Privacy Policy

2.1 Categories of data

We collect the following categories of personal data:

• Identification data: name, address, contact details and identification documents (passport / national ID, proof of address).
• Financial data: tokenized card details and bank account information used for payments and payouts.
• Technical data: IP address, device information, log files and interaction with the Marketplace.

2.2 Purposes and retention

Personal data is processed for the performance of the contract (auction participation, payment, shipping) and for the AML/KYC checks required by EU law. Transactional data and copies of identification documents are retained for 10 years to comply with anti-money-laundering and tax record-keeping obligations.

Legal basis for processing

• Performance of a contract — for registration, bidding, payments and delivery.
• Compliance with a legal obligation — for KYC/AML, tax and customs record-keeping.
• Legitimate interest — to prevent fraud, secure the platform and improve our services.
• Consent — for optional marketing communications, where applicable.

Data sharing

• Payment service providers (e.g. Stripe) — to process payments.
• Logistics partners — to deliver lots and to handle insurance claims for valuables.
• Identity verification providers — to perform KYC and AML checks.
• Public authorities — where we are legally required to disclose data (tax authorities, courts, customs).

International transfers

Where processing involves transfers outside the European Economic Area, we rely on adequacy decisions or on Standard Contractual Clauses approved by the European Commission, supplemented with appropriate technical and organisational measures.

Your rights

• Right of access, rectification and erasure of your personal data.
• Right to restriction of processing and to object to processing based on legitimate interest.
• Right to data portability for data you provided.
• Right to withdraw consent at any time, where processing is based on consent.
• Right to lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec).

Security

We apply appropriate technical and organisational measures, including encryption in transit, access controls and logging, to protect personal data against unauthorised access, alteration, disclosure or destruction.