HENI is delighted to present The Beautiful Paintings, the revolutionary new artwork from Damien Hirst that blurs the boundaries between digital and physical art creation using generative and machine learning algorithms.

HENI Gallery - The Beautiful Paintings

Terms of Service

## This Privacy Notice and your rights

1\. This Privacy Notice describes how the HENI Group of businesses process personally identifiable information (“Personal Data”) in accordance with data protection laws.

2\. The HENI Group businesses to which this Privacy Notice applies (“we”,“us”,“our”) are:

• Prudence Cuming Associates Ltd, which is the Data Controller of Personal Data relating to that business (please contact [terms@pca.com](mailto:terms@pca.com)); and

• Heni Gmbh, which is the Data Controller of Personal Data relating to that business (please contact [terms@heni.com](mailto:terms@heni.com) ); and

• Pierce Protocols Ltd, which is the Data Controller of Personal Data collected and processed through all other websites, products and services provided within the Heni Group (unless a group company has its own privacy notice) (please contact [terms@heni.com](mailto:terms@heni.com)); To review the relevant privacy notices of any other group company or affiliated entities in the HENI Group of businesses please review the relevant website or contact us for further information.

3\. By visiting any HENI Group website or when completing any customer or client registration process with us and/or placing an order on our websites, you agree to be bound by the terms of this Privacy Notice, which also includes our Cookies Policy (see below).

4\. This Privacy Notice also applies more generally to and provides information for the benefit of a wider range of individuals on whom we process Personal Data, whether or not such individuals are our customers and clients, contacts, suppliers, contractors, or visitors to our websites or premises.

5\. Data protection laws generally provide individuals with rights in relation to the processing of their Personal Data. These include rights to information relating to such processing, to access to such Personal Data, to object to the processing, to rectify, erase, restrict and to port such Personal Data. You can seek to exercise any of these rights or make any other enquiry about our use of your Personal Data by contacting us at any time using the relevant Data Controller email address(es) above.

6\. Our aim always is to process Personal Data fairly, lawfully and transparently. However, if you are unhappy with the information provided in this Privacy Notice or have any broader questions or concerns please email the relevant Data Controller email address(es) above. If you remain dissatisfied you may raise your unresolved issues directly with the Information Commissioner’s Office (who can be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or via ico.org.uk).

## Personal Data we may collect from you

7\. When you want to register with or make purchases through any HENI Group website, we will ask you to input and we will collect Personal Data from you (such as your name, e-mail address, billing address, delivery address, telephone number, product selections, and payment information). This includes when you subscribe to receive newsletters or notifications, post comments on our websites or contact us using the ‘contact’ form on our websites.

8\. We may also collect information about where you are on the internet (e.g. the URL you came from, IP address, domain types like .co.uk and .com), your browser type, the country and telephone area code where your computer is located and the pages of our website that were viewed during your visit. We may collect this information even if you do not register with us.

9\. More generally, and subject to this Privacy Notice, we may also obtain Personal Data when you meet with us or correspond with us by email, post, telephone or any other method.

10\. Personal Data about you may also be collected from publicly available records or from other sources, including other affiliates of the HENI Group of businesses.

11\. We may also obtain Personal Data about you when we use video cameras and aerial UAVs for the purpose of creating video footage and photos relating to artworks. For example, whilst filming on location, members of the public may be captured in images/video footage. Any member of the public whose image is captured would be very distant and it is unlikely that they will be recognisable. In the event they are recognisable, we would blur them out of any edited footage.

## Security of your Personal Data

12\. We will treat all your Personal Data as confidential and will only disclose it to third parties outside the HENI Group in accordance with this Privacy Notice. We will keep Personal Data secure and fully comply with all applicable UK data protection and consumer legislation from time to time in place.

13\. The HENI Group will retain Personal Data for at least the length of time required for the specific purposes for which it is processed, as set out in this Privacy Notice, and for such additional periods as are required by law or in order to ensure best practice (including effective back-up systems).

