CafejoleGALLERY

Terms

Privacy

A short account of what this site collects and why. We do not sell data, and there is no advertising or tracking anywhere on it.

Who is responsible

The controller is [COMPANY NAME], [REGISTERED ADDRESS], [ORG/VAT NO]. Questions and requests: [CONTACT EMAIL].

What we collect, and why

  • Purchases. Name, email, delivery address and order contents β€” to fulfil the sale and meet tax obligations. Basis: performance of a contract, and legal obligation.
  • Bidding. Name, email, bid history, and a payment-method reference β€” to run the auction and settle it. For lots at or above €10,000, identity documents, because anti-money-laundering rules require it. Basis: contract, and legal obligation.
  • Enquiries. Whatever you put in your message. Basis: legitimate interest in replying to you.

We never see your card details. Payment is handled entirely by Stripe on their own pages; we hold only a customer reference and the last four digits.

Cookies

This site sets no advertising or analytics cookies, which is why you have not been asked to consent to any. The only cookies are the strictly necessary ones Stripe sets during checkout to process your payment and prevent fraud.

Who processes data on our behalf

  • Vercel β€” hosting and server logs
  • Supabase β€” database (orders, lots, bids), hosted in the EU
  • Stripe β€” payment processing and card storage
  • Cloudflare β€” image delivery and network protection

Each is engaged under a data processing agreement. Where a processor operates outside the EEA, transfers rely on Standard Contractual Clauses.

How long we keep it

Order and bid records are retained for seven to ten years, because tax and anti-money-laundering law requires it. Enquiries are deleted after two years. Server logs are kept for thirty days.

Your rights, stated honestly

You can ask for a copy of your data, correct it, object to processing, or ask us to delete it. We respond within one month.

One important limit: we cannot fully erase a completed transaction or a bid record while the statutory retention period runs, because keeping it is a legal obligation. What we can do is pseudonymise it β€” detach your name and contact details from the financial record. We would rather say this plainly than promise a deletion we cannot perform.

If you are unhappy with how we have handled your data you can complain to your national supervisory authority.

Changes

If this page changes materially we will say so here, with the date. Last updated [DATE].