Privacy policy

This privacy policy explains which personal data we process when you use Koi Auction Europe, why we do so, on what legal basis, with whom we share data, how long we keep it and what rights you have.

1. Who is responsible for your personal data?

Koi Auction Europe is an online auction platform operated by:

Koi en Vijverbouw B.V.
Mostheuvel 11
5513 NT Wintelre
The Netherlands
Chamber of Commerce (KvK) no.: 99492342
VAT no.: NL869013282B01

Email: info@koienvijverbouw.nl
Phone: 06 - 3073 5524

Koi en Vijverbouw B.V. is the controller of the personal data processed through Koi Auction Europe, unless another party is independently responsible for a specific processing operation.

2. What data do we process and why?

Creating and managing an account

When you create an account, we process the data needed to register and manage your account. This may include, among other things:

• your name;
• email address;
• phone number;
• billing and delivery address;
• language preference;
• your confirmation that you are 18 years of age or older;
• information about your acceptance of our general terms and conditions, including the accepted version, date and time.

We do not store your password in readable form.

Legal basis: performance of the contract and taking steps at your request prior to entering into a contract.

Bidding and auctions

When you take part in an auction, we process, among other things:

• your bids;
• automatic bids and the maximum amounts you have set;
• the date and time of bids;
• auctions you have won;
• your watchlist;
• relevant notifications in your account.

Other visitors may see bids under a masked bidder code. Your name and contact details are not publicly displayed.

Legal basis: performance of the contract.

Payment, invoicing and accounting

For payments and our accounting records, we process, among other things:

• order details;
• name and address;
• email address;
• invoice details;
• purchase amounts;
• payment status;
• payment references.

Payments are processed by Mollie. The data needed to carry out a payment, such as certain bank or card details, may be processed directly by Mollie. We do not ourselves store your full card details, CVV code or online banking credentials.

Legal basis: performance of the contract and compliance with legal and tax obligations.

For part of the processing of payment data, Mollie independently determines the purposes and means and acts as a controller in its own right.

Collection and transport

When a koi is collected or transported, we may process, among other things:

• name;
• delivery address;
• phone number;
• email address;
• shipment details;
• the chosen carrier;
• track-and-trace details;
• information needed to carry out the delivery properly.

Where transport is required, we share with the carrier only the data that is necessary to deliver the shipment.

Legal basis: performance of the contract.

Emails and notifications

We use your email address for messages that are necessary for your account, bids and purchases. For example:

• account confirmations;
• information about auctions you have won;
• payment requests and payment confirmations;
• information about collection or transport;
• important changes relating to your purchase.

We may also send optional auction notifications, for example when you have been outbid or when an auction you follow is about to end.

We may keep a technical log of emails sent, including the recipient, the type of message, the time of sending and whether delivery was successful.

You can switch off optional notifications in your account or, where available, via the unsubscribe option in the email.

Legal basis: performance of the contract for necessary messages, and legitimate interest for functional, optional auction notifications.

Contacting us

If you contact us, we process the data needed to answer your question. This may include:

• name;
• email address;
• phone number;
• subject;
• the content of your message;
• information about a purchase or auction if your question relates to it.

Legal basis: our legitimate interest in handling questions and requests, or performance of the contract where your question relates to a purchase.

Security, fraud and misuse

To protect the platform, our customers and the proper conduct of the auctions, we process technical and usage data.

This may include, among other things:

• IP address;
• time of signing in and bidding;
• technical data about important account actions;
• audit logs;
• technical error messages;
• signals from our bot protection;
• signals that may indicate misuse of the platform.

For example, the system may flag cases where multiple accounts take part from the same IP address, where unusual bidding patterns occur, or where auctions are repeatedly won without subsequent payment.

Fraud signals do not automatically lead to the conclusion that fraud has occurred. Where a measure is considered on the basis of such signals, a human review takes place.

Legal basis: our legitimate interest in preventing fraud and misuse and in protecting the security and reliability of the platform and the auctions.

Customer contact and unpaid auctions

We may keep internal notes that are necessary for customer service and the handling of purchases.

We may also record when a won auction has been cancelled due to non-payment and whether an account has, for that reason, been temporarily or permanently blocked from bidding.

Where a block is applied automatically on the basis of predefined criteria for repeated non-payment, you can ask us to have the situation reviewed by a staff member. You can explain your point of view and object to the block.

Legal basis: performance of the contract and our legitimate interest in preventing unpaid auctions and misuse of the platform.

Reviews

If you voluntarily post a review or give us permission to publish it, we may process:

• name;
• place of residence;
• review text;
• rating;
• date;
• source;
• where applicable, a link to your purchase to show that it concerns a verified purchase.

Legal basis: consent.

You can withdraw your consent to the publication of a review at any time.

3. Automated signals and decisions

Koi Auction Europe uses technical signals to help detect fraud, misuse and non-payment.

Signals about potentially fraudulent or unusual bidding behaviour are not used to establish that someone has committed fraud without human review.

In the event of repeated non-payment, the system may, based on predefined criteria, automatically block the ability to place further bids. You can always ask us to have this decision reviewed by a staff member, express your point of view and contest the decision.

After review, a staff member may amend or lift a block.

4. With whom do we share personal data?

We do not sell your personal data.

