Privacy Policy

1. What data we collect

We only collect the data we actually need to run the service, answer your questions, and keep your account safe. Depending on how you use Best Auction, this may include:

Data you give us

• Account details — your email address and the password you choose when you sign up or sign in.
• Support messages — anything you write to us by email, including your contact details and the content of your message.

Data we collect automatically

• Device and connection data — browser type, operating system, device type, screen size, language settings and IP address.
• Usage data — which pages you open, which content you view, when you visit, and how you arrived at our site (for example from an advertisement or a search engine).
• Technical logs — error reports and security events that help us find and fix problems.

We do not ask for and do not want sensitive personal data such as health information, political opinions or biometric data. Please do not send us this kind of information.

2. How we use your data

We use your personal data for the following purposes:

• To provide the service — creating and maintaining your account, signing you in, and giving you access to our content.
• To support you — answering your questions, handling complaints and processing cancellation requests.
• To keep things secure — detecting and preventing fraud, abuse and unauthorised access.
• To improve the service — understanding which content and features are used so we can make the platform better.
• To meet legal obligations — keeping the records that Dutch and European law require us to keep.

Our legal grounds

Under the General Data Protection Regulation (GDPR) we process your data because it is necessary to perform our agreement with you, because we have a legitimate interest in running and securing a reliable service, because you have given consent (for example for non-essential cookies), or because we are legally required to do so. Where we rely on consent, you are free to withdraw it at any time.

3. Data sharing and disclosure

We do not sell your personal data, and we never trade it with third parties for their own marketing purposes. We do share data with a limited number of parties who help us operate the service:

• Hosting and infrastructure providers who store and serve our website and content.
• Analytics providers who help us understand, in aggregate, how the site is used.
• Support and communication tools we use to receive and answer your email.
• Professional advisers and authorities where we are legally obliged to disclose data, or where it is needed to establish or defend a legal claim.

These parties act as processors on our behalf. They may only use your data for the purpose we instruct, they are bound by a written processing agreement, and they must apply appropriate security measures. If data is transferred outside the European Economic Area, we make sure an appropriate safeguard is in place, such as the European Commission's Standard Contractual Clauses.

4. Security measures

We take the protection of your data seriously and apply technical and organisational measures that are appropriate to the risk. These include encrypted connections (HTTPS) for all traffic between your device and our servers, hashed storage of passwords, strict access control so that only authorised staff can reach personal data, regular software updates and patching, and monitoring and logging so we can spot unusual activity quickly.

No system on the internet is completely risk-free. If a data breach occurs that is likely to affect your rights and freedoms, we will report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and inform you without undue delay.

5. How long we keep your data

We keep your personal data only as long as we need it for the purposes described above. Account data is kept for as long as your account is active and for a limited period afterwards so we can handle any follow-up questions. Support correspondence is kept for up to two years. Technical and security logs are kept for a short period, typically no longer than twelve months. Where the law sets a longer retention period — for example for administrative records — we follow that period, and we delete or anonymise your data once it expires.

6. Your rights

You are in control of your personal data. Under the GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data where we no longer have a valid reason to keep it.
• Restriction — ask us to pause the processing of your data while a request or dispute is being resolved.
• Objection — object to processing that is based on our legitimate interest.
• Data portability — receive the data you provided to us in a structured, machine-readable format.
• Withdraw consent — withdraw any consent you have given, at any time, without affecting processing that already took place.

To exercise any of these rights, email us at [email protected]. We respond within one month. We may ask you to confirm your identity first, so that we do not hand your data to someone else. If you are not satisfied with how we handle your request, you are entitled to lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority.

7. Cookies and tracking

We use cookies and similar technologies — small files stored on your device — to make the website work and to understand how it is used. We distinguish between:

• Essential cookies, which are needed to keep you signed in, remember your language and protect against abuse. These cannot be switched off.
• Analytics cookies, which tell us in aggregate how many people visit, which pages they read and where they drop off, so we can improve the site.
• Marketing cookies, which help us measure whether our advertisements are effective. We only place these with your consent.

You can refuse or delete cookies at any time through your browser settings, and most browsers also let you block them in advance. Please note that blocking essential cookies may stop parts of the site from working as intended. We honour "Do Not Track" and similar browser signals where your browser sends them.

8. Children

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will remove it.

9. Changes to this policy

We may update this Privacy Statement from time to time, for example when we change our service, add a new tool, or when laws and guidance change. The date at the top of this page always shows when the most recent version was published. If a change is significant, we will draw attention to it on our website or notify you directly. We encourage you to read this page again now and then so you know where you stand.