Data Protection & Privacy Notice
Last Updated: 27 January 2023Catawiki is the leading Online Marketplace for special Objects that fulfil people’s passions.When you visit our website and/or use our app(s) (also referred to in this notice as “our Online Marketplace”), we process your Personal Data. What data you share with us and how we will use it, depends on whether you are just visiting our Online Marketplace or act as a Buyer or a Seller. We are dedicated to treating your Personal Data with care and respect. This data protection notice is intended to explain to you what we do with your data, and why. You can also read about the rights you have under the applicable data protection laws.Legal:Catawiki B.V. and its subsidiaries in different countries (“Catawiki”) process Personal Data from Users, (prospective) employees, as well as from visitors to our Online Marketplace. Catawiki has its main European establishment in Amsterdam, the Netherlands. This data protection & privacy notice explains what Personal Data we process, why we do so and how this is done. It also explains your rights under the applicable data protection laws, including the European Union’s General Data Protection Regulation (“GDPR”). Capitalised terms are included in the Glossary available on the website. This data protection & privacy notice is designed to provide transparency into our data protection practices and principles in a format that our users can navigate, read and understand. Our Data Protection PrinciplesBe Transparent We want to make sure you understand what happens with your Personal Data whether you are visiting or using our Online Marketplace. Should you still have any questions, please don’t hesitate to contact us using the contact details below.Be CarefulYou trust us to protect your Personal Data properly. Therefore, we are careful how we use it and with whom it is shared. Our security team constantly monitors any risk that may impact the security or integrity of our Online Marketplace and our internal databases. Our trust and safety operations team monitors for other risks, like fraud.Be Relevant In the course of our operations we collect your Personal Data to help us understand how you use our Online Marketplace, and where we can make improvements and be more relevant to you as our User. Still, we try not to collect any more data than we need, and to delete data when it is no longer relevant to us.We Are Here To Help YouIf you have any questions about this data protection notice, or how Catawiki processes your Personal Data, please reach out to our data protection team via privacy [at] catawiki.com. You can also reach out to us in writing using the below contact details or by contacting our customer experience team (“contact us” button below).Catawiki B.V.Attn. Data Protection TeamSint Jorissteeg 2NL - 1012 XV AMSTERDAMThe NetherlandsProcessing Your Personal DataCatawiki wants to be a reliable and responsible Online Marketplace where you can find the special Objects that fulfil your passions. In general, Catawiki will collect and use your Personal Data in order for us to run our business in a meaningful way. This includes making our Online Marketplace available to you, keeping it up to date and ensuring that our Online Marketplace can function, that Sellers can Sell Objects in auction, and that Users are able to make a bid on, and buy these Objects. We use some of your Personal Data for analytics, for example to understand trends in the respective categories, as well as for marketing purposes. Furthermore, we use Personal Data to meet our legal obligations, for example for reporting to the tax and other supervisory authorities. Visiting our Online Marketplace The Personal Data we collect on our Online Marketplace and from our Users reveal how people find and use Catawiki, what they may be interested in and where our visitors are coming from. This helps us to further improve our product and services, for example by analysing if Objects can be found easily, as well as to ensure our Online Marketplace functions properly. We also collect statistics on the number of visitors on a daily and monthly basis, which explains to us how our business grows. Until you create an Account and/or sign in to our Online Marketplace, we only collect technical information. This includes your IP address, information about the device you use, access times, etc. Once you have provided us with your permission, also known as “consent”, we also collect electronic identification data from your browser or device by making use of cookies (small text files your computer sends each time you visit our Online Marketplace) and similar technologies on our Online Marketplace. This data will include a cookie ID, your browsing behaviour on our Online Marketplace, and which Object(s) you like, as well as mobile device identifiers (e.g. IDFA or GAID). These data elements also allow us to test new functionalities . For more information on our use of cookies, please read our Cookie Policy.It is in Catawiki’s legitimate interest to collect the main technical data when you visit and use our Online Marketplace, for the reasons explained above. However, when it comes to cookies and similar data that is used for analytical and advertising purposes, we rely on your consent. Using our Online Marketplace and Creating an AccountIf you want to explore what special Objects Catawiki has to offer, you do not need an account. However, if you want to start bidding on an Object you are passionate about, or if you have an Object you would like to sell on Catawiki, you will need to create an Account. This will also allow you to follow Objects and Online Auctions and to save searches, so we can make sure you don’t miss anything you like. Once you create an Account, we ask you to provide us with your email address and to choose a secure password. Next, we register your first and last name, your email address, your phone number and your password. Our system also collects some technical data, including your IP address and information about the device and operating system you are using. You will also be assigned a User ID, which is the main data element for Catawiki to bring your Personal Data together across our systems. In addition, cookies help us to recognise your device(s), store your language preferences, and keep