Clos Advisory LLC

Privacy Policy

Effective date May 2026Last updated August 2026

1Who we are

Clos Advisory LLC (“Clos Advisory,” “we,” “us,” or “our”) is a California limited liability company providing advisory services to private wine collectors, including cellar inventory and audit, valuation, acquisition and disposition, estate and heir liquidation support, and cellar relocation and refrigerated logistics.

This Privacy Policy explains what personal information we collect through our website at closadvisory.com (the “Site”) and in the course of providing our services, why we collect it, who we share it with, and what rights you have over it.

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), Clos Advisory LLC is the data controller of the personal information described in this Policy.

Contact for privacy matters:

2Summary

3Personal information we collect

3.1 Information you give us

Inquiry and contact information. When you complete our inquiry form, email us, or call us, we collect your name, email address, telephone number, city or region, how you found us, the services you are interested in, an estimated bottle count, and anything else you choose to tell us.

Engagement and client information. If we begin work together, we collect:

• Postal and premises addresses, including the address of the residence or facility where your collection is held, and access details needed to perform an audit or a relocation.

• Collection information — bottle-level inventory, formats, provenance, condition notes, original wood case status, storage conditions, purchase history where you provide it, photographs, and audio or video recordings made during an inventory capture.

• Valuation and appraisal information — our assessments of your collection’s market value, and the working files behind them.

• Insurance, estate, and trust documents you or your advisors share with us — insurance policies and schedules, appraisals, wills, trust instruments, probate filings, and correspondence with your attorney, accountant, or executor, where relevant to the engagement.

• Engagement records — agreements, proposals, scopes of work, notes, and correspondence.

Payment information. For card payments, you enter your card details directly with our payment processor, Stripe; we never see or store your full card number. Where you pay by check or bank transfer, we hold the limited banking details shown on the instrument or transfer advice — account holder name, and the account and routing numbers appearing on a check or ACH remittance — solely to reconcile the payment and satisfy our tax record-keeping obligations. We also hold invoices, amounts, dates, and payment status.

Newsletter subscription. If you subscribe to our Insights newsletter, we collect your email address and, optionally, your name.

3.2 Information we collect automatically

When you visit the Site, we and our analytics provider may collect: IP address, approximate location derived from IP address (typically city or region), browser type and version, operating system and device type, referring URL, pages and content viewed, time spent, links clicked, and cookie or device identifiers. See Section 7 for how consent governs this.

3.3 Information from other sources

We may receive your information from a referring professional — an estate or trust attorney, family office, registered investment adviser, insurance broker, or another collector — who puts us in touch with you, and from publicly available sources such as auction results and market databases used in the ordinary course of valuation work.

3.4 Sensitive information

Under the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), certain categories are treated as sensitive personal information. The only such category we handle is financial account information — the account details described above, held for payment reconciliation. We do not use or disclose sensitive personal information for any purpose other than performing the service, processing payment, and meeting our legal obligations, and therefore we do not offer a separate right to limit its use.

We do not seek, and ask that you not send us, information about health, racial or ethnic origin, religious beliefs, political opinions, union membership, sexual orientation, or biometric identifiers. Under GDPR these are special category data, and we have no need for them.

3.5 Children

Our services are directed to adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

4Why we use your information, and our legal basis

Where GDPR applies, we rely on the following legal bases.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object at any time (see Section 10).

Whether you have to give us this information. You are never required to provide personal information to browse the Site. Providing your name, email address, telephone number, and information about your collection is necessary for us to respond to an inquiry and to enter into and perform an engagement — if you decline to provide it, we will not be able to advise you. Providing payment information is a contractual and tax requirement once an engagement is underway. Providing your email address for our newsletter is entirely optional, and declining has no effect on the services you receive.

Text messages. We may call or send you text messages about a live engagement — arrival windows, access arrangements, shipment status. Standard message and data rates may apply. We do not send promotional or marketing text messages. You can ask us to stop texting at any time by replying STOP or telling us in writing.

5Confidentiality of your collection

We treat information about your collection as confidential, and we understand that for most clients this is the most sensitive information in the engagement. The commitments below describe our standing practice; the binding confidentiality obligation we owe you is set out in our engagement agreement.

• We do not publish, list, or disclose your identity, your address, the contents of your cellar, or its value to any third party except as described in Section 6 or as you direct in writing.

• Where we prepare a valuation for an insurer, appraiser, attorney, executor, auction house, or buyer, we disclose it only to the recipients you designate.

• Where we use anonymized market observations drawn from our work in published commentary, we remove anything that could identify you, your household, or your collection.

• Audio and video captured during an inventory is retained as a working backup and verification record for that inventory, is stored in access-controlled systems, and is not used for any other purpose.

