Privacy policy

Our role

Bidvise is the controller for data about visitors of bidvise.com, people who contact us, and users and billing contacts of Bidvise accounts.

Auction houses use Bidvise to run their auctions and websites. For the data of their bidders, buyers and consignors, the auction house is the controller and Bidvise processes that data on its behalf. Questions about that data are best sent to the auction house; its own privacy policy applies.

What we process

1. Contact and demo requests and newsletter sign-ups: name, email address, company, website, type of organisation, phone number if given, how you heard of us, the page the form was sent from, the message, and IP address and browser details for spam protection.
2. Dashboard accounts: name, email address, role and permissions, login and audit records.
3. Billing: company details, contact person and invoices for our subscription.
4. Technical data: IP address, browser and request logs needed to run and secure the service.
5. Connected social media accounts (see below).
6. Advertising cookies on bidvise.com, only after consent (see below).

Cookies, Google Ads and Google Analytics

After acceptance we also load Google Analytics 4 to measure how the website is used: pages visited, duration, device and country, and which source a visit came from. Google does not store IP addresses for this. Event data is kept for 2 months and user-level data for 14 months, after which Google deletes it. The Google Analytics cookies (_ga) last up to 13 months and are removed when consent is withdrawn.

bidvise.com sets no cookies for advertising or analytics until you accept them in the cookie banner. Fonts are loaded from Google Fonts, which sees your IP address; no other third party is contacted before consent.

After acceptance we load the Google Ads tag. Google then sets cookies for two purposes. First, measurement: we can see whether a visit that came from a Google advert led to a contact request. Second, remarketing: Google keeps a list of visitors of bidvise.com so that Bidvise adverts can be shown to them on other websites and in Google services. Membership of that list ends after 90 days. Google Ireland Limited receives your IP address, browser details, the pages visited and the advert clicked, and may transfer this data to Google LLC in the United States under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. Google is an independent controller for how it uses this data in its own services; see Google's privacy policy.

Consent can be withdrawn at any time with the "Cookie settings" link in the footer. Rejecting or withdrawing has no effect on the use of the website. Withdrawing removes the Google Ads cookies from your browser, which last up to 90 days; an existing membership of the remarketing list at Google is not undone by that. It ends after the period above, or earlier through Google's ad settings at adssettings.google.com.

Facebook and other connected accounts

An auction house can connect its Facebook Page to Bidvise to publish posts about its auctions.

When a Page is connected we store: the Page ID and name, an encrypted access token, the app-scoped ID of the Facebook user who authorised the connection, and the posts published through Bidvise with their Facebook IDs and status.

We use this data only to carry out what the auction house asks for in Bidvise: publishing posts. We do not sell it, do not use it to build profiles and do not share it with third parties other than Meta itself.

The connection can be ended at any time by removing it in Bidvise or by removing Bidvise in the Facebook settings under Apps and websites. See the data deletion page for what happens then.

Legal bases

1. Performance of a contract: accounts, billing and the features an auction house uses.
2. Legitimate interest: security, logs, answering questions and improving the service.
3. Consent: the newsletter, which can be withdrawn with the link in every email, and the Google Ads and Google Analytics cookies, which can be withdrawn with the "Cookie settings" link in the footer.
4. Legal obligation: financial records.

Service providers

We use a small number of providers who process data on our behalf under a data processing agreement, including Fly.io (hosting and database, EU region), Cloudflare (website hosting and DNS), Twilio SendGrid (email delivery), Upstash (cache) and Amazon Web Services (file storage). Where a provider is located outside the European Economic Area, transfers take place under the EU Standard Contractual Clauses or an equivalent safeguard.

Retention

1. Contact requests: as long as needed to handle the request and any follow-up; removed earlier on request.
2. Account data: for the duration of the contract and up to one year after.
3. Financial records: seven years, as required by Dutch law.
4. Social media connections: until the connection is removed or a deletion request is received.
5. Logs: up to 90 days.

Your rights

You can ask for access to, correction or deletion of your data, restriction of or objection to processing, and a copy of your data. Send your request through the contact page. We reply within one month.

You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Contact

Bidvise B.V., Mauritsstraat 1, 9724 BH Groningen, the Netherlands (Chamber of Commerce 82547858). Use the contact page on this website for any privacy question.