Privacy Policy
Last updated 15/09/2026.
This policy explains what personal data Bidexia collects, why, on what legal basis, who receives it, how long we keep it, and how you can exercise your rights. It follows the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Spanish Organic Law 3/2018 (LOPDGDD).
1. Who is responsible for your data
| Detail | Information |
|---|---|
| Controller | Michal Maciazek, trading as Lumsden Auctions |
| NIF | Y6180200E |
| Address | Calle Los Nazarios 11B, Polígono Los Nazarios, 03179 Formentera del Segura (Alicante), Spain |
| Privacy contact | [email protected] |
| General contact | [email protected] · +34 966 792 839 |
We have not appointed a Data Protection Officer, as the law does not require one for our activity. Write to [email protected] with any question about your data.
2. The data we collect
If you buy on Bidexia
- Account: name, email address, phone number and password. We store your password only in an irreversible (hashed) form.
- Sign-in security:
- the one-time codes we email you, stored only in a form that cannot be read back
- a token for each device you ask us to remember
- technical data about your browser and connection, checked by our anti-bot service (see section 4)
- Activity: your bids, maximum (proxy) bids, withdrawn bids, watched lots, saved searches and language preference.
- Purchases: the lots you win or buy, your billing address, the payment method you choose and the payment reference.
- If you pay at our counter, we record who received the payment.
- We also record your signature if you choose to sign.
- Receipts: your name, email, address and, if you give it, your tax number, as printed on your receipt.
- Messages: what you write to us, and the service emails we send you.
- Analytics: how you use the site, only if you accept analytics cookies (see our Cookie policy).
If you sell through us (consignors)
- Identity:
- name, date of birth, and ID document type, number and issuing country
- a copy of your ID document
- for companies: company name, tax number and registration details
- Contact details and address.
- Payment details: bank account (IBAN) and account holder.
- Tax status: whether you sell as a private individual.
- Sales records: your lots, sales, statements, payouts, commission invoices and, for payouts in cash, the signed receipt.
Staff
We keep staff accounts for our dashboards (name, email, role) and a record of the actions they take on payments and payouts.
We do not collect special categories of data (health, beliefs and so on). You must be 18 or over to use Bidexia, and we do not knowingly collect data from minors.
3. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Creating and running your account; running auctions; confirming bids, wins and purchases; watchlist and saved-search emails you set up | Account, activity, purchases | Contract: needed to provide the service you signed up for |
| Taking payment, issuing receipts, arranging collection, handling claims about a lot | Account, purchases, receipts, messages | Contract |
| Keeping accounting and tax records; issuing commission invoices to sellers; reporting to the tax authorities where the law requires it | Purchases, receipts, sellers' identity, tax and sales data | Legal obligation: Spanish commercial and tax law |
| Protecting accounts and auctions: sign-in codes, anti-bot checks, rate limits, refusing disposable email addresses, detecting fraud and shill bidding | Account, sign-in security, activity | Legitimate interest in the security of the platform and of our users. Without these checks, fake accounts could manipulate prices. |
| Verifying sellers' identity and their right to sell, and paying them | Sellers' identity, contact and payment details | Contract, and our legitimate interest in not selling stolen goods |
| Establishing or defending legal claims | Whatever is relevant to the claim | Legitimate interest |
| Site analytics | Usage data | Consent, which you can withdraw at any time |
The phone number is required when you register. We use it to contact you about a lot you have won or need to collect, and as part of our fraud prevention. Without it we cannot open an account.
Automated decisions. Our anti-bot and email checks can refuse a sign-up or sign-in attempt automatically, for example from a disposable email address or an automated script. This is a security measure, not a decision about you as a person. If you think you have been refused in error, write to us and a person will look at it.
4. Who receives your data
We never sell your data.
- Other users.
- Bids are shown publicly as an anonymous "Bidder", never with your name.
- Each lot shows a random code for its current leader. The code is different on every lot, so it cannot be used to follow you across lots.
- Sellers. When you buy a lot, we act as the seller's agent. We do not give the seller your contact details. We share only what is needed to resolve a claim you make about the lot.
- Service providers that process data on our behalf, under contract and only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Contabo | Servers that host the site and database | EU |
| Cloudflare, Inc. | Delivering and protecting the site; anti-bot check (Turnstile) on sign-in and sign-up | EU and USA |
| Resend | Sending the site's emails: codes, bid and purchase emails, receipts | EU |
| Google Ireland Ltd. | Site analytics, only with your consent | EU and USA |
| OpenRouter, and the AI model it routes to | Helping our staff draft lot descriptions from photographs of the items. No buyer data is sent. | USA |
We will add our online card payment provider to this list before card payment is switched on, and our carrier before delivery is.
- Authorities. The tax authority (Agencia Tributaria), courts, police or other authorities, where the law requires it.
- Professional advisers (accountant, lawyer), under a duty of confidentiality.
5. Transfers outside the European Economic Area
Some providers above are based in the United States or may process data there. We rely on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework, or on the Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
6. How long we keep your data
| Data | How long |
|---|---|
| Account | Until you close it. We then delete it, except for the records below. |
| Purchases, receipts, invoices, payouts and statements | 6 years from the end of the year they relate to (Código de Comercio, art. 30), which also covers the 4-year tax period |
| Bids and auction history | As part of the lot's sale record, for the same 6 years |
| Sign-in codes | Valid for 10 minutes; deleted within 24 hours |
| Remembered devices | 30 days, then deleted |
| Sellers' identity documents | 10 years |
| Messages to us | As long as needed to deal with them, and up to 6 years where they relate to a sale or claim |
| Analytics | 14 months |
When a period ends, we delete or anonymise the data.
7. Your rights
You have the right to:
- access your data and receive a copy
- rectify inaccurate data
- erase your data (the "right to be forgotten"), except where we must keep it by law
- restrict our use of it in certain cases
- object to processing based on our legitimate interest
- portability: receive the data you gave us in a machine-readable format
- withdraw consent at any time, where we rely on it. This does not affect what we did before.
To exercise any right, write to [email protected] from the email address on your account, or by post to the address in section 1. We reply within one month. We will ask for proof of identity only if we have reasonable doubts that the request is yours.
If you are not satisfied with our answer, you can complain to the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid).
8. How we protect your data
- All traffic to the site is encrypted (HTTPS).
- Passwords, sign-in codes and device tokens are stored only in a form that cannot be read back.
- Staff access is limited by role: for example, a photographer cannot see buyers or payments.
- Sellers' identity documents are kept in private storage, separate from the site's public images.
9. Changes to this policy
If we make material changes, we will tell you by email or with a notice on the site before they take effect. The date at the top shows the current version.