Privacy notice

Who we are

Consortium Investments is the controller of your personal data. We run a members' club for the co-ownership of luxury items.

How to contact us

For any question about your data, or to make a request, email privacy@consortium-investments.com. We may need to check that the request comes from you before we act on it.

What we collect, why, and our lawful basis

• Your email address and account details. We use them to sign you in with a one-time code and to run your account. Basis: performing our contract with you (Art 6(1)(b)).
• Identity and address documents, date of birth and country of residence. We use them to check that you may join, and to confirm that you are old enough to take part in tobacco-related ownership. Basis: our legitimate interests in keeping the club to verified members (Art 6(1)(f)).
• Your name checked against sanctions lists. We screen members on joining and from time to time after. Basis: our legitimate interests, and compliance with financial sanctions law (Art 6(1)(c) and (f)).
• Your purchases, transfers, votes and payout notices. We keep these records to show who owns what. Basis: performing our contract with you (Art 6(1)(b)).
• Bank details you give us for a payout. We use them to tell the vendor where to pay you. Basis: performing our contract with you (Art 6(1)(b)).
• Security and service logs. We use them to keep the platform secure and working. Basis: our legitimate interests (Art 6(1)(f)).

Identity checks and biometric data

You can verify your identity in two ways, and both lead to the same decision. With the photo identity check, our verification partner compares a photo of your face with your ID document. That is biometric data, and we use it only with your explicit consent (Art 9(2)(a)). With document review, our compliance team reviews your documents by hand, and no biometric data is collected. If you choose document review, your application is unaffected. A member of our team makes every decision about your application. No check rejects an application by itself.

How long we keep it

• Images of your identity documents are deleted 30 days after we decide your application, or 12 months after if we refused it.
• The record of your identity checks is kept for as long as you are a member and for six years after, to deal with any legal claim.
• Records of ownership, transfers, votes and payouts are kept while we need them to show who owns what and to deal with legal claims, because other members' title depends on them.
• Service logs are kept for 15 days in our monitoring tool and one month in our hosting logs.

Who we share it with

We share data only where it is needed to run the platform: our hosting provider (Amazon Web Services), our identity verification and sanctions screening providers, our email provider, our monitoring provider (Datadog, which receives analytics data only if you accept analytics cookies), and the partner firm that sells or holds an item you own, for that item only. We do not sell your data.

Your rights

You have the right to see the data we hold about you, to have wrong data corrected, to have data erased where the law allows, to restrict or object to our use of it, and to take your data with you. Where we rely on your consent, you can withdraw it at any time. Some records must stay while the law needs them, and we will tell you which and for how long. To use a right, email privacy@consortium-investments.com.

Your right to complain

If you are not happy with how we use your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Cookies and analytics

We use one analytics cookie from Datadog (named _dd_s) to measure how the site performs. It is off until you accept it, and you can change your choice at any time. See our cookie notice.