Privacy policy

Last updated [date]

Draft — not yet legal advice. This document was drafted from how the platform works and is a starting point only. Have a qualified solicitor review and adapt it, and fill in the bracketed details, before you rely on it or open to real bidders.

This explains how [Gallery name] handles personal data for this auction site. For UK/EU visitors we are the data controller. [Confirm which data-protection law applies to you — this draft assumes UK GDPR — and appoint a contact for data questions.]

What we collect

When you register and bid, we collect:

Contact and delivery details you enter: name, email, phone, and postal address.
Your bidding activity: the bids you place, including your confidential maximums, and the lots you win.
Technical essentials: a sign-in session cookie, one-time sign-in links sent by email, and a theme preference stored in your browser. We do not run advertising or third-party analytics trackers.

Why we use it, and our legal basis

To run the auction and complete sales — approving bidders, taking bids, contacting winners, arranging payment and delivery — on the basis of taking steps to enter into and perform a contract with you. To send service emails (sign-in links, registration, approval, outbid and result notices) as a necessary part of that. To keep records of sales and prevent abuse, as a legitimate interest.

Who we share it with

We do not sell your data. We share it only with the providers that run this service on our behalf, as processors: our hosting platform (Vercel), our database provider (Neon), our image storage (Vercel Blob), and our email provider ([Gmail today; a domain email provider such as Resend once configured]). Some of these process data outside the UK/EU; where they do, appropriate safeguards such as standard contractual clauses apply. We may disclose data where the law requires it.

Cookies and storage

We use one essential cookie to keep you signed in, and store your light/dark theme choice in your browser. Both are needed for the site to work or to honour your preference, so no consent banner is required for them. [If you later add analytics or marketing cookies, add a consent mechanism.]

How long we keep it

We keep bidder and sale records for as long as needed to run the sale and meet our legal and accounting obligations, then delete or anonymise them. Expired sign-in links and sessions are removed. [Set concrete retention periods with your accountant/solicitor.]

Your rights

You can ask us to access, correct, delete, or restrict your data, object to certain uses, or receive a copy to move elsewhere. To exercise any of these, contact us at [contact email]. You also have the right to complain to your data-protection regulator (in the UK, the Information Commissioner’s Office).

Security

Access is protected by single-use sign-in links and session cookies; sign-in tokens are stored only as hashes; the site is served over HTTPS. No system is perfectly secure, but we take reasonable measures to protect your data.

Contact

[Gallery name], [address]. Data questions: [contact email]. [Add a data-protection contact if you appoint one.]