14\. We will take all reasonable care, in so far as it is in our power to do so, to keep your Personal Data, and the details of your orders and payments secure, but in the absence of proven negligence on our part we cannot be held liable for any loss you may suffer if a third party procures unauthorised access to any Personal Data we process on your behalf.

## Processing and disclosure of your Personal Data

15\. The HENI Group will process your Personal Data for the following purposes or as otherwise set out in this Privacy Notice, on the basis that such processing is in our and/or your legitimate interests:

• for the purposes of negotiating or performing any contracts entered into between you, or some company to which you are affiliated, and any HENI Group business;

• to address any correspondence, comments or enquires made by you;

• to allow you to participate in interactive features on our websites, should you choose to do so, and to provide the services you request;

• to email you with HENI Group invites, newsletters and/or suggestions about products, services or content that may be of interest to you, where we have a legitimate interest to do so in compliance with data protection and privacy law and/or where you provided your consent. However, you may stop such notifications at any time by contacting our customer services team by emailing the relevant Data Controller email address(es) above using the word “unsubscribe” in the subject line or otherwise by opting out of the particular email in the manner described;

• for the effective management of the HENI Group of businesses in accordance with our legitimate interests, such as in group structuring and management, engaging suppliers, generating surveys and statistics, measuring performance and website usage, implementing service improvement and marketing plans, etc;

• disclosing your Personal Data to third parties outside the HENI Group of businesses for the purposes stated above, including on your behalf or in order to enforce or apply our Terms and Conditions, or to protect the rights, property, or safety of HENI Group businesses and our personnel, customers, or others. This may include exchanging information with other organisations for the purposes of fraud protection and credit risk reduction; and

• disclosing your Personal Data to any HENI Group business or affiliate, which means our subsidiaries, any ultimate holding company and its subsidiaries, or any affiliated person or business. In the event that the relevant Data Controller, as identified above, or its assets, are acquired by a third party, Personal Data held by us may also be one of the transferred assets.

• for the purpose of creating video footage and photos of artworks.

• disclosing your Personal Data to third parties outside the HENI Group of businesses for provenance and/or authentication purposes in relation to artworks sold on any Heni Group website.

• disclosing your Personal Data to named third-party organisations for marketing purposes, where we have your consent to do so, for example, if you ticked the relevant opt-in box on our websites or when contacted. In these instances, we will supply your Personal Data to the specific organisation(s) only.

16\. The HENI Group may also process your Personal Data, including disclosing such Personal Data to third parties, as required by virtue of any legal, regulatory or other obligation. For example, the HENI Group of businesses will from time to time be required to disclose Personal Data to external law firms, accountants and auditors, insurance brokers and underwriters.

17\. The HENI Group will process Personal Data in the course of receiving payments from our clients and customers, and when making payments to such persons and to other third parties. The payment methods used will include bank transfers (which will require account names, numbers and sort codes, and possibly other information) and debit or credit card transactions (though note that we do not retain card information and payments via card will be processed securely in accordance with the Payment Card Industry Data Security Standard (PCI DSS) to protect sensitive cardholder data by a payment services provider in accordance with paragraph 17 of this Policy).

18\. Financial transactions through all HENI Group websites will be handled through a payment services provider, for example Stripe or PayPal, with which you will deal directly. You can review the Stripe Privacy Notice at stripe.com. PayPal Privacy Notice at paypal.com. We shall share Personal Data with such payment services providers only to the extent necessary for the purposes of processing payments, and dealing with complaints and queries relating to such payments.

## Where we store and transfer your Personal Data

19\. The Personal Data which HENI collect from you and which we process for the purposes set out above may be transferred outside the European Economic Area (“EEA”) where appropriate and necessary in accordance with our legitimate interests. Personal Data may also be processed by HENI Group staff, or for one of our suppliers or agents, operating outside the EEA. Such persons or entities maybe engaged in, among other things, the fulfilment of your orders, the processing of your payment details or the provision of support services.