you signed in, so you don’t need to keep signing in every time you use Catawiki. You can also use a social media profile, such as Facebook, to create an Account. If you create an Account using social media, we will receive some basic information from your profile, including your email address. We might also receive information about your status updates or content you’ve viewed or clicked on while using that social media account. You can always check and change the privacy settings of the relevant social media platform, and this will update what data we have access to. We would like you to use all the features of our Online Marketplace that are specifically relevant to you. Therefore, we will ask for some extra information, like your address and possibly your date of birth. If you want to become a Seller, we may also ask for your bank Account number and, if applicable, the VAT number and chamber of commerce number of your company. In your profile, you are also able to set your preferences for the language in which you use our Online Marketplace, and the currency in which you would like to see the prices.How We Further Process Your Personal DataBased on your contract with usWhen you create an Account, you need to agree to our Terms of Use (including, for the avoidance of doubt, the Buyer Terms and the Seller Terms). Because of this, a legally binding agreement is in place between you and us, giving us the legal basis to process the Personal Data in your Account. This includes the processing of your Personal Data for the following reasons:We want to make sure Catawiki is open for business in your country, either for buying or selling, and to do so, we use your address. We also use your address to make sure that the Object(s) you bought or sold in an Online Auction can be shipped to you or picked up at your address.Your date of birth is used to ensure you are at least 18 years of age, and eligible to create an Account. It can also be used to verify whether you are allowed to buy certain age-restricted items, subject to national laws.Sometimes it is helpful if we can contact you. To do so, we use your email address and phone number. Both are also used to facilitate the shipping of items you have bought or sold via our Online Marketplace.If you buy or sell something on Catawiki, the payment needs to be processed, both by us and by our Third Party Service Providers. All records of transaction and payment data (including invoices, price and date of payment, the payment method, payment status, bank account, and/or credit card details) are collected and retained for payment and billing purposes. Your financial data are also used to make sure you can make or receive payments or refunds. We are happy to see our Users become Sellers on Catawiki. If you want to sell an Object, you will also need to create a Seller profile within your Account. To do so, we, or one of our verification partners, may ask for additional information. In some situations, we are by law required to verify your identity, meaning you will be asked for a scan or photo of a government-issued photo ID (proof of identification), which clearly shows at least your full name, date of birth and ID (document) number. Subject to country-specific legislation, additional information may be required as well, like a Central Packaging Register number, your Tax Identification Number or your place of birth.When you communicate with other Users through the internal messaging system offered on our Online Marketplace, for example about an Object you bought or sold, your User IDs and technical details about the connection (including the IP addresses), as well as the content of the communication, are logged, so you can rely upon them for further communications.Your contact details and Buyer/Seller information may be used to provide customer support, in case of questions or difficulties with a buy or a sale via our Online Marketplace. Contact with our Customer Experience team may also include details about your request, including on the Object(s) and payment(s). If you contact our customer experience team via phone, your call will be recorded for quality and training purposes. If you prefer that we do not keep your recording, please feel free to let us know, so we can delete it immediately. Finally, we can also collect information if you reach out to us through your social media account, for example via Facebook Messenger. Keep in mind that we don’t use this chat as our official channel for handling questions or complaints. We still try to respond to your messages in time and to provide you with further information or assistance if necessary. The general terms and privacy policy of the relevant social media provider are applicable when you use their services.Our Legitimate InterestThere are situations where Catawiki needs to process the Personal Data we have about you for other reasons than those directly related to the contract you have with us. We consider we have a good reason to do so, legally called a legitimate interest, in any case in all the situations listed below. There could also be others. If you disagree, feel free to contact us, so we can see if we need to revisit our approach for your specific situation. For email communications, you can also go into your Account and opt-out. For phone calls, you can let us know you do not wish to be contacted. We want to help you when you set up your Account, so we will send you several email messages, for example to ask you to confirm your email address, or to give you information on how to use our Online Marketplace. We also send you a text message on your mobile phone number, to verify the number is real.We want to make sure you can find the Objects you are passionate about, so we will send you email messages as part of our marketing communications, for example our regular newsletters and surveys, as long as you are an active User of the Catawiki platform.We want to make sure you do not miss out on Objects or Online Auctions you are following, so we send you email messages and in-app notifications, for example to alert you an Online Auction or an Object you are following is closing soon, or to confirm your bid.Our sales team wants to make sure you have the best experience when you start selling. They may send you email messages or call you, for example