Privacy policy

For both areas of application, a data processing agreement exists with HubSpot. If data is transferred to the USA, this is based on HubSpot's certification under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. Further information: HubSpot's Privacy Policy.

5. Customer account, bidding and identity verification

Customer account and bids

When you create a customer account for our online auctions, we process your name, email address, password (only as a hash), address, date of birth, and for commercial bidders, company and VAT ID, as well as the bids you place, hammer prices, invoices, and payments. We also log when you have confirmed our auction terms and your email address. When setting a password, we check if it appears in known data breaches; only a five-character part of the hash value is transmitted to the service "Have I Been Pwned" (Troy Hunt, Australia), from which neither your password nor your identity can be derived (Art. 6 para. 1 lit. f GDPR, protection of your account). Our registration and account activation forms contain a cookie-free protection against automated registrations, which does not send data to third parties. The legal basis is the performance of the contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR). For bids, we store the time and IP address to be able to prove the binding nature of a bid (Art. 6 para. 1 lit. f GDPR).

Through your account, you receive emails necessary for processing: email address confirmation, activation, hammer price, invoice, and payment reminders. Additionally, we inform you by email if you have been outbid; this notification can be disabled in the account settings. You only receive the newsletter with separate consent; for other emails, see Section 6.

Address suggestions while typing

When you type a street into our forms, we suggest matching addresses. To do this, our server only sends the typed address text to the Photon service of Komoot GmbH (Potsdam, Germany), which is based on OpenStreetMap data. Your IP address, name, or other information is not transmitted. The legal basis is our legitimate interest in correctly recorded addresses (Art. 6 para. 1 lit. f GDPR). The suggestions are voluntary; you can also enter the address completely yourself.

ID verification

Before you are approved to bid, we ask you once for a copy of your identity card or passport (front and back for identity cards). A photo showing you together with the document is optional and speeds up the check. This allows us to verify your identity. The legal basis is our obligation as an auctioneer under the German Money Laundering Act (Sections 10 et seq. GwG in conjunction with Art. 6(1)(c) GDPR) and our legitimate interest in secure auction operations (Art. 6(1)(f) GDPR). We do not need the access and serial numbers of the document for the upload; you may cover them.

The files are transmitted encrypted, stored exclusively on our own server outside the public web directory, and only viewed by the staff conducting the verification. They are not transmitted to service providers and are not evaluated by automated procedures (e.g., text recognition by external AI services). The decision on approval is always made by a human. We will inform you of a rejection by email; you can then submit new documents or contact us.

We retain copies of identity documents, records of on-site checks and documentation forms for five years in accordance with Section 8(4) GwG – for a business relationship, from its end – and delete them afterwards. If you are not approved or the account is deleted beforehand, we remove uploaded files within three months of the last activity, unless a statutory retention obligation applies.

On-site identity check

Instead of a photo with your ID, you can also identify yourself in person at our hall with your original document. We record the type, number, issuing authority and validity of the document, and on request place of birth and nationality, as well as the date, time and the person carrying out the check, and file a record of it. This allows us to prove the check to the supervisory authority. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 8 GwG.

Purchases of 10,000 euros or more

If you buy for a total of 10,000 euros or more in one auction, the Money Laundering Act requires us to record your identity in full (name, date and place of birth, nationality, address, type, number and issuing authority of the identity document and a copy of it) and to ask whether you are acting in your own economic interest and whether you are a politically exposed person. You confirm this information with your signature on our screen. We store the signed documentation form as a PDF on our own server. The legal basis is Art. 6(1)(c) GDPR in conjunction with Sections 8, 10 and 11 GwG.

Quotations, invoices and accounting

We create and book quotations, invoices, credit notes and receipts using the accounting software sevDesk provided by sevDesk GmbH, Hauptstraße 115, 77652 Offenburg, Germany. This involves processing your name, address, email address, customer number and the services and payments charged; some quotations and invoices are sent by email directly from sevDesk. The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our statutory bookkeeping obligation (Art. 6(1)(c) GDPR). A data processing agreement has been concluded with sevDesk; the data is stored in Germany.

