Auction Privacy Policy

This notice covers the auction on fateseeker.art: registering to bid, placing bids, and the emails that come out of that. It doesn’t cover the checkout on Etsy that winning bidders use to pay. That’s governed by Etsy’s own privacy policy, since Etsy is a separate, independent controller for that step. Everything else on fateseeker.art is covered by the Glintworks privacy policy.

Who’s responsible

Glintworks e.U., Hamerlingstraße 7, 4020 Linz, Austria. business@fateseeker.art reaches the person actually handling your data. No data protection officer is appointed, as none is required at this scale of processing (Art. 37 GDPR).

What’s collected, and why

Registration & bidding

Email address and first name, when you register to bid; whether you’ve accepted the terms and opted into marketing, and when; whether and when your email was verified; each bid’s secret maximum and the amount actually displayed, with a timestamp; and your current standing maximum. This is used to run the auction, tell you if you’re outbid or if you’ve won, and enforce the auction terms; this is necessary to provide the service you asked for (Art. 6(1)(b) GDPR). Providing this data is required to take part; without it we can’t register you or accept a bid. To other visitors, bids are shown against a fixed pseudonym for that auction (like “Bidder 6”), never your name or your maximum. Only you and we can see those.

Session & security

A session cookie and a matching CSRF cookie, set once you register, so the site knows it’s you without a password. This is necessary to keep the bidding session working (Art. 6(1)(b) GDPR). Each session also records the IP address and browser/user-agent string it was created from, to catch abuse of the bidding system (Art. 6(1)(f) GDPR). Sessions expire automatically after 30 days.

Optional marketing

If you tick the optional box when registering, we’ll email you about future drops. Based on your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by emailing us. This doesn’t affect emails about an auction you’re already bidding in.

Delivery records

A copy of every registration, outbid, and winner email we send, including its recipient and content, is kept as a short-term audit trail in case a send fails and we need to check what should have gone out. Necessary to run the auction reliably (Art. 6(1)(b) and (f) GDPR). Kept for 7 days, then deleted.

Abuse prevention

To stop the registration and bidding forms being spammed or brute-forced, we count attempts per IP address and per email address over short time windows. The counter is keyed by a one-way hash rather than storing your actual IP address or email in it. Necessary to keep the service usable (Art. 6(1)(f) GDPR). Each counter expires within hours.

Cookies & local storage

The two cookies described above are used, along with your browser’s session storage, which briefly holds the bid you’re submitting so it survives a page reload during verification. All three are strictly necessary to let you use the bidding feature you asked for. Under Austrian law (§ 165(3) TKG 2021) that means no cookie consent banner is required for them. We don’t use analytics, advertising, or tracking cookies of any kind.

Who else sees it

• Our email delivery provider, to send registration, outbid, and winner emails.
• Our hosting/database provider, to run the site and store auction data.
• Etsy, only if you win, to invoice and collect payment for the item, as a separate controller under its own privacy policy.
• If you win, we also receive your name and shipping address back from Etsy in order to fulfil the order, and pass them to the shipping carrier to post your item. This is necessary to perform the sale (Art. 6(1)(b) GDPR) and is kept only for as long as the underlying sale record (see “How long it’s kept” below).

We don’t sell or trade your data, and we don’t use it for anything beyond what’s described here. Our email, hosting, and database providers are based in Austria, inside the EU/EEA. Etsy is a US company; any transfer of your data to Etsy is governed by the safeguards described in Etsy’s own privacy policy, not by us.

How long it’s kept

• Unconfirmed verification links: deleted within 24 hours, whether used or not.
• Registrations that are never confirmed: the registration itself (name, email) is deleted along with the link above, within the same 24 hours.
• Session cookies and the session record behind them: deleted automatically once the session expires, at most 30 days after it was created.
• Delivery records (see above): deleted after 7 days.
• Registration and bid records for auctions you didn’t win: kept for 90 days after the auction closes to handle any disputes. After that your name, email address, and session records are deleted; the bid amounts stay in the auction’s tamper-evident bid history under your anonymous bidder name only, so they can no longer be linked to you.
• Records tied to a completed sale (winning bid, payment, shipping address): retained for 7 years from the end of the calendar year the sale was completed in, as required by Austrian tax and bookkeeping law (§ 132 BAO).

Your rights

You can ask us for access to, correction of, or deletion of your data, ask us to restrict or object to processing, or request a copy in a portable format. Email business@fateseeker.art for any of this. You can also complain to the Austrian data protection authority (dsb.gv.at) at any time.

Automated contract formation

The auction winner is decided purely by whoever holds the highest bid at closing time, and the purchase contract forms automatically at that moment (Art. 6(1)(b) and Art. 22(2)(a) GDPR). This is a mechanical comparison of bid amounts, not profiling: nothing about you personally is evaluated or scored.

Changes

If this notice changes, the update date at the top will change too. Material changes affecting an auction you’re actively bidding in will be emailed to you.