance with a legal obligation
• Legitimate interests: Where processing is necessary for our legitimate interests or those of a third party
• Vital interests: Where processing is necessary to protect your vital interests or those of another person

Your Rights Under EU/UK Data Protection Laws

You have the following rights under applicable data protection laws:

• Right of access: You have the right to obtain confirmation that your personal information is being processed and to request access to your personal information
• Right to rectification: You have the right to have inaccurate personal information corrected
• Right to erasure: You have the right to have your personal information erased in certain circumstances
• Right to restrict processing: You have the right to restrict the processing of your personal information in certain circumstances
• Right to data portability: You have the right to receive your personal information in a structured, commonly used format
• Right to object: You have the right to object to the processing of your personal information in certain circumstances
• Right to withdraw consent: Where processing is based on consent, you have the right to withdraw your consent at any time

International Transfers

We may transfer your personal information to countries outside the EEA/UK/Switzerland. Where we do so, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

Complaints

If you have concerns about our processing of your personal information, you have the right to lodge a complaint with the relevant supervisory authority.

Additional Information for China Customers

For customers in mainland China, we provide additional information about our privacy practices under applicable Chinese data protection laws.

Cross-Border Transfer of Personal Information

Your personal information may be transferred to and processed in countries outside of China. We ensure that appropriate safeguards are in place for such transfers in accordance with applicable law.

Your Rights Under Chinese Data Protection Laws

Under applicable Chinese data protection laws, you have certain rights regarding your personal information, including the right to access, correct, and delete your personal information, subject to applicable law.

Contact Information for China

For privacy-related matters specific to China, you may contact us at privacycompliance@sothebys.com.