Privacy Policy for The Filthy Fox Auction Club

• Register as a user on our website.
• Bid in an auction (online or in person).
• Purchase items following a successful bid.
• Use our website or engage with us in any way.
• Participate in special events or partnerships.

• We value your privacy & data security.
• We do not use your data for commercial purposes.
• We comply with the UK GDPR and (EU 2016/679) and relevant European Union regulations regarding your privacy.
• We will never sell your data.
• You control your data.

• Register an account or complete forms on our website.
• Participate in an auction (online or in person) or request information about an item.
• Complete a purchase following a successful bid.
• Subscribe to emails or contact us for support.
• Take part in surveys or provide feedback.
• Browse our website (automatically collected analytics and usage data).

• When you register to bid in person.
• When you inspect lots, request condition reports, or consign items.
• When you communicate with us by phone or in writing.

• Contact Data (address, email, phone number).
• Financial Data (payment card or bank account details).
• Transaction Data (payments, purchases, auction history).
• Technical Data (IP address, browser info, usage stats, cookies).
• Profile Data (preferences, bids, survey responses).
• Marketing Data (communication preferences, consent records)
• Identity Data (name, username, date of birth for age verification purposes, image).

• To fulfil contracts or deliver auction services.
• Where you have given consent (marketing communications, etc.).
• To comply with legal obligations (anti-money laundering, tax reporting).
• To pursue our legitimate business interests.

• Allow you to register, log in and place a bid.
• Facilitate purchases or payments.
• Send you updates, invoices, or administrative messages.
• Notify you about changes to services.
• Carry out identity or financial checks.
• To comply with legal and regulatory obligations under the EU Consumer Rights Directive (2011/83/EU).
• Analyse website usage and improve user experience.

• Contractual necessity – It is within our contractual necessity to provide our auction services to you via the website.
• Consent – we collect User explicit consent to process your personal information for marketing communications, non-essential cookies, and data sharing with event partners in accordance with (Art. 6(1)(a) GDPR).
• Legal obligation - When processing is required to comply with the EU Consumer Rights Directive (2011/83/EU).
• Legitimate interests – We process your data based on our legitimate interest in compliance with (Art. 6(1) (f) GDPR) in providing secure website operations).

• IP address and general location.
• Browser type and device information.
• Pages visited and time spent on site.
• Referral source (how you found our site).

• Measure the effectiveness of our advertising campaigns.
• Show you relevant advertisements on social media platforms.
• Track conversions from our advertising.

• We will clearly inform you about the data sharing when you register.
• Partners act as independent data controllers for their own communications.
• You will never be automatically subscribed to partner communications without your express consent.
• You maintain all your data protection rights with both us and our partners.
• We will provide appropriate consent mechanisms where required.

• Service providers (IT support, payment processors such as PayPal, email services, analytics providers).
• Marketing and PR agencies who help us with campaigns and communications.
• Event and media partners for specific collaborations.
• Legal authorities where required by law.

• MailChimp (United States) - email services.
• PayPal (United States) - payment processing.
• Social media platforms (various locations) - advertising pixels.

• EU-US Data Privacy Framework certification.
• UK International Data Transfer Agreements (IDTA). We transfer, in accordance with UK law, by using approved international data transfer agreements and the UK addendum.
• Standard Contractual Clauses (SCCs). We transfer, in accordance with Article 46 of the GDPR, for the transfer of personal data outside the European Economic Area ("EEA").

• SSL encryption for data transmission on our website.
• Restricting access to personal data to restricted employee access only.
• AES-256 encryption for stored data, regular security audits.
• Requiring third-party service providers (such as PayPal and MailChimp) to implement appropriate security measures.
• We log all User consents with timestamps, IP addresses, and context of submission to comply with Article 7(1) GDPR.
• Conducting background checks.

We retain your personal data only as long as necessary to fulfil the purposes outlined in this policy or as required by law. Once retention periods expire, we securely delete or anonymise your data.

In some cases, retention periods may be extended where required by law to do so or for dispute resolution purposes. We may anonymise data for statistical analysis, which can be retained indefinitely.

• Right to access: information about your data stored by us and its processing (art. 15 GDPR).
• Right to rectification: correction of incorrect personal data (art. 16 GDPR).
• Right to erasure: deletion of your data stored by us (art. 17 GDPR).
• Right to restrict processing: restriction of data processing if we are not yet allowed to delete your data due to legal obligations (art. 18 GDPR).
• Right to object: objection to the processing of your data by us (art. 21 GDPR).
• Right to data portability: data portability, provided that you have consented to data processing or have concluded a contract with us (art. 20 GDPR).
• Right to withdraw your consent: if you have given us your consent, you can revoke it at any time with effect for the future.