6Who we share your information with

We do not sell your personal information, and we share it only where doing so is necessary to deliver the service you have asked for, to run our business, or to meet a legal obligation. In every case we disclose the minimum information the recipient needs for the task in front of them, and no more.

6.1 Categories of service provider

We use third-party providers to operate our business. Each is bound by contract to process your information only on our instructions, only for the purpose we engaged them for, and to keep it secure and confidential. They are not permitted to use your information for their own purposes.

The categories we use are:

• Website hosting and content delivery

• Website analytics — currently Google Analytics; see Section 7

• Client relationship management, forms, proposals, and contracts

• Payment processing and invoicing — currently Stripe; card details are entered with the processor directly and never reach us

• Email, calendar, and cloud document storage

• Cellar inventory management platforms

• Transcription of inventory dictation

• Professional advisers to Clos Advisory — our accountant, bookkeeper, insurance broker, and legal counsel

We name our analytics and payment providers specifically because our agreements with them require it, and because you interact with them directly. For the remaining categories, our providers change from time to time as we refine how we work. If you would like the current list of named providers, email us and we will send it to you. We maintain that list in writing and keep it current.

6.2 Counterparties needed to deliver a service

Several of our services are performed by, with, or through other companies. Where you engage us for that work, we disclose what those counterparties need in order to do their part. Unlike the providers in Section 6.1, these companies generally decide for themselves how to handle the information we give them — under GDPR they act as independent controllers, and their own privacy policies govern what they do with it.

We do not receive commissions or referral fees for these introductions. Where a counterparty asks us for more information than the task requires, we push back or ask you first.

6.3 At your direction

Anyone else you instruct us to deal with on your behalf — an insurer, adviser, family member, executor, or agent. Your instruction can be as broad or as narrow as you want it to be, and you can withdraw it.

6.4 Legal and protective disclosures

Where required by law, subpoena, or court order; to a regulator or licensing authority; to establish, exercise, or defend legal claims; to prevent fraud; or to protect the rights, property, or safety of Clos Advisory, our clients, or others.

6.5 Business transfers

If Clos Advisory is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

7Cookies and similar technologies

7.1 How consent works on this Site

We use a cookie consent banner. Cookies that are not strictly necessary — our analytics cookies — are not set until you consent. If you are in the EU, the UK, or another jurisdiction requiring prior consent, no non-essential cookie is set unless and until you allow it.

Changing your mind. You can withdraw your consent at any time by clearing the cookies for closadvisory.com in your browser settings, which deletes the stored cookies along with the record of your choice; the banner will then ask you again on your next visit. Most browsers also let you block cookies for a specific site altogether, or block all third-party cookies. Blocking strictly necessary cookies may stop parts of the Site working.

7.2 Categories we use

Strictly necessary. Set by our website platform so the Site functions and stays secure — session management, form submission, load balancing, and protection against cross-site request forgery. These are mostly session cookies, and they do not require consent because the Site cannot operate without them.

Analytics and performance. Help us understand which pages are read, how visitors arrive, and where they lose interest. Set by our website platform’s built-in analytics and by Google Analytics 4. These persist between 30 minutes and two years depending on the cookie, and are set only with your consent.

Embedded third-party services. Where you interact with a form, payment page, scheduling tool, or embedded video hosted by one of the providers in Section 6.1, that provider may set its own cookies, governed by its own privacy policy.

We do not use advertising, retargeting, or social media tracking cookies, and we do not run advertising pixels on this Site. If that changes, we will update this Policy and seek consent before any such cookie is set.

7.3 Do Not Track and opt-out preference signals

Because we do not sell or share personal information and do not run advertising pixels, an opt-out preference signal such as Global Privacy Control (GPC) has nothing to act on where our Site is concerned. We nonetheless treat a GPC signal, or a browser Do Not Track header, as an indication that you would prefer not to be measured, and we will not set analytics cookies where we detect one. If we ever introduce advertising technology, we will honor GPC as a formal opt-out and update this Policy first.

8International transfers

We are based in the United States, and your information is processed here. Our providers are also predominantly US-based.

If you are in the EU, the UK, or Switzerland, transferring your information to the United States means it leaves a jurisdiction the European Commission has found to provide adequate protection. Where we transfer personal information out of the EEA or the UK, we rely on:

• the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our agreements with providers; and/or

• the provider’s certification under the EU–U.S. Data Privacy Framework and its UK Extension, where applicable; and/or

• your explicit consent, or the necessity of the transfer for the performance of our contract with you, where those grounds apply.

You may request a copy of the relevant safeguards by writing to us.

This section is required in a privacy notice rather than a contract: GDPR Article 13(1)(f) obliges a controller to tell you, at the point of collection, that information will leave the EEA and what protects it. Our engagement agreement can and should repeat the commitment, but it cannot replace this disclosure.

9How long we keep your information

We keep information longer only where we are required to by law, or where it is needed to establish, exercise, or defend a legal claim.