20\. If and when making such transfers outside the EEA we will take all steps reasonably necessary to ensure that your Personal Data is managed securely and in accordance with this Privacy Notice and relevant data protection law.

## Cookies Policy

21\. By visiting and interacting with any HENI Group website to which this Privacy Notice applies, you are agreeing to our use of cookies in accordance with this policy and the relevant website Terms of Use.

22\. Cookies are small files that are stored on your computer or internet-enabled portable device by the websites you visit. They are used to make websites work and to improve their efficiency, as well as to provide website usage information to the website owner. Cookies contain information such as the time that the current visit occurred, whether the visitor has been to the website before and what site referred the visitor to the web page.

23\. HENI Group websites use cookies to distinguish you from other users of the site, in order to help us to improve your user experience. Some cookies are essential for the functionality of the website and allow features to work correctly. Other cookies may collect information about how visitors interact with our site, for instance to show which pages are viewed mostly frequently.

24\. Google Analytics: we use this web analytics tool to anonymously track usage statistics to help us improve the user experience of our site. Like many services, Google Analytics uses first-party cookies to track visitor interactions as in our case, where they are used to collect information about how visitors use our site. We then use the information to compile reports and to help us improve our website. Google Analytics collects information anonymously; it reports website trends without identifying individual visitors. You can opt out of Google Analytics without affecting how you visit our site – for more information on opting out of being tracked by Google Analytics across all websites you use, visit this Google page: https://tools.google.com/dlpage/gaoptout.

25\. Vimeo cookies: HENI Talks embed videos from the official Vimeo channel. This channel may set cookies on your computer when you use the Vimeo service or visit a webpage with a Vimeo video. Some of the cookies will only be used if you use certain features or select certain preferences and some cookies will always be used. For more information on Vimeo’s cookie policy visit:[https://vimeo.com/cookie_policy](https://vimeo.com/cookie_policy).

26\. Twitter cookies: HENI Talks also embed a Twitter feed on our press page to show the latest tweets between us and our viewers. If you click through to Twitter they may use both session cookies and persistent cookies to better understand how you interact with their service. For more information on Twitter’s cookie policy visit: [https://twitter.com/en/privacy](https://twitter.com/en/privacy).

## Variations to this Privacy Notice

27\. We may vary the terms of this Privacy Notice from time-to-time. Please check this webpage regularly to ensure you are familiar with the current version as your Personal Data is subject to the Privacy Notice in effect at the time when you provided that information.

28\. This Privacy Notice will be governed by and construed in accordance with English law, and any disputes relating to this notice shall be subject to the exclusive jurisdiction of the courts of England.

Privacy Policy

**1\. This Privacy Notice and Your Rights**

This Privacy Notice describes how HENI Tech LLC (referred to as “Heni”,“we”,“us”or “our” in this Privacy Notice) processes personally identifiable information through your use of the websites, products and services we make available to you (together the “Services”). By using the Services, you agree to be bound by the terms of this Privacy Notice, which also includes our Cookies Policy (see below).

HENI Tech LLC is the controller and is responsible for the collection, processing and use of your Personal Data (as defined below). If you have any questions about this Privacy Notice , please contact us at: terms@heni.com.

It is important that you read this Privacy Notice together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing Personal Data (as defined below) about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements other notices and privacy policies made available by us. In the event of a conflict, the terms of this Privacy Notice shall apply.

To review the relevant privacy notices of any other group company or affiliated entities in the HENI Group of businesses (“HENI Group”) please review the relevant website or contact us for further information.

If you are using the Services from the European Union (“EU”) or the United Kingdom (“UK”), see our Notice to EU and UK data subjects in section 5 below for our legal bases for processing and transfer of your Personal Data.

**2\. Personal Data We may Collect From You**

When you want to register with, apply to purchase or make purchases through our websites to which this Privacy Notice applies (collectively, the “Website”) or when you subscribe to receive newsletters or notifications, post comments on the Website or contact us using the ‘contact’ form on our Website, or correspond with us by email, post, telephone or any other method, we may ask you to provide and may collect personally identifiable information from you, such as your first and last name, e-mail address, billing address, shipping address, telephone number, product selections, and payment information. We may also collect:

• Your wallet address or other information related to your digital wallet that may be considered Personal Data under certain data privacy laws; and

• Information required to comply with anti-money laundering (“AML”) laws and know-your-customer (“KYC”) requirements (including, but not limited to, your photographic identity, nationality, date of birth, address and place of birth);

We may also collect information about you as you navigate through and interact with our Service, including, but not limited to the URL of the website you visited prior to accessing our Website, IP addresses, your browser type, Ethereum address, wallet type, application programming interface (API)-key, network information regarding transactions the country and telephone area code where your computer is located, the pages of our Website that were viewed during your visit, and cookies and other data analytics described in Section 6 below. We may collect this information even if you do not register with us.

We may receive personally identifiable information about you from publicly-available records or from other sources, including other affiliates of the HENI Group that offer their products and/or services on our Service. In particular, MetaMask and other wallets provide us with your Ethereum address and certain other information you choose to share with MetaMask and other wallets. These third party companies may supply us with Personal Data. We may add this to the information we have already collected from you via our Service in order to improve it.

The personally identifiable information described in this Section is referred to in this Privacy Policy as “Personal Data”.

**3\. Security of your Personal Data**

We will treat all your Personal Data as confidential and will only disclose it to third parties outside the HENI Group in accordance with this Privacy Notice. We will keep Personal Data secure as necessary to comply with all applicable data protection and consumer protection requirements.

We will retain Personal Data for at least the length of time required for the specific purposes for which it is processed, as set out in this Privacy Notice, or in order to ensure best practices (including, for example, maintaining effective backup systems) and for such additional periods as necessary to comply with applicable laws.

**4\. Processing and disclosure of your Personal Data**

We will process your Personal Data for the following purposes or as otherwise set out in this Privacy Notice:

• to process your application to make purchases through our Website;

• to facilitate the creation of and secure your account on our Website;

• for the purposes of negotiating or performing any contracts entered into between you, or some company to which you are affiliated, and Heni;

• as required by virtue of any legal, regulatory or other obligation such as to comply with AML and KYC requirements;

• to address any correspondence, comments or enquires made by you;

• to allow you to participate in interactive features on our Website, should you choose to do so, and provide the Services you request, including but not limited to facilitating your cryptocurrency transactions through MetaMask or other wallets that may be available to use with our Services;

• to email you with HENI Group invites, newsletters and/or suggestions about products, services or content that may be of interest to you. However, you may stop such notifications at any time by contacting our customer services team by emailing our email address(es) using the word “unsubscribe” in the subject line or otherwise by opting out of the particular email in the manner described;

• for the effective management of the HENI Group such as in group structuring and management, engaging suppliers, generating surveys and statistics, measuring performance and website usage, and implementing service improvement and marketing plans;

• we will process Personal Data in the course of receiving payments from our clients and customers, and when making payments to such persons and to other third parties. The payment methods used will include bank transfers (which will require account names, numbers and sort codes, and possibly other information) and debit or credit card transactions (though note that we do not retain card information and payments via card will be processed securely in accordance with the Payment Card Industry Data Security Standard (“PCI DSS”) to protect sensitive cardholder data by a payment services provider);

• to manage our relationship with you which will include notifying you about changes to our Terms of Service or Privacy Notice;

• to administer and protect our business and Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data);

• to use data analytics to improve our Services, customer relationships and experiences; or

• any other way we may describe when you provide Personal Data.

