Privacy policy

Our role

Bidvise is the controller for data about visitors of bidvise.com, people who contact us, and users and billing contacts of Bidvise accounts.

Auction houses use Bidvise to run their auctions and websites. For the data of their bidders, buyers and consignors, the auction house is the controller and Bidvise processes that data on its behalf. Questions about that data are best sent to the auction house; its own privacy policy applies.

What we process

1. Contact and demo requests and newsletter sign-ups: name, email address, company, website, type of organisation, phone number if given, how you heard of us, the page the form was sent from, the message, and IP address and browser details for spam protection.
2. Dashboard accounts: name, email address, role and permissions, login and audit records.
3. Billing: company details, contact person and invoices for our subscription.
4. Technical data: IP address, browser and request logs needed to run and secure the service.
5. Connected social media accounts (see below).

Facebook and other connected accounts

An auction house can connect its Facebook Page to Bidvise to publish posts about its auctions.

When a Page is connected we store: the Page ID and name, an encrypted access token, the app-scoped ID of the Facebook user who authorised the connection, and the posts published through Bidvise with their Facebook IDs and status.

We use this data only to carry out what the auction house asks for in Bidvise: publishing posts. We do not sell it, do not use it to build profiles and do not share it with third parties other than Meta itself.

The connection can be ended at any time by removing it in Bidvise or by removing Bidvise in the Facebook settings under Apps and websites. See the data deletion page for what happens then.

Legal bases

1. Performance of a contract: accounts, billing and the features an auction house uses.
2. Legitimate interest: security, logs, answering questions and improving the service.
3. Consent: the newsletter, which can be withdrawn with the link in every email.
4. Legal obligation: financial records.

Service providers

We use a small number of providers who process data on our behalf under a data processing agreement, including Fly.io (hosting and database, EU region), Cloudflare (website hosting and DNS), Twilio SendGrid (email delivery), Upstash (cache) and Amazon Web Services (file storage). Where a provider is located outside the European Economic Area, transfers take place under the EU Standard Contractual Clauses or an equivalent safeguard.

Retention

1. Contact requests: as long as needed to handle the request and any follow-up; removed earlier on request.
2. Account data: for the duration of the contract and up to one year after.
3. Financial records: seven years, as required by Dutch law.
4. Social media connections: until the connection is removed or a deletion request is received.
5. Logs: up to 90 days.

Your rights

You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy of your data. Send your request through the contact page. We reply within one month.

You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Contact

Bidvise B.V., Mauritsstraat 1, 9724 BH Groningen, the Netherlands (Chamber of Commerce 82547858). Use the contact page on this website for any privacy question.