Clos Advisory LLC

Privacy Policy

Effective date May 2026Last updated October 2026

1Who we are

Clos Advisory LLC (“Clos Advisory,” “we,” “us,” or “our”) is a California limited liability company providing advisory services to private wine collectors, including cellar inventory and audit, valuation, acquisition and disposition, estate and heir liquidation support, and cellar relocation and refrigerated logistics.

This Privacy Policy explains what personal information we collect through our website at closadvisory.com (the “Site”) and in the course of providing our services, why we collect it, who we share it with, and what rights you have over it.

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), Clos Advisory LLC is the data controller of the personal information described in this Policy.

Contact for privacy matters:

2Summary

3Personal information we collect

3.1 Information you give us

Inquiry and contact information. When you complete our inquiry form, email us, or call us, we collect your name, email address, telephone number, city or region, how you found us, the services you are interested in, an estimated bottle count, and anything else you choose to tell us.

Engagement and client information. If we begin work together, we collect:

• Postal and premises addresses, including the address of the residence or facility where your collection is held, and access details needed to perform an audit or a relocation.

• Collection information — bottle-level inventory, formats, provenance, condition notes, original wood case status, storage conditions, purchase history where you provide it, photographs, and audio or video recordings made during an inventory capture.

• Valuation and appraisal information — our assessments of your collection’s market value, and the working files behind them.

• Insurance, estate, and trust documents you or your advisors share with us — insurance policies and schedules, appraisals, wills, trust instruments, probate filings, and correspondence with your attorney, accountant, or executor, where relevant to the engagement.

• Engagement records — agreements, proposals, scopes of work, notes, and correspondence.

Payment information. For card payments, you enter your card details directly with our payment processor, Stripe; we never see or store your full card number. Where you pay by check or bank transfer, we hold the limited banking details shown on the instrument or transfer advice — account holder name, and the account and routing numbers appearing on a check or ACH remittance — solely to reconcile the payment and satisfy our tax record-keeping obligations. We also hold invoices, amounts, dates, and payment status.

Newsletter subscription. If you subscribe to our Insights newsletter, we collect your email address and, optionally, your name.

3.2 Information we collect automatically

When you visit the Site, we and our analytics and advertising providers may collect: IP address, approximate location derived from IP address (typically city or region), browser type and version, operating system and device type, referring URL, pages and content viewed, time spent, links clicked, and cookie or device identifiers.

Where you reach the Site by clicking one of our advertisements, we also receive a Google click identifier that lets us attribute your visit, and any inquiry that follows, to the campaign that produced it. See Section 7 for how cookies and consent govern this.

3.3 Information from other sources

We may receive your information from a referring professional — an estate or trust attorney, family office, registered investment adviser, insurance broker, or another collector — who puts us in touch with you, and from publicly available sources such as auction results and market databases used in the ordinary course of valuation work.

3.4 Sensitive information

Under the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), certain categories are treated as sensitive personal information. The only such category we handle is financial account information — the account details described above, held for payment reconciliation. We do not use or disclose sensitive personal information for any purpose other than performing the service, processing payment, and meeting our legal obligations, and therefore we do not offer a separate right to limit its use. Sensitive personal information is never included in any advertising audience.

We do not seek, and ask that you not send us, information about health, racial or ethnic origin, religious beliefs, political opinions, union membership, sexual orientation, or biometric identifiers. Under GDPR these are special category data, and we have no need for them.

3.5 Children

Our services are directed to adults. We do not knowingly collect personal information from anyone under 16, and we never include anyone we know to be a minor in an advertising audience. If you believe a child has provided us information, contact us and we will delete it.

4Why we use your information, and our legal basis

Where GDPR applies, we rely on the following legal bases.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you may object at any time (see Section 10).

Whether you have to give us this information. You are never required to provide personal information to browse the Site. Providing your name, email address, telephone number, and information about your collection is necessary for us to respond to an inquiry and to enter into and perform an engagement — if you decline to provide it, we will not be able to advise you. Providing payment information is a contractual and tax requirement once an engagement is underway. Providing your email address for our newsletter is entirely optional, and declining has no effect on the services you receive.

Text messages. We may call or send you text messages about a live engagement — arrival windows, access arrangements, shipment status. Standard message and data rates may apply. We do not send promotional or marketing text messages. You can ask us to stop texting at any time by replying STOP or telling us in writing.

5Confidentiality of your collection

We treat information about your collection as confidential, and we understand that for most clients this is the most sensitive information in the engagement. The commitments below describe our standing practice; the binding confidentiality obligation we owe you is set out in our engagement agreement.

• We do not publish, list, or disclose your identity, your address, the contents of your collection, or its value to any third party except as described in Section 6 or as you direct in writing.

• Where we prepare a valuation for an insurer, appraiser, attorney, executor, auction house, or buyer, we disclose it only to the recipients you designate.