To operate Koi Auction Europe, we use various service providers. They receive personal data only to the extent necessary for their services.

Supabase

We use Supabase for, among other things, our database, accounts and authentication.

The primary database of Koi Auction Europe is hosted in a European region.

Vercel

We use Vercel for hosting and making the platform available.

In addition, technical performance data may be processed to monitor the speed and operation of the website. We do not use advertising tracking for this.

Twilio SendGrid

We use Twilio SendGrid to send transactional emails, such as account messages, auction notifications, payment information and information about your purchase.

Cloudflare

We use Cloudflare for parts of our technical infrastructure, including:

• delivering images and videos securely and quickly;
• protecting forms against bots and automated misuse.

For this purpose, Cloudflare Turnstile processes technical signals needed to distinguish normal use from automated misuse. For part of this Turnstile processing, Cloudflare describes itself as a processor acting on behalf of the website operator.

PDOK (Dutch Cadastre)

When you enter a Dutch address, the address finder of PDOK, a service of the Dutch Cadastre (Kadaster), helps you complete it. The address fragments you type are sent directly from your browser to PDOK, together with the technical data that accompanies such a request (such as your IP address). PDOK does not set cookies for this.

Mollie

We use Mollie to process payments.

For this purpose, personal data necessary to carry out the payment is shared with Mollie. Mollie processes certain personal data as an independent controller and has its own privacy statement for this.

Carriers

If you choose transport, we share with the carrier the data needed to deliver the koi to you.

We currently use, among others, GO! Express & Logistics Netherlands B.V.

This may include, for example, your:

• name;
• delivery address;
• phone number;
• email address;
• shipment details.

Bookkeeping and accounting

Invoices and other data necessary for our financial records may be processed in our accounting software and, where applicable, shared with our bookkeeper or accountant.

Government authorities

We provide personal data to government authorities where we are legally required to do so, for example to the Dutch Tax and Customs Administration (Belastingdienst).

5. Processing outside the European Economic Area

Some of our service providers or their subcontractors may process personal data outside the European Economic Area, for example in the United States.

Where personal data is transferred to a country outside the EEA, we ensure that there is a valid legal basis and an appropriate safeguard for that transfer. Depending on the service provider concerned, this may be based on, for example:

• an adequacy decision of the European Commission;
• the applicable EU model contract clauses, also known as Standard Contractual Clauses;
• another legally permitted transfer mechanism.

The GDPR requires data subjects to be informed about such transfers and the applicable safeguards.

6. How long do we keep personal data?

We do not keep personal data for longer than necessary for the purpose for which it was collected, unless we are legally required to keep it for longer.

For Koi Auction Europe, we currently apply, among others, the following retention periods:

• Invoices and orders: 7 years, due to tax retention obligations.
• IP addresses in the audit log: 90 days.
• Log data about bids: 365 days.
• Other audit log data: up to 730 days.
• Email logs: 180 days.
• Technical error logs: 90 days.
• Reviews: until you withdraw your consent or the review is removed for another reason.

Your account

Your account remains active until you close it.

When you close your account, we anonymise or delete personal data that is no longer necessary. Your name, contact details and address details are removed from the active account and, among other things, your watchlist, automatic bids and notifications are deleted.

Data that we are required to keep under a legal obligation, such as invoices and the related invoice details, is retained for the applicable retention period.

Bids may be retained to keep historical auction results verifiable, but after anonymisation they are no longer directly linked to your account.

7. Your privacy rights

Under the GDPR, you have various rights, depending on the circumstances.

Among other things, you can request:

• access to the personal data we process about you;
• rectification of inaccurate or incomplete data;
• erasure of personal data;
• restriction of processing;
• to object to processing based on a legitimate interest;
• transfer of your data where the right to data portability applies;
• to withdraw your consent where processing is based on consent.

Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

You can view, download or update much of your data yourself via My details in your account.

For other requests, you can contact us at info@koienvijverbouw.nl.

We will in principle respond to a privacy request within one month. Where necessary, we may ask you for additional information to verify your identity.

The GDPR grants data subjects, among other things, rights of access, rectification, erasure, restriction, objection and data portability.

8. Complaints about the processing of your data

Do you have a question or complaint about how we handle your personal data? Please feel free to contact us first at:

info@koienvijverbouw.nl

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Security

We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access, misuse and unwanted alteration.

These include, among other things:

• encrypted HTTPS connections;
• secure authentication;
• access rights per user role;
• two-factor authentication for administrators;
• time-limited administrator sessions;
• technical logging;
• protection against automated misuse and bots.

No digital system can fully rule out every security risk. We therefore review our security measures regularly and adjust them where necessary.

10. Minors

Koi Auction Europe is intended for persons aged 18 and over.

We do not knowingly collect personal data from persons under 18 for participation in our auctions.

11. Cookies and local storage

Koi Auction Europe uses functional cookies and local storage that are necessary for the platform to function, to be secure and to be user-friendly.

We currently do not use advertising pixels or cookies that track visitors across different websites for advertising purposes.

More information can be found in our Cookie Policy.

12. Changes to this privacy policy

We may amend this privacy policy when our services, technical systems or the way we process personal data change.

The date at the top of this page shows when this privacy policy was last updated.

We may inform you separately of any significant changes.