to provide assistance with onboarding and Account creation, and with the submission of Objects for Online Auction, to invite you to participate in specific themed and partnership Online Auctions, or to support you to grow your business on Catawiki.Our data team helps us to understand how you use our Online Marketplace, including bids, purchases and Objects put to auction by our Users, as well as what pages and categories you visit and favourite. This allows us to make improvements to our Online Marketplace and give you the best possible user experience. We also use data for market analysis and to improve our sales process.We want to make sure you get the best possible customer service. To do so, we need to train our teams. Our customer experience team may therefore listen to recent calls from Users, or colleagues may listen in live to calls to provide immediate feedback. To make sure Catawiki is a secure, trusted platform for both Buyers and Sellers, by spotting and combating fraud, money laundering, and other non-compliant use of our Online Marketplace. For example, our trust and safety operations team uses Personal Data to look into Users who don’t comply with our Terms of Use and our systems can match various data points to (temporarily or permanently) block these Users from using our Online Marketplace. We also process your Personal Data for system integrity purposes (for example, to prevent hacking or credential stuffing attacks), to register, mediate, and resolve possible disputes or irregularities or to enforce our Terms of Use and other policies. If a contract has been entered into between you and another User (the “Contract of Sale”) and there is an issue or dispute, we might provide certain information to help you resolve the issue directly with that User. We also use prediction models to determine whether we need to ask certain Users for a form of payment security or obstruct their Bid or payment. We use your bidding, buying, or selling history and location to predict the chances of the Contract of Sale being cancelled. Based on the outcome of this model, we may ask you to verify your credit card before placing a Bid as a safety measure. We want to make sure our website is reliable for you to use. Therefore, we review, scan, or analyse all activity on our Online Platform as well as your messages with other Users via our internal messaging system, for fraud prevention, risk assessment, investigation, or support purposes.Finally, all Personal Data can be used to implement and operate company policies and procedures, to respond to any claims against us and to protect the rights, property, or personal safety of Catawiki, our Users, or the public. We can also use these data to make corporate transactions, such as any merger, sale, reorganisation, acquisition, bankruptcy or similar event and for other legitimate business purposes permitted by applicable law.From time to time, we may initiate new data processing activities that rely upon legitimate interest. These will be included in this data protection & privacy notice when it is next updated. Under a Legal ObligationWe are under a legal obligation to process certain types of Personal Data. This includes the processing of Personal Data for the following reasons:To ensure all Users are who they say they are, your contact details and, where appropriate, a copy of your government issued ID and other additional information, are used for identity verification in light of applicable laws, including for anti-money laundering. We may use a Third Party Service Provider to support us in this process.To ensure all transactions are recorded to the tax authorities and can be audited in a proper manner, we retain records of transaction and payment data. In addition, in certain countries we have the obligation to provide (at least) annual updates about our Sellers and their activities on the platform with national authorities in the countries where we do business, including tax authorities.In some countries, we are obligated to discover and take down harmful or illegal content from our Online Marketplace. To this end, we may screen Information included in Object descriptions as well as the content of our internal messaging system.ConsentFinally, we may process your Personal Data with your consent. We try not to bother you too much with consent requests, unless we are under a legal obligation to do so or if there is no other option. We use your Account information with your consent for the following reason:We like to ensure that if we show you advertisements outside of our Online Marketplace, they are relevant to you. To do so, we may use the data from cookies and other trackers on your device. The same data can be used to make sure email communications and in-app or on device notifications you receive from us are relevant to you. We may always collect some basic statistics, but we like to have more detail to really understand how you use our Online Marketplace. For these detailed statistics, we need your permission.To get your feedback on your experience when buying or selling on Catawiki. In these cases, we will only process Personal Data (such as your email address or User ID) for our internal analytics, which help to enhance our Services. We may also process the opinions, experiences, preferences and interests and reviews that you provide to us, with other Users or share with us online or through social media. For more detail, please also review our Buyer Feedback Policy.To use your pictures or Object details for marketing campaigns.Please note that you may withdraw your consent at all times. The section on Your Rights below provides more detail.Sharing Information with Third PartiesLegally speaking, Catawiki is the “data controller” for all Personal Data we process. That means that we take the decisions about how and why your Personal Data is processed. It also means that any question you may have about how your Personal Data is processed can be raised with us, even if this is done by one of our Third Party Service Providers. Exception: Joint ControlThere is one exception to the rule that Catawiki acts as data controller. We partner with Criteo, as part of our online advertising strategy. In order to ensure the right advertisement is shown to the right people, Criteo and Catawiki are jointly