Privacy policy
This policy explains how Vintage Grail Global Limited ("Grail Exchange", "we", "us") collects, uses and protects personal data when you use grailexchange.com, our client account (My account) and our services, and when you message us on WhatsApp. We follow the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong.
What we collect
- Contact details: name, company, email address, phone and WhatsApp number, country and preferred language
- Account details: your client code, sign-in records and passkeys (we never see your fingerprint or face; your device keeps them)
- What you tell us about watches: requests, pre-alerts, declared values, and the photos and documents you send
- Records we create while handling your watches: receiving photos, condition and authenticity reports, and notes about your requests and shipments
- WhatsApp messages: your WhatsApp number and profile name, the messages, photos and documents you send us, and whether our messages were delivered and read
- Website usage: pages visited and basic technical information such as browser type, through cookies needed for the site to work
Why we use it
- To answer your requests and provide our services: receiving, authentication, service, storage, shipping, purchase assistance and parts
- To identify parcels and keep a record of what arrived, for insurance and to settle questions about missing items
- To verify your account and prevent fraud
- To send you updates about your requests, parcels and watches by email and WhatsApp, such as "your parcel has arrived" or your condition report
- To send you news, only if you agreed; you can stop at any time
When you message us on WhatsApp, or we message you about your requests and parcels, we use the WhatsApp Business Platform provided by Meta Platforms, Inc. and its affiliates. Your messages pass through Meta's systems and are kept in our client records so our team can answer you and keep a history of your service. Meta's own use of this information is described in WhatsApp's privacy policy. We send messages only about your requests, parcels and account, or that you asked for. To stop WhatsApp messages from us, reply "STOP" or tell us at the contact details below.
Who we share it with
- Couriers, insurers, watchmakers, service centres and other providers, only as needed to do what you asked
- Our affiliated companies, where needed to serve you across locations
- Service providers that run our website, database, email, messaging (including Meta for WhatsApp) and file storage for us, under agreements that protect your data
- Authorities, when the law requires it
We do not sell your personal data.
Where it is stored
Our systems are run by cloud providers, and some data is stored outside Hong Kong, including in Singapore. We protect it with access controls, encryption in transit and at rest, and activity logs.
How long we keep it
We keep your data while you have an account with us, and afterwards for as long as needed for legal, accounting and insurance purposes, which for business records in Hong Kong is up to 7 years. Marketing consent ends as soon as you withdraw it.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, and opt out of marketing at any time.
How to delete your data
To have your account and personal data deleted, email hongkong@vintagegrail.com from the address on your account, or message us on WhatsApp, with the subject "Delete my data". We confirm your identity, delete or anonymise your personal data within 30 days, and confirm by email when it is done. Records we must keep by law (for example invoices and insurance records) are kept only for as long as required and then deleted.
Contact
Data Protection Officer, Vintage Grail Global Limited, Suite 906, 9th Floor, Wing On Plaza, 62 Mody Road, Tsim Sha Tsui, Kowloon, Hong Kong. Email: hongkong@vintagegrail.com. Phone and WhatsApp: +852 5561 6428.
Changes to this policy
If we change this policy, we post the new version here with its date.
Last updated: 22 October 2026