6. Newsletter and other emails

If you subscribe to our newsletter, we need your email address; you may voluntarily provide your first name so that we can address you personally. Registration uses the double opt-in procedure: you receive an email with a confirmation link, and only then does the registration take effect. If you subscribe in your customer account with an email address that has already been confirmed, this second email is not needed. We log registration and confirmation (time, IP address, form used) in order to be able to prove your consent. Anyone who previously subscribed via our former sign-up form (HubSpot) has been transferred to our own mailing list; we no longer use HubSpot for the newsletter.

For sending we use Amazon Simple Email Service (SES) provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, with a data centre in Frankfurt am Main. In the process, your email address and the content of the issue are processed. Amazon reports undeliverable messages and spam complaints back to us; we automatically remove such addresses from the mailing list. We have concluded a data processing agreement with Amazon Web Services. Insofar as data is transferred to the USA, this is based on Amazon's certification under the EU-U.S. Data Privacy Framework and on standard contractual clauses.

We do not measure whether you open an issue (no tracking pixel). However, the links in the newsletter lead via our own server: when you click, we store which link in which issue was clicked, together with the identifier of your subscription, so that each person is counted only once. The data is evaluated only in aggregated form, not for individual persons. We delete the click data after 14 months. The legal basis is our legitimate interest in tailoring the newsletter to the interests of our readers (Art. 6 para. 1 lit. f GDPR); you can object to this at any time by email.

The legal basis for the newsletter is your consent (Art. 6 para. 1 lit. a GDPR). You can unsubscribe at any time via the unsubscribe link in each issue, in your customer account or by email to info@die-auktionshalle-berlin.de. After that you will no longer receive any issues; we keep your email address only as a blocking note with the time of unsubscription so that it does not accidentally end up on the mailing list again.

Messages about your business relationship

Independently of the newsletter, we occasionally email bidders, buyers, consignors and business customers when something is important for the existing business relationship – for example when switching to our new auction platform or when procedures, auction terms or collection times change. These messages do not contain advertising. The legal basis is Art. 6(1)(b) GDPR or our legitimate interest in smooth processing (Art. 6(1)(f) GDPR).

Offers for existing customers

If you have already consigned or bought items from us or used another of our services and gave us your email address in the process, we occasionally inform you by email – even without a newsletter subscription – about our own similar services, for example consignment campaigns or special terms (Section 7(3) of the German Act Against Unfair Competition (UWG), Art. 6(1)(f) GDPR). You can object to this use of your email address at any time without incurring any costs other than the transmission costs at basic rates – via the unsubscribe link in each of these emails or informally to info@die-auktionshalle-berlin.de. We will then mark your address as blocked for advertising; you will still receive messages about your bids, invoices and consignments.

Sending and translation

Like the newsletter, we send these emails via Amazon SES (see above); we do not track opens or clicks. If you have chosen English or Polish as the language in your customer account, you receive a translated version. For this, the text is machine-translated in advance by OpenAI (OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland). Only the general text of the message is transmitted – no names, email addresses or other recipient data.

Reminders about quotations

If we have sent you a quotation at your request – for example for a house clearance – we will remind you of it once by email about a week later if we have not heard from you by then. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). If you do not wish to receive a reminder, a short message to us is sufficient.

7. Contact via form, phone, email, and WhatsApp

Inquiry forms on this website

Our own inquiry forms (such as for contact, viewing, purchase, consignment, container rental, as well as on our action and partner pages) are delivered directly from our server without external services; no data is transferred to third parties when loading. When you submit a form, we store your details (name, email address, phone number, your request, information about the object, and any uploaded photos) in our internal order and customer management system on our own server and use them to process your inquiry. You will receive an automatic confirmation of receipt by email (sent via Amazon SES, see section 6). To protect against automated entries, the forms contain an invisible check field and a time check; no cookies are set and no data is transmitted to third parties.

If you have accessed the website via one of our advertisements, we additionally store the identifier of the ad click (e.g., "gclid") and the campaign details from the address to track which ads lead to inquiries. We do not pass this identifier on to Google; performance measurement with Google only takes place with your consent (see section 3).

The legal basis is Art. 6 para. 1 lit. b GDPR (initiation of a contract) or Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries and evaluating our advertising). For storage duration, see section 11.