responsible. To this end, we have concluded a so-called joint controller agreement. This agreement explains, among other things, that you can always address any questions you may have about our partnership to both Catawiki and Criteo. Furthermore, your Personal Data will only be processed for online advertising purposes if you accept the advertising cookies when visiting our Online Marketplace. If you have already accepted the cookies, but change your mind, you can do so via our cookie settings. Please also take a look at Criteo’s Privacy Notice, which provides further information.Sharing of Personal Data with Buyers and SellersSometimes, it is necessary that Catawiki shares your Personal Data with another User of our Online Marketplace. There is a number of possible scenarios, each of them related to the preparation and execution of the Contract of Sale which include:If you buy an Object from another User, the item needs to be shipped to you upon reception of payment. We will share your address and contact information (including phone number and email address) with the Seller so they can arrange shipping.If there is an issue between you and another User, we may share the address and contact information between the Users to help you resolve the issue directly with that User.If a Contract of Sale is cancelled by a Buyer under consumer protection rules (the so-called cooling off period), there can be limited situations where Catawiki will still have to share your contact details with the Seller in order for them to initiate legal proceedings. When we agree to such data sharing, we see this as a so-called compatible use of the data processed under the Contract of Sale.If you receive another User’s Personal Data, you guarantee that you will only process these to perform your obligations, or to remedy any issues under, or arising from, the Contract of Sale. You shall always process Personal Data in accordance with applicable (data protection) laws and regulations. Without consent from the User in question, you may not use any Personal Data for (other) commercial purposes, for instance to send marketing messages, other unsolicited communications or otherwise approach the User for such purposes.In addition to the contractual reasons above, we may share your Personal Data if you have given us consent to do so. This can for instance include the following situation:If a User wants to inspect an Object on site before making a bid and entering into a Contract of Sale, we can share the contact details of the Seller with the Buyer in order to arrange the viewing. Should there be a need for a refund, we may ask you for your consent to share your banking information with another User, so this can be arranged directly between the Users. Companies processing Personal Data on behalf of CatawikiCatawiki uses multiple Third Party Service Providers to help us process your Personal Data. These include companies that provide our office software, host our website, run our databases, run our advertisements, or are involved in other ways in the processing of Personal Data. Just to be clear: your Personal Data will at all times be processed by our Third Party Service Providers under our instructions. Contracts are in place to ensure your expectations and our obligations regarding data protection and data security are met. Where relevant, we conduct a risk assessment before a contract is concluded.The following categories of Third Party Service Providers may process your Personal Data as part of our operations:Customer relationship management software providersEmail and messaging servicesWeb hosting services Office software providersPayment service providers (including identity verification)Online advertisers and advertising networksData analytics service providers Social media networks Organisations processing your Personal Data for their own reasonsSometimes, Catawiki will need to share your Personal Data with organisations that will process the data for their own reasons. This is often the case when there is a legal obligation to process your data. If indeed your Personal Data is processed by an organisation for one of the reasons mentioned below, you need to be aware they (also) do so under their own responsibility. Payment service providers (including identity verification)Government authorities (including tax and law enforcement authorities)AuditorsDebt Collectors In addition, your Personal Data may be disclosed to one or more other organisations as part of any merger, (partial) sale or (partial) transfer of our assets. Should that ever happen, we will try to inform you in a timely manner.Use of Social MediaCatawiki is active on social media platforms, including Facebook, Instagram, Twitter, TikTok and LinkedIn, where you would be able to interact with us. Please note that in all situations, the terms of use and privacy policy of the respective social mediums would apply.If you interact with Catawiki on social media, we will in any case process your Username and any additional information you share with us. If you contact us as part of a customer support request, this information may also be connected to your User ID in our customer relationship management systems.The Catawiki sales teams also use social media and public websites to identify prospective Sellers for our platform. You have the option to tell us you do not want us to contact you again. Cross-border Data TransfersPersonal Data you entrust to Catawiki will primarily be processed by Catawiki B.V. in the Netherlands. However, our Third Party Service Providers are not all located in the Netherlands, which means your Personal Data is likely to end up in other countries, including outside of the European Economic Area. We respect the rules set out by the GDPR, local data protection rules and applicable guidance from supervisory authorities, also when your Personal Data is processed in other countries.Where they exist, we rely upon adequacy decisions from the European Commission for the cross-border transfer of your Personal Data. These decisions indicated another country has data protection rules that are very similar to those in the GDPR. The full list of current adequacy decisions is available here. Where there is no adequacy decision, Catawiki will work to have the necessary contractual arrangements in place with our Third Party Service Providers, for example by using standard contractual clauses and additional data protection safeguards. When concluding or revising contracts with our Third Party Service Providers, we also intend to conduct a data transfer risk assessment, to identify any challenges under foreign laws which may impact the protection of your Personal Data. The main country outside the European Economic Area where your Personal Data will be processed, is the United States. This is because many of our Third Party Service Providers have their headquarters there, and also make use (in part) of American hosting servers. Without going into all the technical details, we can tell you that we strive to encrypt all our Personal Data, both in transit and at rest, and try to agree with our Third Party Service Providers that they will not share your Personal Data with anyone else, without telling us to do so. There can be exceptions, for example when there is a warrant or subpoena in place that requires handing over your data. Data Security & RetentionThe security, integrity, and confidentiality of your Personal Data are extremely important to us. We have implemented technical, contractual, organisational, and physical security measures that are designed to protect our User's Personal Data from unauthorised access, disclosure, use, and modification. We regularly review our security procedures and practices to consider appropriate new technology and methods. Please be aware that, despite our best efforts, no security measures are perfect or impenetrable.When we no longer need your Personal Data, we also do not want to keep it. In general, that means that Catawiki will process your Personal Data for as long as you have an active User Account, or as long as required under our legal obligations in the respective countries we operate. Where we process Personal Data that is not directly related to your User Account or our legal obligations, we will set specific retention periods based on the purpose for which we have collected that Personal Data in the first place.Account DeletionIf you wish to delete your Account, you can request to do so on your Account settings page in line with our Individual Rights policy. Once your Account is deleted, we will also proceed to delete the Personal Data associated with your Account as soon as possible, but in any case within one month. We will also notify our Third Party Service Providers that you have requested to delete your data, and request them to do the same. Some data cannot be deleted straight away when you close your Account. For example, we are under a legal obligation to retain all financial information for tax reporting purposes for up to 10 [ten] years, depending on the jurisdiction. Catawiki will also retain a record of the User ID that was associated with your Account for statistical purposes. However, in our databases this User ID will no longer be associated with any information that directly identifies you as a former User of our Online Marketplace. We will not, nor are we allowed to, use the information that is retained as part of our financial administration to re-identify you once you have deleted your Account, except in a legal procedure.Your Rights and ChoicesCatawiki gives you the ability to make certain choices about what Personal Data we collect from you and how these data may be used. You can make these choices via our cookie banner, as well as via your Account settings. Please be aware however, that depending on your choices, we may not be able to give you the full Catawiki experience. Some of our services may, for example, not be able to take account of your interests and preferences. Where this is the case, we will try to let you know upfront what added value the collection of your Personal Data will have, and what the consequences are of opting-out, so you can make an informed choice. When you use our app(s), we may still try to make a best guess of how you use the app, using only the basic technical information (such as the type of device you are using and your IP address).In accordance with applicable law, you may have the right to access and correct the Personal Data Catawiki processes about you. Furthermore, again within the boundaries set by the law, you can request that we close your Catawiki Account and delete your Personal Data.If you have questions about the specific Personal Data about you that we process or retain, and your rights regarding that personal information, our data protection team is also happy to provide you with more detail. Depending on the nature of your request, we may ask you for information to authenticate you, before we can provide a full response to your request. Violations of your RightsIf you think we do not process your Personal Data in a correct manner or in accordance with the law, please contact our data protection team via privacy [at] catawiki.com. Catawiki will investigate any complaint as soon as possible after receiving your message. You may also file a complaint with the Dutch Data Protection Authority, which acts as our lead supervisory authority, or your local supervisory authority. Changes to our Data Protection & Privacy Notice From time to time, this data protection & privacy notice will be updated, in order to ensure it reflects the current status of how and why we process your Personal Data. At the top of this page, you will see when the notice was last reviewed and updated. If we make any important changes to the way Catawiki processes your Personal Data and how you use our Online Marketplace, we may also directly inform you via email, if we have your email address. If there is any conflicting information between the English version of our data protection & privacy notice and any of the translations into other languages, the English version prevails. Should you have any questions about changes we have made to our notice, feel free to reach out to our data protection team.ContactIf you have any questions about this data protection & privacy notice, please reach out to our data protection team via privacy [at] catawiki.com. You can also reach out to us in writing using the below contact details or by contacting our customer experience team (“contact us” button).Catawiki B.V.Sint Jorissteeg 2NL - 1012 XV AMSTERDAMThe Netherlands