• Where we use anonymized market observations drawn from our work in published commentary, we remove anything that could identify you, your household, or your collection.

• Audio and video captured during an inventory is retained as a working backup and verification record for that inventory, is stored in access-controlled systems, and is not used for any other purpose.

• Advertising is the one place your contact details leave us for a purpose other than your engagement. As described in Section 6.3, your email address — and sometimes your name, telephone number, or postal address — may be included in an advertising audience we provide to Google. Nothing about your collection travels with it. Not its contents, not its value, not your inventory, not your valuation, not the fact that your engagement concerns an estate, a probate, or a disposition. Google receives contact details and nothing more, and you can ask us to remove you at any time.

6Who we share your information with

We do not sell your personal information. We share it where doing so is necessary to deliver the service you have asked for, to run our business, to advertise our services, or to meet a legal obligation. In every case we disclose the minimum information the recipient needs for the task in front of them, and no more.

6.1 Categories of service provider

We use third-party providers to operate our business. Each is bound by contract to process your information only on our instructions, only for the purpose we engaged them for, and to keep it secure and confidential. They are not permitted to use your information for their own purposes.

The categories we use are:

• Website hosting and content delivery

• Website analytics — currently Google Analytics; see Section 7

• Tag management — currently Google Tag Manager, which controls which measurement and advertising tags run on the Site

• Client relationship management, forms, proposals, and contracts

• Payment processing and invoicing — currently Stripe; card details are entered with the processor directly and never reach us

• Email, calendar, and cloud document storage

• Cellar inventory management platforms

• Transcription of inventory dictation

• Professional advisers to Clos Advisory — our accountant, bookkeeper, insurance broker, and legal counsel

We name our analytics, tag management, advertising, and payment providers specifically because our agreements with them require it, and because you interact with them directly. For the remaining categories, our providers change from time to time as we refine how we work. If you would like the current list of named providers, email us and we will send it to you. We maintain that list in writing and keep it current.

6.2 Counterparties needed to deliver a service

Several of our services are performed by, with, or through other companies. Where you engage us for that work, we disclose what those counterparties need in order to do their part. Unlike the providers in Section 6.1, these companies generally decide for themselves how to handle the information we give them — under GDPR they act as independent controllers, and their own privacy policies govern what they do with it.

We do not receive commissions or referral fees for these introductions. Where a counterparty asks us for more information than the task requires, we push back or ask you first.

6.3 Advertising and measurement

We advertise Clos Advisory on Google. Doing so means sharing some of your information with Google, and Google is not simply acting on our instructions when it does — for parts of this it decides for itself how the information is used, which makes it an independent recipient rather than a processor working on our behalf. This section explains exactly what leaves us and what you can do about it.

Measuring our advertising. Tags on the Site record when a visit that began with one of our advertisements leads to an inquiry, so we know which campaigns are worth paying for. This uses cookies and the Google click identifier described in Section 3.2.

Improving that measurement. When you submit our inquiry form, an irreversibly hashed version of your email address may be sent to Google so it can match the inquiry to the advertisement that produced it. Hashing scrambles the address before it leaves us; we do not send Google the address in readable form for this purpose.

Remarketing. Third-party vendors, including Google, show our advertisements on sites across the internet. Third-party vendors, including Google, use cookies to serve those advertisements based on your past visits to the Site. This is why you may see Clos Advisory after reading about a collection audit and then moving on.

Advertising audiences built from our contact lists. We provide lists of contact details — email addresses, and sometimes name, telephone number, and postal address — to Google so that we can show advertisements to people who have contacted us or worked with us, build audiences of people who resemble them, and exclude people from campaigns that should not reach them. The contact details are hashed before they are uploaded. These lists contain contact details only. Nothing about your collection, your inventory, your valuation, or the subject matter of your engagement is included, as set out in Section 5.

How to stop it. You have four independent routes, and any one of them works:

• Our “Your Privacy Choices” link, in the footer of every page, turns off advertising and analytics cookies on this Site and removes you from the contact lists described above.

• Email us at wine@closadvisory.com and ask to be removed from our advertising audiences. We will do it and confirm.

• Google’s own controls. You can opt out of Google’s use of cookies for personalized advertising through Google Ads Settings at myadcenter.google.com.

• Industry opt-outs. You can opt out of a third-party vendor’s use of cookies for personalized advertising through the Network Advertising Initiative at optout.networkadvertising.org.

Opting out does not mean you stop seeing advertising. It means the advertising you see is no longer based on your visits to this Site or on your presence in one of our audiences.

6.4 At your direction

Anyone else you instruct us to deal with on your behalf — an insurer, adviser, family member, executor, or agent. Your instruction can be as broad or as narrow as you want it to be, and you can withdraw it.

