Privacy Policy

Template — last updated: [DATE]

1. Who is responsible for your data

The data controller is [REGISTERED COMPANY NAME], [ADDRESS], contactable at [EMAIL]. [If you have a Data Protection Officer, name them here.]

2. What we collect

• Registration details: name or company name, VAT/registration number, contact person, email, phone, address.
• Identity documents: a national ID card, passport, or business registration document that you upload for verification.
• Bidding activity: the lots you bid on and the amounts.
• Technical data: essential session cookies used to keep you signed in.

3. Why we process it, and our lawful basis

We use your registration details and documents to verify your identity and operate the auction (performance of a contract, and our legitimate interest in a trustworthy marketplace). Identity documents are a special category of care; we rely on [your consent, given at registration / other lawful basis to be confirmed with your adviser]. We use bidding data to run sales and contact winners.

4. How we protect identity documents

Uploaded documents are stored in a private location that is not accessible from the public web, under randomised filenames, and are viewable only by our authorised verification team through an access-controlled screen — never by other members or the public. Data is transmitted over an encrypted (HTTPS) connection. File types are validated on upload.

5. How long we keep it

We keep identity documents only as long as needed for verification and legal obligations, then delete them. [State your retention periods — e.g. delete unverified uploads after X days; delete documents X months after account closure.] Bidding records may be retained longer where required by law.

6. Who we share it with

We do not sell your data. We share it only with [hosting provider], and where required by law or to complete a sale you have won. [List any processors and confirm appropriate safeguards.]

7. Your rights

Subject to local law you may request access to, correction of, or deletion of your personal data, object to or restrict processing, withdraw consent, and receive a copy of your data. To exercise these rights, contact [EMAIL]. You may also complain to your data-protection authority.

8. Cookies

We use a single essential session cookie to keep you signed in. We do not use advertising or third-party tracking cookies. [Update if this changes.]

9. Changes

We may update this policy; the date above shows the latest revision.