Privacy Policy
Effective Date: 10.11.2025
Bidexia by Lumsden Auctions (LAO) is committed to protecting the personal data of its users in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).
1. Data Controller Information
The responsible entity for the processing of your personal data is:
| Detail | Information |
|---|---|
| Name | Lumsden Auctions Online (LAO) |
| Address | Calle Los Nazarios, 11B, Formentera del Segura, Alicante 03179, Spain |
| NIF/VAT | ESY6180200E |
| Telephone | 0034 966 792 839 |
| Email (general) | info@bidexia.com |
| Email (privacy/rights) | privacy@bidexia.com |
2. Types of Data We Collect
We distinguish between two main categories of data:
Personal Data (Personally Identifiable Information - PII): Data that identifies you directly or indirectly. This includes your name, surname, user ID, email address, postal address, telephone number, and payment details (processed securely by payment processors). Anonymous/Usage Data: Information about your interaction with our site (IP address, pages visited, device information, browser type). We use this data aggregated and cannot use it to identify you individually unless linked to your PII due to security or legal reasons.
3. Purposes and Legal Basis for Processing
We process your data only for specific, explicit, and legitimate purposes, based on the following legal grounds established by the GDPR:
| Purpose of Processing | Personal Data Involved | Legal Basis (GDPR Art. 6) | Retention Period |
|---|---|---|---|
| A. Account registration and auction management | Name, email, address, telephone, user ID, password. | Performance of a contract: necessary to fulfil LAO's Terms of Service (account setup, bidding). | For as long as the user remains a registered member. |
| B. Carrying out transactions | Buyer and seller contact details, transaction details. | Performance of a contract: necessary for buyer and seller to complete purchase and delivery. | 3 years from the transaction date, to cover legal and tax obligations. |
| C. Marketing communications (newsletter) | Email address. | Consent: explicit consent obtained through an opt-in mechanism. | Until the data subject withdraws consent. |
| D. Fraud prevention and security | IP address, usage data, transaction history. | Legitimate interest: fraud prevention and protection of LAO's property and rights. | 12 months after collection, unless linked to a security incident. |
| E. Legal and tax compliance | Transaction data, financial records. | Legal obligation: compliance with Spanish tax and accounting law. | The mandatory period set by law (e.g. 4 or 6 years). |
4. How We Collect Your Data (Consent Compliance)\
A. Contractual Data (Lawful Processing)
We collect data necessary for the Execution of the Contract during the registration process and when you place a bid or list an item.
B. Marketing Data (GDPR Consent)
For the purpose of sending you commercial communications about new features, services, or offers from LAO (Purpose C), we will only do so if you provide specific and explicit consent by ticking a clear, unticked box during registration.
5. Sharing of Personal Data (Recipients)
We only share your data when strictly necessary, and we ensure all recipients adhere to GDPR standards.
A. Required Sharing for Transaction Completion (Purpose B)
Other Users: When a transaction is finalized (winning bid), we share the necessary contact information (Name, Email, Phone, Address) of the Buyer with the Seller, and the Seller with the Buyer, solely for the purpose of completing the sale. B. Third-Party Service Providers (Data Processors)
We engage third parties (Data Processors) to help us run our services. These parties act strictly on our instructions and cannot use your data for their own purposes:
Payment Processors: Stripe, PayPal for securely processing payments. C. Transfers to Third Parties for Marketing (Original Concern)
We DO NOT share or sell your Personal Data (PII) with "select sponsors and partners" for their marketing purposes without your specific, explicit, and separate consent.
D. Legal Disclosure
We may disclose your information if legally required to do so by Spanish or EU law, or in response to a valid request from a competent authority (e.g., police, court order, tax authority).
6. International Data Transfers
Your data is primarily processed within the European Economic Area (EEA). If we transfer your data to a country outside the EEA (e.g., to a US-based cloud provider), we will ensure that an adequate level of protection is maintained through the use of Standard Contractual Clauses (SCCs) approved by the European Commission or other legally recognized safeguards.
7. Use of Cookies
We use cookies to enhance your experience. Our use of cookies is governed by a separate Cookie Policy and is subject to your consent.
8. Your Rights as a Data Subject (GDPR Chapter III)
As a user, you have the following rights over your personal data:
| Right | Description |
|---|---|
| Access | You may ask us to confirm whether we are processing your personal data and, if so, obtain a copy of it. |
| Rectification | You may ask us to correct inaccurate or incomplete data. |
| Erasure (right to be forgotten) | You may ask us to delete your data where, among other reasons, it is no longer necessary for the purposes it was collected for. |
| Restriction of processing | You may ask us to restrict processing in certain circumstances (for example, while a rectification request is being handled). |
| Data portability | You have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller. |
| Objection | You may object to the processing of your data, particularly for direct marketing. |
| Withdrawal of consent | You may withdraw consent at any time for processing based on it (for example, newsletters). |
Exercising Your Rights
You can exercise these rights by sending a written request to the dedicated Privacy Email: privacy@bidexia.com or by postal mail to the address in Section 1, including a copy of your ID or passport for verification purposes. We will respond to your request within one month.
Right to Lodge a Complaint
If you believe that LAO has not adequately addressed your rights, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): Agencia Española de Protección de Datos (www.aepd.es).
9. Security Measures
LAO maintains appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, pseudonymization, firewalls, and strict access controls. Only authorized employees have access to the data, and they are bound by confidentiality agreements.
10. Changes to the Privacy Policy
LAO reserves the right to modify this policy at any time. We will notify you of any material changes via email or prominent notice on our website prior to the change becoming effective.