6.5 Legal and protective disclosures

Where required by law, subpoena, or court order; to a regulator or licensing authority; to establish, exercise, or defend legal claims; to prevent fraud; or to protect the rights, property, or safety of Clos Advisory, our clients, or others.

6.6 Business transfers

If Clos Advisory is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

7Cookies and similar technologies

7.1 How consent works on this Site

What happens when you arrive depends on where you are.

If you are in the EU, the UK, or another jurisdiction that requires prior consent: no cookie beyond the strictly necessary ones is set unless and until you allow it. Analytics and advertising tags stay switched off until you choose.

If you are in the United States: analytics and advertising cookies are set when you arrive, and you may turn them off at any time. US privacy law works on an opt-out basis rather than an opt-in one, and we have chosen to follow that standard here rather than ask every visitor for permission before the Site can measure anything.

Turning them off. Use the “Your Privacy Choices” link in the footer of every page. You can also send a Global Privacy Control signal from your browser, which we honor automatically — see Section 7.3 — or clear the cookies for closadvisory.com in your browser settings, which deletes the stored cookies along with the record of your choice. Most browsers also let you block cookies for a specific site altogether, or block all third-party cookies. Blocking strictly necessary cookies may stop parts of the Site working.

7.2 Categories we use

Strictly necessary. Set by our website platform so the Site functions and stays secure — session management, form submission, load balancing, and protection against cross-site request forgery. These are mostly session cookies, and they do not require consent because the Site cannot operate without them.

Analytics and performance. Show us which pages are read, how visitors arrive, and where they lose interest. Set by our website platform’s built-in analytics and by Google Analytics 4. These persist between 30 minutes and two years depending on the cookie.

Advertising and targeting. Used to measure what our advertising achieves and to show our advertisements to people who have visited the Site. Set by Google through Google Tag Manager, and by Google’s own advertising domains when an advertisement is served. The Google advertising cookies we set on this Site typically persist for about 90 days; Google’s own cookies have their own durations, governed by Google’s privacy policy.

Embedded third-party services. Where you interact with a form, payment page, scheduling tool, or embedded video hosted by one of the providers in Section 6.1, that provider may set its own cookies, governed by its own privacy policy.

7.3 Do Not Track and opt-out preference signals

We honor the Global Privacy Control (GPC) signal. If your browser or a browser extension transmits GPC, we treat it as a valid request to opt out of the sale or sharing of personal information, and we will stop setting advertising and analytics cookies for that browser and display confirmation that the signal has been honored. You do not need to do anything else, and you do not need to tell us who you are.

We treat a browser Do Not Track header the same way.

A browser signal applies to the browser that sends it. It cannot remove you from a contact-list audience we have already provided to Google, because that audience is built from your email address rather than from your browser. To be removed from those, use the “Your Privacy Choices” link or email us, as described in Section 6.3.

8International transfers

We are based in the United States, and your information is processed here. Our providers, including Google, are also predominantly US-based. Our advertising is directed to the United States; we do not currently run campaigns targeting the EU or the UK.

If you are in the EU, the UK, or Switzerland, transferring your information to the United States means it leaves a jurisdiction the European Commission has found to provide adequate protection. Where we transfer personal information out of the EEA or the UK, we rely on:

• the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our agreements with providers; and/or

• the provider’s certification under the EU–U.S. Data Privacy Framework and its UK Extension, where applicable; and/or

• your explicit consent, or the necessity of the transfer for the performance of our contract with you, where those grounds apply.

You may request a copy of the relevant safeguards by writing to us.

This section is required in a privacy notice rather than a contract: GDPR Article 13(1)(f) obliges a controller to tell you, at the point of collection, that information will leave the EEA and what protects it. Our engagement agreement can and should repeat the commitment, but it cannot replace this disclosure.

9How long we keep your information

We keep information longer only where we are required to by law, or where it is needed to establish, exercise, or defend a legal claim.

Inventory recordings. The audio and video we capture while walking your collection exists to verify the written inventory, which is the deliverable of record. Once you have accepted the inventory, the recordings have served their purpose. We delete them 12 months after the engagement ends, and sooner if you ask us to in writing.

10Your rights under GDPR (EEA, UK, and Switzerland)

If you are in the EEA, the UK, or Switzerland, you have the right to:

• Access the personal information we hold about you, and receive a copy.

• Rectification of inaccurate or incomplete information.

• Erasure of your information where there is no overriding reason for us to keep it.

• Restriction of our processing in certain circumstances.

• Portability — receive information you provided to us in a structured, machine-readable format, and have it transmitted to another controller where technically feasible.

• Object to processing based on our legitimate interests, and to object at any time to processing for direct marketing, including the advertising described in Section 6.3.

• Withdraw consent at any time where we rely on consent — including by unsubscribing from our newsletter or changing your cookie preferences. Withdrawal does not affect processing carried out before you withdrew.

