Privacy Policy

This policy explains what personal data we collect on leonlossyart.com, why, and your rights under the GDPR.

Who is responsible

Léon David de Lossy, leonlossy@gmail.com (the “controller”). Postal address on the legal notice.

What we collect and why

• Account: your name and email, to create your account, sign you in and show your name next to your bids and chat messages (as first name + initial). Legal basis: contract.
• Bids and purchases: your bids, wins, payments and delivery address and phone, to run the auction, deliver the artwork and keep accounting records. Legal basis: contract and legal obligation.
• Payment card: handled entirely by Stripe. We only receive a reference and the card brand and last 4 digits. Legal basis: contract.
• Chat messages: what you write in the public live chat, and reports about messages. Legal basis: legitimate interest (running and moderating the chat).
• Service emails: sign-in links, outbid alerts, winner and order emails. Legal basis: contract.
• News emails (new auctions and news): only if you opted in. You can stop them any time with the link in each email or in your account. Legal basis: consent.
• Statistics: anonymous visit statistics (Vercel Web Analytics), without cookies and without identifying you. Legal basis: legitimate interest.

Cookies

We only use cookies that are strictly necessary to keep you signed in. We don't use advertising or tracking cookies, so no cookie consent is needed.

Who receives your data

Only service providers that help us run the website, under data processing agreements: Supabase (database and accounts, Ireland), Vercel (hosting, Ireland), Stripe (payments, Ireland), Resend (emails, Ireland), and the delivery company for shipping. Some of these companies are American; where data may be accessed from the USA, they rely on the EU-US Data Privacy Framework or the EU standard contractual clauses. We never sell your data.

How long we keep it

• Account data: as long as your account exists.
• Purchase, payment and delivery data: 7 years (Belgian accounting obligations).
• Chat messages: as long as the auction page is online, unless deleted earlier.

Your rights

You can ask to access, correct, delete or export your data, object to its use, or withdraw your consent at any time. You can delete your account yourself in Account, or email leonlossy@gmail.com. If you think we don't respect your rights, you can complain to the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit, Rue de la Presse 35, 1000 Brussels, dataprotectionauthority.be).