Last updated: 22 August 2026
Who we are
Chrono6538 Ltd is a company registered in England and Wales, company number 12844120, with its registered office at Booths Hall, Booths Park, Chelford Road, Knutsford, WA16 8GS, United Kingdom. VAT registration number GB495892911. We trade as Chrono6538 and Chrono6538 Auctions.
We are the controller of the personal data described in this notice.
Contact for all privacy matters: email sales@chrono6538.com, or write to Data Protection, Chrono6538 Ltd, Booths Hall, Booths Park, Chelford Road, Knutsford, WA16 8GS.
This notice forms part of our Terms and Conditions of Sale.
What this notice covers
This notice applies to personal data we handle when you buy from chrono6538.com, create an account, contact us with an enquiry or valuation request, subscribe to our emails, or simply browse the site. If you bid in one of our auctions, the privacy notice at chrono6538.auction/privacy/ also applies.
What we collect
Identity and contact data. Name, billing and delivery address, email address, telephone number, and where you buy as a business, your company name, company number and VAT number.
Order data. Items viewed and bought, order and invoice numbers, delivery and export records, returns and correspondence about your purchase.
Payment data. Payment card details are captured and held by our payment processor, not by us. We see the transaction result, the last four digits and the card type.
Verification data. Where required, copies of passport or photographic driving licence, proof of address, and evidence of source of funds. We collect this because we are an art market participant under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and are required to carry out customer due diligence on higher-value transactions.
Account data. If you create an account: username, password (stored hashed, never in readable form), saved addresses and order history.
Communications data. Emails, messages, call notes, enquiry form submissions and complaint records.
Technical data. IP address, browser type and version, device information, time zone, operating system, and how you use the site. See the cookies section.
We do not deliberately collect special category data. Please do not send us health, biometric or similar information unless we specifically ask for it.
Why we use it, and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Taking and fulfilling your order, and managing your account | Performance of a contract |
| Verifying identity and running anti-money-laundering checks | Legal obligation |
| Taking payment, issuing invoices and recovering sums due | Performance of a contract; legitimate interests in recovering money owed |
| Arranging delivery, export, insurance and customs documentation | Performance of a contract; legal obligation |
| Handling cancellations, returns and refunds | Performance of a contract; legal obligation |
| Handling warranty and authenticity claims | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Preventing fraud, chargeback abuse and security incidents | Legitimate interests in protecting the business |
| Handling complaints, claims and disputes | Legitimate interests in defending and resolving claims |
| Sending marketing emails and stock alerts | Consent, or legitimate interests where you are an existing customer |
| Improving the site and understanding how it is used | Legitimate interests; consent for non-essential cookies |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and concluded they are not. You can ask us for the detail of that assessment.
Marketing
If you have bought from us or asked us about buying, we may send you stock alerts and details of pieces relevant to what you have shown interest in. Everyone else receives marketing only if they have opted in.
You can stop marketing at any time — click unsubscribe in any email, or email sales@chrono6538.com. Stopping marketing does not stop the operational emails we must send about an order you have placed.
Who we share it with
- Payment processors and our bank — to take payment and issue refunds
- Carriers, freight agents and insurers — Royal Mail Special Delivery, FedEx, DHL and similar, and our transit insurers, to deliver and insure your item
- Our website and email providers — hosting, WooCommerce, and our email sending platform
- Identity verification and credit reference agencies — for the checks described above
- Professional advisers — our accountants, solicitors and auditors, where they need it to advise us
- Law enforcement, HMRC, the National Crime Agency and regulators — where we are required to disclose. In some circumstances the law prevents us from telling you a disclosure has been made.
- A buyer of our business, if we ever sell it
We do not sell personal data, and we do not share it with anyone for their own marketing.
Sending data outside the UK
Where you ask us to ship internationally, or where a supplier we use is based overseas, your data may be transferred outside the United Kingdom. Where that happens we rely on UK adequacy regulations, the International Data Transfer Agreement or Addendum, or another safeguard permitted by the UK GDPR. You can ask us which applies to a particular transfer.
How long we keep it
- Anti-money-laundering records, including identity documents: five years from the end of our business relationship with you, as required by the 2017 Regulations. We delete them then, unless the law requires us to keep them longer.
- Accounting and tax records: six years from the end of the accounting period, as required by the Companies Act 2006 and HMRC.
- Order records: six years from the date of sale, matching the limitation period for a contract claim.
- Account data: until you ask us to close your account.
- Marketing preferences and suppression lists: until you ask us to remove you. We keep a minimal suppression record afterwards so we do not contact you again by mistake.
- Website analytics: 26 months.
Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have data erased, where we no longer need it and no legal obligation requires us to keep it
- restrict how we use it while a question about it is resolved
- object to our using it where we rely on legitimate interests, and to object to direct marketing at any time, absolutely
- receive certain data in a portable form
- withdraw consent at any time, where we rely on consent
Two honest limits. We cannot erase identity documents held under the money laundering regulations before the five years are up, because we are legally required to keep them. And we cannot erase records we need to defend a claim within the limitation period.
To exercise any right, email sales@chrono6538.com. We will respond within one month, at no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at https://ico.org.uk, by phone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you came to us first so we can put it right.
Cookies
Strictly necessary cookies keep you logged in, hold your basket and keep the site secure — these run without consent because the site cannot work without them. Analytics and marketing cookies run only if you accept them in our cookie banner. You can change your choice at any time through the banner, and you can block or delete cookies in your browser settings, though parts of the site may stop working if you block the necessary ones.
Changes to this notice
We update this notice when our practices change. The date at the top shows when it was last revised. Where a change materially affects you we will tell you by email.
Chrono6538 Ltd · Company number 12844120 · VAT GB495892911 · Registered in England and Wales
Booths Hall, Booths Park, Chelford Road, Knutsford, WA16 8GS