Inventory recordings. The audio and video we capture while walking your cellar exists to verify the written inventory, which is the deliverable of record. We delete those recordings 12 months after capture, and we will delete them sooner if you ask us to in writing once you have accepted the inventory.

10Your rights under GDPR (EEA, UK, and Switzerland)

If you are in the EEA, the UK, or Switzerland, you have the right to:

• Access the personal information we hold about you, and receive a copy.

• Rectification of inaccurate or incomplete information.

• Erasure of your information where there is no overriding reason for us to keep it.

• Restriction of our processing in certain circumstances.

• Portability — receive information you provided to us in a structured, machine-readable format, and have it transmitted to another controller where technically feasible.

• Object to processing based on our legitimate interests, and to object at any time to processing for direct marketing.

• Withdraw consent at any time where we rely on consent — including by unsubscribing from our newsletter or changing your cookie preferences. Withdrawal does not affect processing carried out before you withdrew.

• Not be subject to a decision based solely on automated processing with legal or similarly significant effects. We do not make such decisions, and we do not use automated decision-making or profiling in the course of our advisory work.

• Complain to your local supervisory authority. A list of EEA authorities is maintained by the European Data Protection Board; in the UK the authority is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to address your concern first.

To exercise any of these rights, email wine@closadvisory.com. We will respond within one month, and will tell you if we need a further two months because the request is complex. We may ask you to verify your identity — for a request about a wine collection, that verification protects you.

11Your rights under California law

The following applies to California residents. Clos Advisory is a small business and does not currently meet the CCPA’s applicability thresholds — annual gross revenue above roughly $26.6 million, buying, selling, or sharing the personal information of 100,000 or more California consumers, or deriving 50% or more of revenue from selling or sharing personal information. We extend the following rights voluntarily, and will comply as a matter of practice regardless of whether we are a “business” as the statute defines it.

11.1 Categories collected, disclosed, and shared

In the preceding 12 months we have collected the following CCPA categories, from the sources described in Section 3, for the purposes described in Section 4, and disclosed them to the recipients described in Section 6:

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We also do not “share” personal information for cross-context behavioral advertising, as California defines that term — we run no advertising or retargeting pixels on the Site. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.

11.2 Your rights

• Know and access — the categories and specific pieces of personal information we have collected, the sources, our purposes, and the recipients.

• Delete — request deletion, subject to exceptions such as completing a transaction, complying with a legal obligation, or retaining records needed to defend a claim.

• Correct — inaccurate personal information.

• Opt out of sale or sharing — you have this right, though we do not currently sell or share personal information, so there is nothing for an opt-out to stop. If we ever introduce advertising technology, we will update this Policy and provide a working opt-out before doing so.

• Limit the use of sensitive personal information — we use sensitive personal information only for purposes the statute permits without a limit right, so there is nothing to limit; if that changes, this Policy will change with it.

• Non-discrimination — we will not deny you services, charge a different price, or provide a lesser quality of service because you exercised a privacy right.

11.3 How to exercise them

Email wine@closadvisory.com with “Privacy Request” in the subject line. To decline analytics cookies, use the cookie banner, or clear the cookies for closadvisory.com in your browser to reset a prior choice.

We will confirm receipt within 10 business days and respond within 45 calendar days, extendable by a further 45 days with notice. We must verify your identity before disclosing or deleting personal information; we will match the information you provide against our records and may ask for additional detail where the request concerns collection or valuation records.

Authorized agents may submit requests on your behalf with written permission signed by you; we may contact you to confirm.

12Other US state privacy rights

Residents of other states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Tennessee, Indiana, Iowa, Kentucky, and Rhode Island, and others as they take effect — have broadly similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, and in several states a right to appeal a denied request. We extend the same rights described in Section 11 to residents of those states. We do not engage in targeted advertising, profiling, or the sale of personal information, so those particular opt-outs have nothing to act on; we honor universal opt-out signals as described in Section 7.3. To appeal a decision we have made about your request, reply to our response and we will review it and explain the outcome in writing.

13Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including access-controlled and encrypted storage, multi-factor authentication on business accounts, encryption in transit, limiting access on a need-to-know basis, and vetting the providers described in Section 6. Card payments are handled entirely by Stripe, a PCI-DSS Level 1 service provider.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities where the law requires it, within the applicable deadlines.

14Third-party links

The Site may link to third-party websites, including auction houses, market databases, and publications. We do not control those sites and are not responsible for their privacy practices. Read their policies before providing information.

15Changes to this Policy

We may update this Policy to reflect changes in our services, our providers, or the law. We will update the “Last updated” date above, and where a change materially affects how we use your information we will notify you by email or with a notice on the Site before it takes effect. Where the law requires your consent to a change, we will obtain it.

16Contact us

Questions, requests, or complaints about this Policy or how we handle your information: