Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions of Auctify and applies automatically to every customer, from the moment an auction site is created, without signature. It implements Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, for customers established in the United Kingdom, the UK GDPR. A countersigned copy is available on request (see the end of this page).

1. Parties and Scope

Processor: Auctify B.V., a company incorporated in the Netherlands, registered with the Chamber of Commerce under number 92337139, established in Enschede, the Netherlands ("Auctify").

Controller: the natural or legal person who holds an Auctify account and operates one or more auction sites with the Auctify software (the "Customer").

This DPA governs all personal data that Auctify processes on the Customer's behalf in providing the Service: the data of the Customer's bidders, sellers and site administrators. It does not govern the Customer's own account and billing data, for which Auctify is an independent controller under its Privacy Policy. Where this DPA and the Terms conflict on data protection, this DPA prevails.

2. Subject Matter, Nature, Purpose and Duration

• Subject matter: hosting and operating the Customer's auction site, and sending the emails the site generates.
• Nature: storage, display, transmission, backup and deletion of the data entered by the Customer and the users of its site.
• Purpose: enabling the Customer to run online auctions: registering users, taking bids, closing sales, notifying winners and recording what is owed.
• Duration: for as long as the Customer's account exists, plus the deletion period in clause 10.

Data subjects and categories of data

• Data subjects: bidders and sellers registered on the Customer's site, and the Customer's own administrators.
• Categories: name, email address, chosen language, password (stored only as a salted hash), bids and maximum bids, lots won and amounts owed, watchlists and alerts, IP addresses and server logs, and messages sent through the site.
• Not processed by Auctify: card and bank details. Payments go directly to the Customer's own Stripe or PayPal account, and those providers are the Customer's own processors.

The Service is not designed for special categories of personal data (Article 9 GDPR) or data of children, and the Customer agrees not to use it for them.

Instructions

Auctify processes personal data only on the Customer's documented instructions. The Terms, this DPA and the settings the Customer chooses in its admin area are those instructions; this includes the publication of a lot on AuctionsNearMe, which follows the Customer's own Private mode setting. Auctify will inform the Customer if, in its opinion, an instruction infringes data protection law, and may suspend that instruction until it is clarified.

Confidentiality

Auctify limits access to the Customer's data to the persons who need it to operate and support the Service, and binds each of them to confidentiality.

3. Security

Auctify implements the technical and organisational measures listed in Annex 2 and keeps them appropriate to the risk, taking into account the state of the art and the nature of the data. Measures may be improved over time but never reduced below the level described there.

4. Sub-processors

The Customer gives Auctify general authorisation to engage the sub-processors listed in Annex 1. Auctify imposes on each sub-processor data protection obligations no less protective than those in this DPA and remains liable to the Customer for their performance.

Auctify will notify the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected subscription without penalty before the change takes effect.

5. International Transfers

The Service is hosted in the United States. Transfers of personal data from the European Economic Area, Switzerland or the United Kingdom to Auctify's sub-processors rely on the EU-U.S. Data Privacy Framework where the sub-processor is certified, and otherwise on the European Commission's Standard Contractual Clauses (Decision 2021/914, Module Three) and, for UK data, the UK International Data Transfer Addendum. On request Auctify provides the Customer with the documentation for each transfer.

6. Assistance to the Customer

Auctify forwards to the Customer without undue delay any request it receives from a data subject of the Customer's site and does not answer it on the Customer's behalf unless instructed. The admin area lets the Customer view, correct and delete a user's data itself; for anything it cannot do there, Auctify assists on request.

Auctify assists the Customer, to the extent the information is in its possession, with data protection impact assessments and prior consultations with a supervisory authority. Assistance that goes beyond what the Service already provides may be charged at a reasonable rate agreed in advance.

7. Personal Data Breaches

Auctify notifies the Customer of a personal data breach affecting the Customer's data without undue delay, and in any case within 48 hours of becoming aware of it, by email to the address on the Customer's account. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact, and is supplemented as further information becomes available. The Customer is responsible for notifying its supervisory authority and data subjects.

8. Audits

Auctify makes available the information necessary to demonstrate compliance with this DPA. The Customer, or an independent auditor it mandates and who is bound to confidentiality, may audit Auctify's compliance once in any twelve months, on 30 days' written notice, during business hours, remotely where possible, at the Customer's cost and without disrupting the Service. Auctify may offer a recent written report or certification in place of an on-site audit where it answers the Customer's questions.

9. Liability

Each party is liable for its own obligations under the GDPR. The limitations of liability in the Terms apply to this DPA, except where the law does not allow them to.

10. Deletion at the End of the Service

When the Customer's subscription ends, or a free trial is not continued, the site and all personal data on it are deleted as described in the Terms and the Privacy Policy, unless the law requires Auctify to keep part of it. Copies in server backups are overwritten in the normal backup rotation. The Customer is responsible for keeping whatever it needs from its site before the subscription ends.

11. Term, Changes and Governing Law

This DPA lasts for as long as Auctify processes personal data on the Customer's behalf. Auctify may update it to reflect changes in the law or the Service and gives paying customers at least 30 days' notice by email of a change that reduces their rights. It is governed by the law of the Netherlands, and the competent court in Arnhem, the Netherlands, has jurisdiction, without prejudice to the parties' rights under the GDPR. The English text is binding.

Annex 1: Sub-processors

Stripe and PayPal are not Auctify sub-processors: the Customer connects its own account and payments go to it directly under the Customer's own agreement with them. Google Analytics, Google Tag Manager and the Meta pixel run on auctify.com only, with the visitor's consent, and never on customer auction sites.

Annex 2: Technical and Organisational Measures

• Encryption in transit: every site, including the Customer's own domain, is served over HTTPS with an automatically renewed certificate.
• Credentials: user passwords are stored only as salted hashes; access codes for private sites are generated per site, never shared between sites.
• Isolation: each customer site runs in its own hosting account with its own database and file space, separated from every other customer's.
• Access control: server access is limited to authorised Auctify personnel and is logged; the Customer controls its own administrators, bidder approval and registration restrictions from the admin area.
• Availability: regular server backups; the software and operating system receive security updates.
• Minimisation: bidders are shown in bid histories by number, not by name; card and bank data are never collected by the Service.
• Deletion: sites are deleted at the end of the subscription as described in clause 10.

Countersigned Copy and Contact

To receive a countersigned copy of this DPA naming your company, or to ask a question about it, email us. Clients can also open a support ticket in the client area.