Data Protection Policy

Atsur Operations Ltd ("Atsur", "we", "us", "our") operates the Atsur provenance infrastructure platform — a system that combines physical artwork inspection, cryptographic identity verification, and blockchain anchoring to create tamper-proof authenticity and resale royalty records for African art and cultural heritage.

For the purposes of applicable data protection law, Atsur is the data controller in respect of personal data processed through the platform.

This Policy applies to personal data processed in connection with:

• Artist registration and artwork provenance recording;

• Buyer and collector accounts and ownership records;

• Gallery and marketplace partner API access and integration;

• Resale royalty calculation, routing, and payment records;

• Physical artwork inspection and identity verification processes;

• Use of the Atsur website, platform, and mobile applications;

• Communications with Atsur by any channel.

A note on blockchain data: some data recorded on-chain as part of the provenance anchor is permanent by design and cannot be deleted or amended. We address this directly in Section 10. We are committed to minimising the personal data recorded on-chain to only what is technically necessary for provenance integrity.

3.1 Artists

3.2 Buyers & Collectors

3.3 Gallery & Marketplace Partners

3.4 Website & Platform Visitors

When you visit the Atsur website or use the platform without creating an account, we may collect:

• IP address, browser type, device type, and operating system;

• Pages visited, time spent, and navigation patterns (via analytics cookies);

• Location data at country or city level (derived from IP address).

3.5 Represented Artists & Shadow Profiles

Where a gallery or authorised representative registers an artwork on behalf of an artist who does not yet hold an Atsur account, Atsur creates a limited placeholder record (a "Shadow Profile") to hold the registration and any accruing royalty entitlement until the artist claims their account.

Where a represented artist claims their account, the Shadow Profile is merged into a full Artist account and all data is thereafter processed in accordance with Section 3.1. Where a represented artist does not claim their account and Held Royalties are ultimately treated as abandoned, the Shadow Profile is retained for the minimum period required by law and then deleted, with the exception of any blockchain-anchored provenance records which are permanent by design.

We only process personal data where we have a lawful basis to do so. The table below maps our key processing activities to their legal basis under NDPR (Article 2.2), GDPR (Article 6), UK GDPR, and POPIA (Condition 2).

Legitimate Interests Assessment: Where we rely on legitimate interests as our lawful basis, we have assessed that our interests are not overridden by your rights and freedoms, having regard to the nature of the data, the reasonable expectations of data subjects, and the safeguards we apply. You may request a copy of our Legitimate Interests Assessment by contacting privacy@atsur.io.

We do not intentionally collect special category data (such as racial or ethnic origin, religious beliefs, health data, or biometric data used for unique identification) except in the following limited circumstances:

• Physical inspection photographs of artworks may incidentally capture the artist's face or likeness. These are processed solely for provenance documentation purposes and are not used for biometric identification. Where practicable, we will process only images of the artwork itself.

• Artists may voluntarily include information about their cultural background, ethnicity, or community affiliation in their professional biography. This is provided voluntarily and processed only for the purpose of the biography display.

Where special category data is processed, we rely on explicit consent (GDPR Article 9(2)(a); NDPR Article 2.2) and apply enhanced security measures.

6.1 Core Platform Services

• Creating and maintaining your Atsur account;

• Registering artworks and building their provenance records;

• Verifying artist identity and artwork authenticity;

• Calculating, routing, and recording resale royalty payments;

• Maintaining the blockchain-anchored provenance chain;

• Issuing and managing digital and physical certificates of provenance;

• Providing API services to connected gallery and marketplace partners.

• Administering Held Royalties: instructing licensed payment processors to hold unclaimed royalty amounts on an artist's behalf, maintaining the associated Held Royalties ledger, and processing claim notifications to unregistered or unconfigured artists.

• Creating and maintaining Shadow Profiles for artists registered by gallery partners who have not yet claimed their Atsur account, and issuing claim invitations to those artists.

6.2 Compliance & Legal Obligations

• Anti-money laundering (AML) and counter-terrorism financing (CTF) due diligence;

• Responding to lawful requests from regulatory authorities, courts, or law enforcement;

• Maintaining records required under Nigerian Copyright Act 2022 and other applicable law;

• Resolving disputes regarding artwork ownership or authenticity.

6.3 Platform Improvement & Analytics

• Understanding how users interact with the platform to improve functionality;

• Detecting and preventing fraud, security breaches, and unauthorised access;

• Developing new features and services.

6.4 Communications

• Sending transactional communications (royalty payment confirmations, provenance updates, account alerts, Held Royalty notifications, and claim invitations to unregistered artists) — these are necessary for the service and cannot be opted out of while you hold an account or have a pending Held Royalties balance;

• Sending marketing communications about Atsur products, events, and updates — opt-in only, withdrawable at any time.

7.1 Within Atsur

Personal data is accessible only to Atsur staff and contractors who need it to perform their role. All staff are bound by confidentiality obligations and receive data protection training.

7.2 With Connected Marketplaces & Gallery Partners

When you register an artwork on Atsur, the following data is made available to connected partners via the Atsur API:

• Artist name (as registered — may be a professional name);

• Artwork title, description, and provenance record;

• Royalty parameters (rate, wallet address for routing, threshold);

• Verification/authentication status.

Connected partners are bound by the Atsur Marketplace & Gallery Partner Terms (ATSUR-POL-003), which includes data protection obligations. Partners are independent data controllers in respect of their own customer data.

7.3 Service Providers (Data Processors)

We share personal data with trusted third-party service providers acting as data processors on our behalf. These include:

All processors are bound by data processing agreements requiring them to process data only on our instructions, implement appropriate security measures, and comply with applicable data protection law.

