Privacy policy

The purpose is a complete and consistent customer record: inquiries, correspondence, appointments, and orders should converge in one place so that your request can be processed comprehensibly and appointment agreements are not lost. Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place.

The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the processing serves the initiation or execution of a contract with you, otherwise Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in orderly customer care and reliable scheduling and order management. You can object to this processing pursuant to Art. 21 GDPR (see section 11).

For both areas of application, a data processing agreement exists with HubSpot. If data is transferred to the USA, this is based on HubSpot's certification under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. Further information: HubSpot's Privacy Policy.

5. Customer account, bidding and identity verification

Customer account and bids

When you create a customer account for our online auctions, we process your name, email address, password (only as a hash), address, date of birth, and for commercial bidders, company and VAT ID, as well as the bids you place, hammer prices, invoices, and payments. We also log when you have confirmed our auction terms and your email address. When setting a password, we check if it appears in known data breaches; only a five-character part of the hash value is transmitted to the service "Have I Been Pwned" (Troy Hunt, Australia), from which neither your password nor your identity can be derived (Art. 6 para. 1 lit. f GDPR, protection of your account). Our registration and account activation forms contain a cookie-free protection against automated registrations, which does not send data to third parties. The legal basis is the performance of the contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR). For bids, we store the time and IP address to be able to prove the binding nature of a bid (Art. 6 para. 1 lit. f GDPR).

Through your account, you receive emails necessary for processing: email address confirmation, activation, hammer price, invoice, and payment reminders. Additionally, we inform you by email if you have been outbid; this notification can be disabled in the account settings. We only send advertising or newsletters with separate consent (Section 6).

ID verification

Before you are authorised to bid, we ask you once for a copy of your identity card or passport (for identity card, front and back) and a photo showing you together with the document. This is to verify your identity. The legal basis is our obligation as an auctioneer under the Money Laundering Act (§ 10 ff. GwG in conjunction with Art. 6 para. 1 lit. c GDPR) as well as our legitimate interest in a secure auction operation (Art. 6 para. 1 lit. f GDPR). We do not require the access and serial number of the document; you may cover them.

The files are transmitted encrypted, stored exclusively on our own server outside the public web directory, and only viewed by the staff conducting the verification. They are not transmitted to service providers and are not evaluated by automated procedures (e.g., text recognition by external AI services). The decision on approval is always made by a human. We will inform you of a rejection by email; you can then submit new documents or contact us.

We retain copies of IDs for five years after the end of the business relationship in accordance with § 8 GwG and delete them thereafter. If the account is not activated or is deleted beforehand, we remove the files within three months of the last activity, provided there is no legal obligation to retain them.

6. Newsletter

If you subscribe to our newsletter, we need your email address. Registration is done using the double opt-in procedure: you will receive an email with a confirmation link, only after which the registration is effective. We log registration and confirmation (time, IP address) to be able to prove consent. The dispatch is carried out via HubSpot (see section 4).

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link in each issue or by email to info@die-auktionshalle-berlin.de. Your data will then be removed from the distribution list.

7. Contact by phone, email and WhatsApp

If you call us, write an email, or send photos via WhatsApp, we process the data transmitted (name, contact details, content of the message, photos) to handle your request and for any follow-up questions. The legal basis is Art. 6 para. 1 lit. b GDPR (initiation or performance of a contract) or Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).

Email mailboxes (Google Workspace)

Our email mailboxes are operated by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Emails you send us and our replies are additionally transferred to our internal order and customer management system (sender, recipient, time, subject, message text, as well as name and size of attachments – not the attachments themselves). This allows us to assign your request to the appropriate process and respond reliably even if the originally contacted person is unavailable. Attachments are only transferred to our document storage on Google Drive if they belong to an order.

The legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR (legitimate interest in an orderly, representative handling of inquiries). A contract for order processing exists with Google; insofar as data is transferred to the USA, this is based on Google's certification under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. Further information: Google's Privacy Policy.

On WhatsApp (WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland), metadata of the communication is transmitted to WhatsApp or Meta; the message contents are end-to-end encrypted. The use of WhatsApp is voluntary; you can also reach us at any time via the other mentioned ways. Details: WhatsApp's Privacy Policy.

8. External links and services

Our website contains links to third-party offers, such as our previous online catalogues (online.die-auktionshalle-berlin.de), partner auctions (luedtke-auktion-online.de), and Google Maps for route planning. By clicking on such a link, you leave our website; the privacy policy of the respective provider applies. We do not embed maps, videos, or social media plugins directly into our pages, so no data flows to these providers when you simply visit our website.

9. Reach measurement (own statistics)

To understand which content on our website is in demand, we conduct our own access statistics. We do not use cookies or third-party analytics services for this – the evaluation takes place exclusively on our own server, and no data is transmitted to third parties.

For each page view, we store: the page accessed, date and time, language version, referring website or search engine, type of device (mobile, tablet, computer), browser family, and – if included in the accessed address – campaign identifiers (utm parameters). Additionally, we record whether a phone number, an email address, a catalogue link, a download, or the online appointment booking was clicked on a page.

To ensure that repeated visits from the same device within a day are not counted multiple times, we create a non-reversible check value from the IP address, browser identification, a secret key, and the respective date. The IP address itself is not stored.<\/strong> Because the date is included in the check value, recognition beyond the day is excluded; we cannot identify individual persons from this.