• Not be subject to a decision based solely on automated processing with legal or similarly significant effects. We make no such decisions, and none of our advisory work is automated. The advertising audiences described in Section 6.3 involve a limited form of profiling, but only to decide which advertisement you see; it has no legal or similarly significant effect on you, and you can opt out of it at any time.

• Complain to your local supervisory authority. A list of EEA authorities is maintained by the European Data Protection Board; in the UK the authority is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to address your concern first.

To exercise any of these rights, email wine@closadvisory.com. We will respond within one month, and will tell you if we need a further two months because the request is complex. We may ask you to verify your identity — for a request about a wine collection, that verification protects you.

11Your rights under California law

The following applies to California residents. Clos Advisory is a small business and does not currently meet the CCPA’s applicability thresholds — annual gross revenue above roughly $26.6 million, buying, selling, or sharing the personal information of 100,000 or more California consumers, or deriving 50% or more of revenue from selling or sharing personal information. We extend the following rights voluntarily, and will comply as a matter of practice regardless of whether we are a “business” as the statute defines it.

11.1 Categories collected, disclosed, and shared

In the preceding 12 months we have collected the following CCPA categories, from the sources described in Section 3, for the purposes described in Section 4, and disclosed them to the recipients described in Section 6:

We do not sell personal information, and we have not sold personal information in the preceding 12 months. We receive no money or other consideration for anyone’s information.

We do “share” personal information for cross-context behavioral advertising, as California defines that term. Our Google Ads measurement, remarketing, and contact-list audiences — all described in Section 6.3 — mean that online identifiers and contact details reach Google so that our advertisements can be targeted and measured. This is not a sale for money, but California treats it as an activity you may opt out of, and Section 11.3 tells you how. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.

11.2 Your rights

• Know and access — the categories and specific pieces of personal information we have collected, the sources, our purposes, and the recipients.

• Delete — request deletion, subject to exceptions such as completing a transaction, complying with a legal obligation, or retaining records needed to defend a claim.

• Correct — inaccurate personal information.

• Opt out of sale or sharing — direct us to stop sharing your information for cross-context behavioral advertising. We will stop, and we will tell Google to remove you from the audiences described in Section 6.3.

• Limit the use of sensitive personal information — we use sensitive personal information only for purposes the statute permits without a limit right, and it never enters an advertising audience, so there is nothing to limit; if that changes, this Policy will change with it.

• Non-discrimination — we will not deny you services, charge a different price, or provide a lesser quality of service because you exercised a privacy right. Opting out of advertising has no effect whatsoever on the advice you receive from us.

11.3 How to exercise them

To opt out of sharing for advertising, use any of these — no account, no form, no explanation required:

• the “Your Privacy Choices” link in the footer of every page;

• a Global Privacy Control signal from your browser, which we honor automatically and confirm on screen;

• an email to wine@closadvisory.com.

For access, deletion, or correction requests, email wine@closadvisory.com with “Privacy Request” in the subject line.

We will confirm receipt within 10 business days and respond within 45 calendar days, extendable by a further 45 days with notice. We must verify your identity before disclosing or deleting personal information; we will match the information you provide against our records and may ask for additional detail where the request concerns collection or valuation records. An opt-out request needs no identity verification — we act on it as received.

Authorized agents may submit requests on your behalf with written permission signed by you; we may contact you to confirm.

12Other US state privacy rights

Residents of other states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Tennessee, Indiana, Iowa, Kentucky, and Rhode Island, and others as they take effect — have broadly similar rights of access, correction, deletion, portability, and opt-out of targeted advertising, and in several states a right to appeal a denied request.

We extend the same rights described in Section 11 to residents of those states. We do engage in targeted advertising, as described in Section 6.3, and you may opt out of it by any of the routes in Section 11.3. We do not sell personal information, and we do not profile anyone in a way that produces legal or similarly significant effects. We honor universal opt-out signals, including Global Privacy Control, as described in Section 7.3. To appeal a decision we have made about your request, reply to our response and we will review it and explain the outcome in writing.

13Security

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, including access-controlled and encrypted storage, multi-factor authentication on business accounts, encryption in transit, limiting access on a need-to-know basis, and vetting the providers described in Section 6. Card payments are handled entirely by Stripe, a PCI-DSS Level 1 service provider.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities where the law requires it, within the applicable deadlines.

14Third-party links

The Site may link to third-party websites, including auction houses, market databases, and publications. We do not control those sites and are not responsible for their privacy practices. Read their policies before providing information.

15Changes to this Policy

We may update this Policy to reflect changes in our services, our providers, or the law. We will update the “Last updated” date above, and where a change materially affects how we use your information we will notify you by email or with a notice on the Site before it takes effect. Where the law requires your consent to a change, we will obtain it.

16Contact us

Questions, requests, or complaints about this Policy or how we handle your information: