Data Protection & Privacy Notice
Last Updated: 1 October 2024What’s new in this version:Clarification of legal bases for certain data usesExplanation of account deletion processHow we're using personal data with artificial intelligenceCatawiki is the leading Online Marketplace for special objects that fulfil people’s passions.When you visit our website and/or use our app(s) (also referred to in this notice as “our Online Marketplace”), we process your Personal Data. What data you share with us and how we will use it, depends on whether you are just visiting our Online Marketplace or act as a Buyer or a Seller. We are dedicated to treating your Personal Data with care and respect. This data protection notice is intended to explain to you what we do with your data, and why. You can also read about the rights you have under the applicable data protection laws.Legal:Catawiki B.V. and its subsidiaries in different countries (“Catawiki”) process Personal Data from Users, (prospective) employees, as well as from visitors to our Online Marketplace. Catawiki has its main European establishment in Amsterdam, the Netherlands. This data protection & privacy notice explains what Personal Data we process, why we do so and how this is done. It also explains your rights under the applicable data protection laws, including the European Union’s General Data Protection Regulation (“GDPR”). Capitalised terms are included in the Glossary available on the website. This data protection & privacy notice is designed to provide transparency into our data protection practices and principles in a format that our users can navigate, read and understand. Since Catawiki is based in the Netherlands, we follow the GDPR. We also strive to make sure our data protection practices comply with the laws in every country where we operate.Our Data Protection Principles1. TransparencyWe want you to feel confident about how your Personal Data is handled. When you use our Online Marketplace, we ensure full transparency about what happens to your data. If you have any questions or need more information, our support team is always here to help. Please reach out to us using the contact details below.2. TrustYour trust is paramount. We are committed to safeguarding your Personal Data with the highest level of security. Our dedicated security team continuously monitors our systems to prevent any risks, while our trust and safety team works hard to detect and address potential fraud. We take every precaution to ensure that your data is protected and used responsibly.3. RelevanceWe use your Personal Data to enhance your experience on our Online Marketplace and to tailor our services to better meet your needs. We strive to only collect data that is necessary and to keep it only as long as needed. When data is no longer relevant, we ensure it is securely deleted to respect your privacy and maintain the quality of our services.We Are Here To Help YouIf you have any questions about this data protection notice, or how Catawiki processes your Personal Data, please reach out to our data protection team via privacy [at] catawiki.com. You can also reach out to us in writing using the below contact details or by contacting our customer experience team (“contact us” button below).Catawiki B.V.Attn. Data Protection TeamSint Jorissteeg 2NL - 1012 XV AMSTERDAMThe NetherlandsProcessing Your Personal DataCatawiki wants to be a reliable and responsible Online Marketplace where you can find the special objects that fulfil your passions. In general, Catawiki will collect and use your Personal Data in order for us to run our business in a meaningful way. This includes making our Online Marketplace available to you, keeping it up to date and ensuring that our Online Marketplace can function, that Sellers can Sell Objects in auction, and that Users are able to make a bid on, and buy these Objects. We use some of your Personal Data for analytics, for example to understand trends in the respective categories and for marketing purposes, as well as to help our users find the object they love at a fair price. Furthermore, we use Personal Data to meet our legal obligations, for example for reporting to the tax and other supervisory authorities. Visiting our Online Marketplace The Personal Data we collect on our Online Marketplace and from our Users reveal how people find and use Catawiki, what they may be interested in and where our visitors are coming from. This helps us to further improve our product and services, for example by analysing if Objects can be found easily, as well as to ensure our Online Marketplace functions properly. We also collect statistics on the number of visitors on a daily and monthly basis, which explains to us how our business grows. Until you create an Account and/or sign in to our Online Marketplace, we only collect technical information. This includes your IP address, information about the device you use, access times, etc. We might use general information about you, like your location, to personalise your experience by showing you items that are available near you and more likely to interest you. This also helps us figure out shipping costs. We won't use this information to identify you.Once you have provided us with your permission, also known as “consent”, we also collect electronic identification data from your browser or device by making use of cookies (small text files your computer sends each time you visit our Online Marketplace) and similar technologies on our Online Marketplace. This data will include a cookie ID, your browsing behaviour on our Online Marketplace, and which Object(s) you like, as well as mobile device identifiers (e.g. IDFA or GAID). These data elements also allow us to test new functionalities. For more information on our use of cookies, please read our Cookie Policy.It is in Catawiki’s legitimate interest to collect the main technical data when you visit and use our Online Marketplace, for the reasons explained above. However, when it comes to cookies and similar data that is used for analytical and advertising purposes, we rely on your consent. Using our Online Marketplace and Creating an AccountIf you want to explore what special Objects Catawiki has to offer, you do not need an account. However, if you want to start bidding on an Object you are passionate about, or if you have an Object you would like to sell on Catawiki, you will need to create an Account. This will also allow you to follow Objects and Online Auctions and to save searches, so we can make sure you don’t miss anything you like. Once you create an Account, we ask you to provide us with your email address and to choose a secure password. Next, we register your first and last name, your email address, your phone number and your password. Our system collects some technical data, including your IP address and information about the device and operating system you are using. You will also be assigned a User ID, which is the main data element for Catawiki to bring your Personal Data together across our systems. In addition, cookies help us to recognise your device(s), store your language preferences, and keep you signed in, so you don’t need to keep signing in every time you use Catawiki. You can also use a social media profile, such as Facebook, to create an Account. If you create an Account using social media, we will receive some basic information from your profile, including your email address. We might also receive information about your status updates or content you’ve viewed or clicked on while using that social media account. You can always check and change the privacy settings of the relevant social media platform, and this will update what data we have access to. We would like you to use all the features of our Online Marketplace that are specifically relevant to you. Therefore, we will ask for some extra information, like your address and possibly your date of birth. If you want to become a Seller, we may ask for your bank account number and, if applicable, the VAT number and chamber of commerce number of you or your company. In your profile, you are also able to set your preferences for the language in which you use our Online Marketplace, and the currency in which you would like to see the prices.How We Further Process Your Personal DataBased on your contract with usWhen you create an Account, you need to agree to our Terms of Use (including, for the avoidance of doubt, the Buyer Terms and the Seller Terms). Because of this, a legally binding agreement is in place between you and us, giving us the legal basis to process the Personal Data in your Account. This includes the processing of your Personal Data for the following reasons:We want to make sure Catawiki is open for business in your country, either for buying or selling, and to do so, we use your address. We also use your address to make sure that the Object(s) you bought or sold in an Online Auction can be shipped to you or picked up at your address.Your date of birth is used to ensure you are at least 18 years of age, and eligible to create an Account. It can also be used to verify whether you are allowed to buy certain age-restricted items, subject to national laws.Sometimes it is helpful if we can contact you. To do so, we use your email address and phone number. Both are also used to facilitate the shipping of items you have bought or sold via our Online Marketplace.If you buy or sell something on Catawiki, the payment needs to be processed, both by us and by our Third Party Service Providers. All records of transaction and payment data (including invoices, price and date of payment, the payment method, payment status, bank account, and/or credit card details) are collected and retained for payment and billing purposes. Your financial data are also used to make sure you can make or receive payments or refunds. We are happy to see our Users become Sellers on Catawiki. If you want to sell an Object, you will also need to create a Seller profile within your Account. To do so, we, or one of our verification partners, may ask for additional information. In some situations, we are by law required to verify your identity, meaning you will be asked for a scan or photo of a government-issued photo ID (proof of identification), which clearly shows at least your full name, date of birth and ID (document) number.When you communicate with other Users through the internal messaging system offered on our Online Marketplace, for example about an Object you bought or sold, your User IDs and technical details about the connection (including the IP addresses), as well as the content of the communication, are logged, so you can rely upon them for further communications. We may use this data to help settle disputes between users or to investigate claims.Your contact details and Buyer/Seller information may be used to provide customer support, in case of questions or difficulties with a purchase or a sale via our Online Marketplace. Contact with our Customer Experience team may also include details about your request, including on the Object(s) and payment(s). If you contact our customer experience team via phone, your call will be recorded for quality and training purposes. If you prefer that we do not keep your recording, please feel free to let us know, so we can delete it immediately. Finally, we can also collect information if you reach out to us through your social media account, for example via Facebook Messenger. Keep in mind that we don’t use this chat as our official channel for handling questions or complaints. We still try to respond to your messages in time and to provide you with further information or assistance if necessary. The general terms and privacy policy of the relevant social media provider are applicable when you use their services. Our Legitimate InterestThere are situations where Catawiki needs to process the Personal Data we have about you for other reasons than those directly related to the contract you have with us. We consider we have a good reason to do so, legally called a legitimate interest, in any case in all the situations listed below. There could also be others. If you disagree, feel free to contact us, so we can see if we need to revisit our approach for your specific situation. For email communications, you can also go into your Account and opt-out. For phone calls, you can let us know you do not wish to be contacted. We want to help you when you set up your Account, so we will send you several email messages, for example to ask you to confirm your email address, or to give you information on how to use our Online Marketplace. We also send you a text message on your mobile phone number, to verify the number is real.We want to help you discover items you'll love! As an active user, we'll send you emails like newsletters and surveys to keep you in the loop. We also use your activity on our platform (like your likes and favourites) to make these emails more relevant to you. Additionally, we may use some of your information to show you relevant Catawiki ads on other websites. You're always in control: You can manage your email preferences and opt out of personalised ads anytime in your account settings.FWe want to make sure you do not miss out on Objects or Online Auctions you are following, so we send you email messages and in-app notifications, for example to alert you an Online Auction you are following is closing soon, or to confirm your bid.Sometimes, even if you didn't win an auction, we may contact you with another chance to buy the item or to let you know about similar items you might like, based on what you've shown interest in before.Our sales team wants to make sure you have the best experience when you start selling. They may send you email messages or call you, for example to provide assistance with onboarding and Account creation, and with the submission of Objects for Online Auction, to invite you to participate in specific themed and partnership Online Auctions, or to support you to grow your business on Catawiki.Our data team helps us to understand how you use our Online Marketplace, including bids, purchases and Objects offered on the platform as well as what pages and categories you visit and favourite. This allows us to make improvements to our Online Marketplace and give you the best possible user experience. We also use data for market analysis and to improve our sales process.We want to make sure you get the best possible customer service. To do so, we need to train our teams. Our customer experience team may therefore listen to recent calls from Users, or colleagues may listen in live to calls to provide immediate feedback. To make sure Catawiki is a secure, trusted platform for both Buyers and Sellers, by spotting and combating fraud, money laundering, and other non-compliant use of our Online Marketplace. For example, our trust and safety operations team uses Personal Data to look into Users who don’t comply with our Terms of Use and our systems can match various data points to (temporarily or permanently) block these Users from using our Online Marketplace. We also process your Personal Data for system integrity purposes (for example, to prevent hacking or credential stuffing attacks), to register, mediate, and resolve possible disputes or irregularities or to enforce our Terms of Use and other policies. If a contract has been entered into between you and another User (the “Contract of Sale”) and there is an issue or dispute, we might provide certain information to help you resolve the issue directly with that User. We also use prediction models to determine whether we need to ask certain Users for a form of payment security or obstruct their Bid or payment. We use your bidding, buying, or selling history and location to predict the chances of the Contract of Sale being cancelled. Based on the outcome of this model, we may ask you to verify your credit card before placing a Bid as a safety measure. If you haven’t logged in for a while, or want to change key data in your account, we may ask you to reconfirm your identity through our login system.We want to make sure our website is reliable for you to use. Therefore, we review, scan, or analyse all activity on our Online Platform as well as your messages with other Users via our internal messaging system, for fraud prevention, risk assessment, investigation, or support purposes.Finally, all Personal Data can be used to implement and operate company policies and procedures, to respond to any claims against us and to protect the rights, property, or personal safety of Catawiki, our Users, or the public. We can also use these data to make corporate transactions, such as any merger, sale, reorganisation, acquisition, bankruptcy or similar event and for other legitimate business purposes permitted by applicable law.From time to time, we may initiate new data processing activities that rely upon legitimate interest. These will be included in this data protection & privacy notice when it is next updated. Under a Legal ObligationWe are under a legal obligation to process certain types of Personal Data. This includes the processing of Personal Data for the following reasons:To ensure all Users are who they say they are and are allowed to conduct business on our Online Marketplace, your contact details and, where appropriate, a copy of your government issued ID and other additional information (such as company registration documents if you are a professional Seller), are used for identity verification in light of applicable laws, including for anti-money laundering. We use a Third Party Service Provider to support us in this process. Where required by law, some personal or company data of professional Sellers is also disclosed on the Seller detail page.To ensure all transactions are reported to the tax authorities and can be audited in a proper manner, we retain records of transaction and payment data. In addition, in certain countries we have the obligation to provide (at least) annual updates about our Sellers and their activities on the platform with national authorities in the countries where we do business, including tax authorities. To this end, it may be required for you to add additional information to your account, like a Central Packaging Register number, your Tax Identification Number or your place of birth.In some countries, we are obligated to discover and take down harmful or illegal content from our Online Marketplace. To this end, we may screen Information included in Object descriptions as well as the content of our internal messaging system.ConsentFinally, we may process your Personal Data with your consent. We try not to bother you too much with consent requests, unless we are under a legal obligation to do so or if there is no other option. We use your Account information with your consent for the following reason:We like to ensure that if we show you advertisements outside of our Online Marketplace, they are relevant to you. To do so, we may use the data from cookies and other trackers on your device.We collect some basic information about how our site is used, but we'd love to learn more about your specific experience. This helps us make our marketplace even better. We'll only collect this extra information with your permission.To get your feedback on your experience when buying or selling on Catawiki. In these cases, we will only process Personal Data (such as your email address or User ID) for our internal analytics, which help to enhance our Services. We may also process the opinions, experiences, preferences and interests and reviews that you provide to us with other Users or share with us online or through social media. For more detail, please also review our Buyer Feedback Policy.If you want to subscribe to available newsletters without creating an account.To use your image for marketing campaigns.Please note that you may withdraw your consent at all times. The section on Your Rights below provides more detail.Sharing Information with Third PartiesLegally speaking, Catawiki is the “data controller” for all Personal Data we process. That means that we take the decisions about how and why your Personal Data is processed. It also means that any question you may have about how your Personal Data is processed can be raised with us, even if this is done by one of our Third Party Service Providers. Exception: Joint ControlThere is one exception to the rule that Catawiki acts as data controller. We partner with Criteo, as part of our online advertising strategy. In order to ensure the right advertisement is shown to the right people, Criteo and Catawiki are jointly responsible. To this end, we have concluded a so-called joint controller agreement. This agreement explains, among other things, that you can always address any questions you may have about our partnership to both Catawiki and Criteo. Furthermore, your Personal Data will only be processed for online advertising purposes if you accept the advertising cookies when visiting our Online Marketplace. If you have already accepted the cookies, but change your mind, you can do so via our cookie settings. Please also take a look at Criteo’s Privacy Notice, which provides further information.Sharing of Personal Data with Buyers and SellersSometimes, it is necessary that Catawiki shares your Personal Data with another User of our Online Marketplace. There is a number of possible scenarios, each of them related to the preparation and execution of the Contract of Sale which include:If you buy an Object from another User, the item needs to be shipped to you upon reception of payment. We will share your address and contact information (including phone number and email address) with the Seller so they can arrange shipping. When the item is marked to be picked-up by you, we may also share the address and contact information of the Seller with you. If there is an issue or conflict between the Buyer and the Seller, for example regarding the delivery or the condition of an object, we may share the contact information of the Seller with the Buyer. Reversely, if a Buyer has not paid for a purchased Object in time, we may provide the contact information of the Buyer with the Seller. In both situations, the contact information is shared to enable the Users to defend their legal rights and possibly pursue legal action. If a Contract of Sale is cancelled by a Buyer under consumer protection rules (the so-called cooling off period), there can be limited situations where Catawiki will still have to share your contact details with the Seller, for example in support of legal proceedings. When we agree to such data sharing, we see this as a so-called compatible use of the data processed as part of a Sale.If you receive another User’s Personal Data, you can only process these data to perform your obligations, or to remedy any issues under, or arising from, the Contract of Sale. You shall always process Personal Data in accordance with applicable (data protection) laws and regulations. Without consent from the User in question, you may not use any Personal Data for (other) commercial purposes, for instance to send marketing messages, other unsolicited communications or otherwise approach the User for such purposes. Please note that Catawiki may take certain measures in line with our Terms of Use when misuse of personal data is confirmed.In addition to the contractual reasons above, we may share your Personal Data if you have given us consent to do so. This can for instance include the following situation:In special cases, if you're interested in a high-value item and the Seller allows it, we can connect you directly, so you can arrange to see the item in person before placing a bid.Should there be a need for a refund, we may ask you for your consent to share your banking information with another User. This way, the refund can be handled between the Buyer and Seller directly. Companies processing Personal Data on behalf of CatawikiCatawiki uses multiple Third Party Service Providers to help us process your Personal Data. These include companies that provide our office software, host our website, run our databases, run our advertisements, or are involved in other ways in the processing of Personal Data. Just to be clear: your Personal Data will at all times be processed by our Third Party Service Providers under our instructions. Contracts are in place to ensure your expectations and our obligations regarding data protection and data security are met. Where relevant, we conduct a risk assessment before a contract is concluded.The following categories of Third Party Service Providers may process your Personal Data as part of our operations:Customer relationship management software providersEmail and messaging servicesWeb hosting services Office software providersPayment service providers (including identity verification)Website security providersShipping companies and warehouses Ancillary service providers, e.g. to help estimate shipping costs and VAT ratesInsurance companiesOnline advertisers and advertising networksData analytics service providers Social media networks Organisations processing your Personal Data for their own reasonsSometimes, Catawiki will need to share your Personal Data with organisations that will process the data for their own reasons. This is often the case when there is a legal obligation to process your data. If indeed your Personal Data is processed by an organisation for one of the reasons mentioned below, you need to be aware they (also) do so under their own responsibility. Payment service providers (including identity verification)Government authorities (including tax and law enforcement authorities)AuditorsDebt Collectors In addition, your Personal Data may be disclosed to one or more other organisations as part of any investment, merger, (partial) sale or (partial) transfer of our assets. Should that ever happen, we will try to inform you in a timely manner.Use of Social MediaCatawiki is active on social media platforms, including Facebook, Instagram, Twitter, TikTok and LinkedIn, where you would be able to interact with us. Please note that in all situations, the terms of use and privacy policy of the respective social mediums would apply.If you interact with Catawiki on social media, we will in any case process your Username and any additional information you share with us. If you contact us as part of a customer support request, this information may also be connected to your User ID in our customer relationship management systems.Our sales team sometimes looks for potential sellers on social media and other public websites. If we contact you, we can add your information to our records. You can always let us know if you don't want us to contact you again, and we'll remove your information.Artificial Intelligence (AI)We use AI to enhance your experience and keep our platform safe. AI is built into multiple processes, some of which also interact with our users. These include the following:The chatbot and phone menu provided by our customer experience team will help to get you a faster response to questions you may have.The “For You” Feed is tailored to the personal profile of a user.Search results, as well as the order in which results are shown, can be tailored to the personal profile of a user.Auction results are analysed to help suggest Reserve and Buy Now pricingRisk assessments are conducted to fight fraud and money laundering via our platform, helping to keep it secure.Cross-border Data TransfersPersonal Data you entrust to Catawiki will primarily be processed by Catawiki B.V. in the Netherlands. However, our Third Party Service Providers are not all located in the Netherlands, which means your Personal Data is likely to be hosted in other countries, including outside of the European Economic Area. We respect the rules set out by the GDPR, local data protection rules and applicable guidance from supervisory authorities, also when your Personal Data is processed in other countries.How We Protect Your Data When It's TransferredWhen we need to share your data with companies outside of the European Union, we make sure it's still protected. In some cases, we rely on official decisions from the European Commission that confirm other countries have strong data protection laws, similar to the GDPR.If there's no such decision, we put legal agreements in place with those companies to make sure they handle your data carefully. We also check for any potential risks with sharing your data, especially when working with new companies or updating existing agreements. Where Your Data May Be ProcessedSome of your information may be processed in the United States, as many of our service providers are based there. We take your privacy seriously, even when your data is outside of Europe. We use strong encryption to protect your data while it's being stored or transferred.We have agreements with our service providers to keep your data confidential.In rare cases, we may need to share your data if required by law, for example, if we receive a court order.Data Security & RetentionKeeping Your Data Safe and SecureThe security, integrity, and confidentiality of your Personal Data are important to us. We use a combination of technical, organisational, and physical safeguards to keep your data secure and prevent unauthorised access.This includes the use of software to detect potential fraudulent accounts or activities, which can lead to the automated suspension or blocking of an account. This qualifies as automated decision-making. However, such automated decisions