Online-Terminbuchung

Unsere Online-Terminbuchung für Besichtigungen wird ohne externe Skripte und ohne Cookies direkt von unserem Server ausgeliefert. Wenn Sie einen Termin buchen, speichern wir Ihre Angaben (Name, E-Mail-Adresse, Telefonnummer, Anschrift des Objekts, Ihre Angaben zum Objekt und den gewählten Termin) in unserem internen Auftrags- und Kundenverwaltungssystem und verwenden sie zur Durchführung der Besichtigung. Sie erhalten eine Bestätigung und eine Erinnerung per E-Mail (Versand über Amazon SES, siehe Abschnitt 6) mit einem persönlichen Link, über den Sie den Termin verlegen oder absagen können.

Damit wir nur Zeiten anbieten, die wirklich passen, gleichen wir die Termine mit dem Kalender unseres Mitarbeiters bei Google Workspace (Google Ireland Limited) ab und tragen den gebuchten Termin dort mit Name, Anschrift und Telefonnummer ein. Außerdem berechnen wir die Fahrzeit zwischen zwei Besichtigungen: Dazu übermittelt unser Server ausschließlich die Koordinaten der Anschriften – ohne Namen oder sonstige Angaben – an den öffentlichen Routendienst des Open-Source-Projekts OSRM, der auf Kartendaten von OpenStreetMap beruht. Fehlen die Koordinaten, ermitteln wir sie aus der Anschrift über den Dienst Photon (siehe „Adressvorschläge beim Eintippen“).

Rechtsgrundlage ist Art. 6 Abs. 1 lit. b DSGVO (Anbahnung eines Vertrags) bzw. Art. 6 Abs. 1 lit. f DSGVO (berechtigtes Interesse an einer verlässlichen Terminplanung). Mit Google besteht ein Vertrag zur Auftragsverarbeitung. Zur Speicherdauer siehe Abschnitt 11.

Phone, email and WhatsApp

If you call us, write an email, or send photos via WhatsApp, we process the data transmitted (name, contact details, content of the message, photos) to handle your request and for any follow-up questions. The legal basis is Art. 6 para. 1 lit. b GDPR (initiation or performance of a contract) or Art. 6 para. 1 lit. f GDPR (legitimate interest in responding to inquiries).

Email mailboxes (Google Workspace)

Our email mailboxes are operated by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Emails you send us and our replies are additionally transferred to our internal order and customer management system (sender, recipient, time, subject, message text, as well as name and size of attachments – not the attachments themselves). This allows us to assign your request to the appropriate process and respond reliably even if the originally contacted person is unavailable. Attachments are only transferred to our document storage on Google Drive if they belong to an order.

The legal basis is Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR (legitimate interest in an orderly, representative handling of inquiries). A contract for order processing exists with Google; insofar as data is transferred to the USA, this is based on Google's certification under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. Further information: Google's Privacy Policy.

On WhatsApp (WhatsApp Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland), metadata of the communication is transmitted to WhatsApp or Meta; the message contents are end-to-end encrypted. The use of WhatsApp is voluntary; you can also reach us at any time via the other mentioned ways. Details: WhatsApp's Privacy Policy.

8. External links and services

Our website contains links to third-party offers, such as partner auctions (luedtke-auktion-online.de), and Google Maps for route planning. By clicking on such a link, you leave our website; the privacy policy of the respective provider applies. We do not embed maps, videos, or social media plugins directly into our pages, so no data flows to these providers when you simply visit our website.

9. Reach measurement (own statistics)

To understand which content on our website is in demand, we conduct our own access statistics. We do not use cookies or third-party analytics services for this – the evaluation takes place exclusively on our own server, and no data is transmitted to third parties.

For each page view, we store: the page accessed, date and time, language version, referring website or search engine, type of device (mobile, tablet, computer), browser family, and – if included in the accessed address – campaign identifiers (utm parameters). Additionally, we record whether a phone number, an email address, a catalogue link, a download, or the online appointment booking was clicked on a page.

To ensure that repeated visits from the same device within a day are not counted multiple times, we create a non-reversible check value from the IP address, browser identification, a secret key, and the respective date. The IP address itself is not stored.<\/strong> Because the date is included in the check value, recognition beyond the day is excluded; we cannot identify individual persons from this.