We may share your Personal Data with the parties and for the purposes set out below:

• disclosing your Personal Data to third parties outside the HENI Group for the purposes stated above, including on your behalf or in order to enforce or apply our Terms of Service, or to protect the rights, property, or safety of HENI Group businesses and our personnel, customers, or others. This may include exchanging information with other organisations for the purposes of fraud protection and credit risk reduction;

• disclosing your Personal Data to third parties outside the HENI Group as required by virtue of any legal, regulatory or other obligation. For example, we will from time to time be required to disclose Personal Data to external law firms, accountants and auditors, insurance brokers and underwriters;

• disclosing your Personal Data to any HENI Group business or affiliate, which means our subsidiaries, any ultimate holding company and its subsidiaries, or any affiliated person or business. In the event that we or our assets, are acquired by a third party, Personal Data held by us may also be one of the transferred assets; and

• disclosing your Personal Data to third parties outside the HENI Group who need it to do work for us. These recipients may include third party companies and individuals who provide the Services on our behalf, such as operating our Website.

• disclosing your digital wallet address to third parties outside the HENI Group, such as secondary marketplaces, who need it to provide a service to you, where you have chosen to subscribe to their service.

Financial transactions through our Websites will be handled through a payment services provider, including Stripe or PayPal, with which you will deal directly. You can review the Stripe Privacy Notice at stripe.com. PayPal Privacy Notice at paypal.com. We shall share Personal Data with such payment services providers only to the extent necessary for the purposes of processing payments, and dealing with complaints and queries relating to such payments.

You may permit us to share your Personal Data with other companies or entities of your choosing including those companies or entities whose websites or services you can link to from our Website. Those uses will be subject to the privacy policies of the recipient entity or entities.

**5\. Notice to EU and UK data subjects**

This section of the Privacy Notice describes how we process Personal Data relating to individuals in the EU and the UK in accordance with:

• the EU General Data Protection Regulation ((EU) 2016/679) (“EU GDPR”) - in respect of individuals in the EU; and

• the retained EU law version of the EU GDPR that applies in the UK, along with the Data Protection Act 2018 (“UK GDPR”) – in respect of individuals in the UK,

the EU GDPR and the UK GDPR are referred to together as the “Data Protection Legislation”.

**Your rights**

The Data Protection Legislation generally provides individuals with rights in relation to the processing of their Personal Data. These include rights to information relating to such processing, to access such Personal Data, to object to the processing, to rectify, erase, restrict and to port such Personal Data. You can seek to exercise any of these rights or make any other enquiry about our use of your Personal Data by contacting us at any time using the email address above.

Our aim always is to process Personal Data fairly, lawfully and transparently. However, if you are unhappy with the information provided in this Privacy Notice or have questions or concerns regarding this Privacy Notice please email us at the email address above. If you remain dissatisfied you may raise your unresolved issues directly with the data protection regulator in your jurisdiction. You can find your data protection regulator here: https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

**Sensitive Personal Data**

Some of the information you provide us may constitute sensitive personal data as defined in the Data Protection Legislation (also referred to as special categories of personal data), including identification of your race or ethnicity on government-issued identification documents which we may collect as part of AML and KYC as explained above.

**Legal Bases for Processing**

We will only use your Personal Data as the law permits. We are required to inform you of the legal bases of our processing of your Personal Data. We have set out below a description of all the ways we plan to use your Personal Data, and which of the legal bases we rely on to do so.

Please note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data.

| Purpose | Lawful basis for processing |
| :----------------------------------------------------------- | :----------------------------------------------------------- |
| To provide our Services including to address any correspondence, comments or enquires made by you and to allow you to participate in interactive features on our Website, should you choose to do so | Performance of a contract with you Necessary for our legitimate interests |
| To process and deliver your purchase orders including to manage payments, fees and charges | Performance of a contract with you Necessary for our legitimate interests |
| To email you with HENI Group invites, newsletters and/or suggestions about products, services or content that may be of interest to you | Necessary for our legitimate interests Consent |
| For the effective management of the HENI Group such as in group structuring and management, engaging suppliers, generating surveys and statistics, measuring performance and website usage, implementing service improvement and marketing plans, etc | Necessary for our legitimate interests |
| To manage our relationship with you which will include notifying you about changes to our Terms of Service or Privacy Policy | Performance of a contract with you Necessary to comply with a legal obligation Necessary for our legitimate interests |
| To administer and protect our business and Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | Necessary for our legitimate interests Necessary to comply with a legal obligation |
| To use data analytics to improve our Services, customer relationships and experiences | Necessary for our legitimate interests |
| To comply with AML and KYC requirements | To comply with legal obligations |

**Change of purpose**

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to receive an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with this Privacy Notice, where it is required or permitted by law.

**Cross-Border transfer**

The Personal Data which we collect from you and which we process for the purposes set out in this Privacy Notice may be held and transferred outside the European Economic Area (“EEA”) where appropriate and necessary in accordance with our legitimate interests. Personal Data may also be processed by HENI Group staff, or by one of our suppliers or agents, operating outside the EEA. Such persons or entities may be engaged in, among other things, the fulfilment of your orders, the processing of your payment details or the provision of support services.

If and when making such transfers outside the EEA we will take all steps reasonably necessary to ensure that your Personal Data is managed securely and in accordance with this Privacy Notice and applicable Data Protection Legislation.

**6\. Cookies Policy**

By visiting and interacting with any Website to which this Privacy Notice applies, you are agreeing to our use of cookies in accordance with this Privacy Notice and the relevant website’s terms and conditions.

Cookies are small files that are stored on your computer or internet-enabled portable device by the websites you visit. They help websites improve their efficiency, as well as to provide usage information to the website owner. Cookies contain information such as the time that a website visit occurred, whether the visitor has been to the website before and what site referred the visitor to the web page.

We use cookies on our Website to distinguish you from other users of the site, in order to help us to improve your user experience. Some cookies are essential for the functionality of the Website and allow features to work correctly. Other cookies may collect information about how you interact with our site, including, for example, showing which pages are viewed mostly frequently.

Mixpanel: We collect personal information such as your email address and your user activity through the use of Mixpanel. Mixpanel helps us analyze usage patterns of our users. Mixpanel’s ability to use and share information is governed by the Mixpanel Terms of Use, available at https://mixpanel.com/terms , and the Mixpanel Privacy Policy, available at https://mixpanel.com/privacy. You can opt-out of Mixpanel’s services by clicking on the following link: https://mixpanel.com/optout.

Segment: Segment.io is a central service that allows us to more efficiently forward analytics data to our other data processors. To learn about the privacy practices of Segment please review https://segment.com/docs/legal/privacy. Please contact us if you want to opt-out from Segment.

**7\. How We Respond to Do Not Track Signals**

We do not currently respond to “do not track” signals or other mechanisms that might enable you to opt out of tracking on our Website. You can typically remove and reject cookies from the Services with your browser settings. Many browsers are set to accept cookies until you change your settings. If you remove or reject the cookies, it could affect how the Services work for you.

**8\. Children**

We do not knowingly collect, maintain, or use personal information from children under 13 years of age, and no part of our Service is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Notice, then you may alert us at the email provided above.

**9\. Third party links**

Our Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. This Privacy Notice does not apply to information collected through these third-party websites. We do not control these third-party websites and are not responsible for their privacy notices or policies. When you leave our Website, we encourage you to read the privacy policy of the website you are visiting.

**10\. Variations to this Privacy Notice**

We may vary the terms of this Privacy Notice from time-to-time. You are responsible for checking this webpage regularly to ensure you are familiar with the current version as your Personal Data is subject to the Privacy Notice in effect at the time when you provided that information.