Legal
Privacy statement
Auctium is the data controller for the personal data processed through our marketplace. This statement explains what we collect, why, on what legal basis, how long we keep it, and the rights you have under the GDPR. We follow three principles: be transparent, be careful, and collect only what is relevant.
1. Data we collect
- Account data — your name, email address, username and password (stored only as a hash).
- Identity and verification data — documents and details needed for KYC checks when you sell, and for anti-fraud or legal reporting obligations.
- Transaction data — bids, orders, payments, shipping addresses, disputes and reviews.
- Payment data — processed by our payment processor; we never store full card numbers on our systems.
- Usage and device data — pages visited, searches, IP address, browser and device identifiers, collected via cookies and similar technologies.
- Communications — messages you exchange with other users through the platform and correspondence with our support team.
2. Purposes and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Running the marketplace: accounts, auctions, orders, escrow, payouts | Account, transaction, payment data | Performance of the contract |
| Seller verification (KYC), fraud prevention, deposit warranty administration | Identity, account and transaction data | Legal obligation and legitimate interest |
| Tax, accounting and regulatory reporting | Transaction and identity data | Legal obligation |
| Improving the platform: analytics, ranking and personalisation | Usage and device data | Legitimate interest (consent where required) |
| Service emails — bids, orders, disputes — and optional marketing | Account and transaction data | Contract; consent for marketing |
| Resolving disputes and enforcing our Terms | Transaction data and communications | Legitimate interest |
3. Cookies
We use essential cookies to keep you signed in and process your bids and orders — the marketplace does not work without them — and preference and analytics cookies to remember your settings and understand how the platform is used, so we can improve it. Where the law requires consent for non-essential cookies, we ask for it; you can change your choice at any time in your browser or account settings.
4. Who processes your data
We share personal data only with the processors needed to run the marketplace, under data-processing agreements:
- Stripe — payment processing, escrow flows and seller payouts.
- Our email provider — transactional and service email delivery.
- Hosting and infrastructure providers — operating and securing the platform.
- Shipping carriers — only the details needed to deliver your purchase.
We may disclose data to public authorities where the law requires it. We never sell your personal data. Where processors are located outside the EEA, transfers are protected by adequacy decisions or standard contractual clauses.
5. Retention
We keep your account data for as long as your account is active. Transaction and invoice data is retained for the periods required by tax and accounting law (typically up to seven years). Dispute and verification records are kept while a case or claim can still arise. When data is no longer needed, we delete or anonymise it.
6. Your rights
You can at any time:
- access the personal data we hold about you and receive a copy (portability);
- have inaccurate data rectified and incomplete data completed;
- request erasure of your data, subject to what we must keep for legal reasons;
- request restriction of processing, or object to processing based on legitimate interest;
- withdraw consent where processing is based on it — for example marketing email.
To exercise any of these rights, contact our Data Protection Officer through the help centre. If you believe your data has been handled unlawfully, you also have the right to lodge a complaint with your supervisory authority — in Ireland, the Data Protection Commission.
7. Security and changes
We protect your data with encryption in transit, hashed credentials, access controls and continuous security monitoring. No system is immune to attack; if a breach affects your rights, we will inform you and the authorities as the law requires.
We may update this statement; material changes are announced by email or on the platform before they take effect. Questions about this statement or about your data? Reach us through the help centre.