7.4 Blockchain — Public Ledger Disclosure

Important: The blockchain component of Atsur's provenance system operates on a public or semi-public distributed ledger. Data anchored on-chain — including wallet addresses and artwork hashes — may be publicly visible to anyone who can access the relevant blockchain. We minimise on-chain personal data to cryptographic references (hashes) and wallet addresses wherever technically possible. Full artwork records and personal identity data are stored off-chain in our secured database and referenced by hash. Artists should be aware that wallet addresses, while pseudonymous, can in some circumstances be linked to real-world identities. We recommend artists use dedicated wallets for Atsur royalty receipt.

7.5 Disclosures Required by Law

We may disclose personal data to law enforcement, regulatory authorities, or courts where required by applicable law, including the Nigerian Cybercrimes Act 2015, lawful court orders, and regulatory investigations. We will notify affected data subjects of such disclosures where permitted by law.

7.6 Business Transfers

In the event of a merger, acquisition, or sale of all or part of Atsur's business, personal data may be transferred to the successor entity, subject to the same data protection obligations. We will notify users of any such transfer.

Atsur is headquartered in Nigeria and processes data primarily within Nigeria. However, given the international nature of the art market, we may transfer personal data to countries outside Nigeria, including EU/EEA member states, the United Kingdom, and other jurisdictions where our service providers or partners operate.

For transfers outside Nigeria, we ensure appropriate safeguards are in place, including:

• Transfers to countries recognised by the NITDA as providing adequate data protection;

• Standard Contractual Clauses (SCCs) approved by the European Commission or UK ICO for transfers to non-adequate countries;

• Binding Corporate Rules where applicable;

• Your explicit consent in specific circumstances.

South African data subjects should note that transfers of their data outside South Africa are subject to Section 72 of POPIA and will only occur where adequate protection is in place.

9.1 General Principles

We retain personal data only for as long as necessary for the purposes for which it was collected, subject to legal obligations to retain data for specific periods.

9.2 The Blockchain Permanence Issue

Blockchain data cannot be deleted. This is a fundamental characteristic of distributed ledger technology and is essential to the integrity of the provenance record. To address the tension between blockchain permanence and data subject rights (including the right to erasure), Atsur applies the following approach:

• Only cryptographic hashes and pseudonymous wallet addresses are recorded on-chain — no names, contact details, or sensitive personal data;

• The off-chain database that links hashes to identifiable persons can be amended or deleted in response to valid data subject requests;

• Deleting the off-chain linkage effectively anonymises the on-chain record, satisfying the purpose of erasure even where the hash itself persists on the blockchain.

You have the following rights in relation to your personal data. These rights apply under NDPR, GDPR/UK GDPR, and POPIA, with some variation in scope by jurisdiction. To exercise any right, contact us at privacy@atsur.io.

We will not charge a fee for exercising your rights unless requests are manifestly unfounded or excessive. We may ask for proof of identity before processing a request.

11.1 Types of Cookies We Use

11.2 Managing Cookies

You can manage cookie preferences through the Atsur Cookie Consent banner on first visit to the platform, or at any time through the Cookie Settings link in the platform footer. You can also control cookies through your browser settings, though this may affect platform functionality.

12.1 Technical & Organisational Measures

We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);

• Role-based access controls limiting data access to authorised personnel;

• Cryptographic hashing of personally identifiable information before on-chain anchoring;

• Multi-factor authentication for platform accounts and administrative access;

• Regular security audits and penetration testing;

• Formal incident response procedures;

• Staff data protection training and confidentiality obligations.

12.2 Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware (GDPR/UK GDPR requirement; also best practice under NDPR);

• Notify affected individuals without undue delay where the breach is likely to result in high risk;

• Maintain a record of all data breaches, including those not meeting the notification threshold.

The Atsur platform is not directed at children under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete that data promptly. If you believe we have collected data from a child, please contact privacy@atsur.io.

If you have a concern about how we process your personal data, we encourage you to contact us first at privacy@atsur.io. We will investigate and respond within 30 days.

If you remain dissatisfied, you have the right to lodge a complaint with the relevant supervisory authority for your jurisdiction:

As a Nigerian-registered organisation processing the personal data of Nigerian data subjects, Atsur complies with the Nigerian Data Protection Regulation 2019 (NDPR) issued by NITDA and the Nigeria Data Protection Act 2023 (NDPA) where applicable. Specific provisions include:

• We will file an annual Data Protection Audit Report with NITDA as required where we process the data of more than 1,000 data subjects in a 12-month period;

• We have appointed (or will appoint) a Data Protection Compliance Organisation (DPCO) licensed by NITDA to conduct our annual audit;

• We maintain a Record of Processing Activities (RoPA) as required;

• Consent obtained from Nigerian data subjects is explicit, freely given, specific, and informed, and is recorded;

• Nigerian data subjects may lodge complaints directly with NITDA as set out in Section 14.

Where we process the personal data of South African data subjects, we comply with the Protection of Personal Information Act 4 of 2013 (POPIA). Specific provisions include:

• Processing is subject to the eight Conditions for Lawful Processing under POPIA Chapter 3;

• We have appointed (or will appoint) an Information Officer registered with the Information Regulator;

• South African data subjects have the right to request access to their records under the Promotion of Access to Information Act 2 of 2000 (PAIA), in addition to rights under POPIA;

• Transborder flows of South African data are subject to Section 72 of POPIA;

• South African data subjects may lodge complaints with the Information Regulator as set out in Section 14.

We may update this Policy from time to time to reflect changes in our data practices, platform functionality, or applicable law. Material changes will be notified to registered users by email and through a prominent notice on the platform at least 30 days before the change takes effect. The current version of this Policy is always available at atsur.io/privacy.

The version number and effective date at the top of this document identify the current version. Continued use of the platform after the effective date of any update constitutes acceptance of the revised Policy.