are always reviewed by our trust and safety operations team.We take the protection and security of your information and data seriously. We're constantly updating our systems to protect your information. While no system is completely foolproof, we're committed to doing everything we can to keep your data safe.How Long We Keep Your DataWe only keep your personal data for as long as we need it. Generally, this means we'll keep it as long as you have an active account or as long as we're legally required to.If your account is inactive for three years, we'll consider it inactive and may delete it at the beginning of the following year. We'll contact you before deleting your account to give you a chance to keep it active.Phone Call RecordingsIf you call our customer support team, we may record the call to help us improve our service. These recordings are only accessible to a few employees and are automatically deleted after two weeks, unless you or one of our team members requests to keep it for longer due to an ongoing issue.Other DataFor any other personal data we collect, we have specific retention periods based onthe specific reason we collected it.Account DeletionIf you wish to delete your Account, you can request to do so on your Account settings page in line with our Individual Rights policy. Once your Account is deleted, we will also initiate the deletion of the Personal Data associated with your Account as soon as possible, but in any case within one month. We will also notify our Third Party Service Providers that you have requested to delete your data, and request them to do the same. There are situations when your account cannot be deleted yet, for example when you have recently bought or sold an object on our platform, if your account is currently suspended or blocked, or if your account is reportable for the current or preceding year under applicable tax legislation. If that is the case, you will be notified on screen when you try to delete your account. You may always reach out to our data protection team for further information. Some data cannot be deleted straight away when you close your Account. For example, we are under a legal obligation to retain all financial information for tax reporting purposes for up to 10 [ten] years, depending on the jurisdiction. Catawiki will also retain a record of the User ID that was associated with your Account for statistical purposes. However, in our databases this User ID will no longer be associated with any information that directly identifies you as a former User of our Online Marketplace. We will not, nor are we allowed to, use the information that is retained as part of our financial administration to re-identify you once you have deleted your Account, except in support of a legal procedure.Your Rights and ChoicesCatawiki gives you the ability to make certain choices about what Personal Data we collect from you and how these data may be used. You can make these choices via our cookie banner, as well as via your Account settings. Please be aware however, that depending on your choices, we may not be able to give you the full Catawiki experience. Some of our services may, for example, not be able to take account of your interests and preferences. Where this is the case, we will try to let you know upfront what added value the collection of your Personal Data will have, and what the consequences are of opting-out, so you can make an informed choice. When you use our website or app(s) without providing consent, we may still try to make a best guess of how you use Catawiki, using only the basic technical information (such as the type of device you are using and your IP address).In accordance with applicable law, you may have the right to access and correct the Personal Data Catawiki processes about you. Furthermore, again within the boundaries set by the law, you can request that we close your Catawiki Account and delete your Personal Data.If you have questions about the specific Personal Data about you that we process or retain, and your rights regarding that personal information, our data protection team is also happy to provide you with more detail. Depending on the nature of your request, we may ask you for information to authenticate you, before we can provide a full response to your request. Violations of your RightsIf you think we do not process your Personal Data in a correct manner or in accordance with the law, please contact our data protection team via privacy [at] catawiki.com or via the “contact us” button. Catawiki will investigate any complaint as soon as possible after receiving your message. You may also file a complaint with the Dutch Data Protection Authority, which acts as our lead supervisory authority, or your local supervisory authority. Changes to our Data Protection & Privacy Notice From time to time, this data protection & privacy notice will be updated, in order to ensure it reflects the current status of how and why we process your Personal Data. At the top of this page, you will see when the notice was last reviewed and updated. If we make any important changes to the way Catawiki processes your Personal Data and how you use our Online Marketplace, we may also directly inform you via email. If there is any conflicting information between the English version of our data protection & privacy notice and any of the translations into other languages, the English version prevails. Should you have any questions about changes we have made to our notice, feel free to reach out to our data protection team.ContactIf you have any questions about this data protection & privacy notice, please reach out to our data protection team via privacy [at] catawiki.com. You can also reach out to us in writing using the below contact details or by contacting our customer experience team (“contact us” button).Catawiki B.V.Attn. Legal DepartmentSint Jorissteeg 2NL - 1012 XV AMSTERDAMThe Netherlands