Privacy policy
What Numirama knows about you, why, who else sees it, how long it is kept, and the rights you have over it.
Last updated 24 October 2026
Who is responsible
[Company name], [Registered office address], is the controller of the personal data processed on Numirama. Write to [privacy@…] for anything about your data.
When you buy from a house, that house also becomes controller of the data it needs for the sale (your name, delivery address, the order and its invoice), under its own obligations as a seller.
What we collect, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, password (stored hashed), passkeys and second sign-in step | Your account and signing you in safely | Contract |
| Legal name, country, date of birth, verification status. The identity document and selfie are processed by Stripe; Numirama never receives them. | Verifying who bids and who we collect payments from | Legal obligation (anti-money-laundering), contract |
| Bids and maximums, with their time and the address they came from | Running the auctions, proving what was bid, preventing fraud | Contract, legitimate interest |
| Orders, delivery address, payments, parcels and their tracking, returns and disputes | Selling and delivering what you win, protecting your payment | Contract, legal obligation (accounting) |
| Watchlist, saved searches, alert and email preferences, devices you enabled push alerts on | Telling you about the lots and searches you follow | Contract; your consent for push alerts |
| Signed-in sessions: browser, address, last activity | Keeping your account secure; letting you sign other devices out | Legitimate interest |
| For houses asking for an early-bird place: name, house, professional email address, the trade show they came from | Calling the house back about Numirama | Legitimate interest |
| Messages you send us | Answering you | Legitimate interest |
We do not sell your data, do not use it for advertising, and do not build profiles of you for marketing.
Who receives it
- The house you buy from: what it needs for the order. Houses see that a bidder is verified, not the identity details.
- Other bidders see bids under an anonymous number, never your name.
- The services below, which process data on our behalf and only on our instructions.
- Authorities, when the law requires it.
| Service | What for | Where |
|---|---|---|
| Vercel | Hosting of the website and of the photographs houses upload | United States, under the EU Standard Contractual Clauses |
| [Database host] | Database of accounts, bids and orders | [Location] |
| Stripe | Checking identity documents and selfies; collecting and holding payments, paying houses | Ireland, and the United States under the EU Standard Contractual Clauses |
| Brevo | Sending emails: confirmations, alerts, receipts | France |
| Ship24 | Following parcels across carriers from their tracking number | [Location] |
When data leaves the European Union, it is protected by the European Commission’s Standard Contractual Clauses or an adequacy decision.
How long we keep it
- Account data: as long as the account is open, then 3 years after your last activity for any claim, unless you ask for erasure sooner.
- Identity verification: 5 years after the end of the relationship, as anti-money-laundering law requires.
- Bids, orders and invoices: 10 years, as French accounting and commercial law requires.
- Sessions and security logs: up to 12 months.
- Alerts: 12 months.
- Early-bird requests: until the house opens an account or tells us it is not interested, and at most 3 years.
Your rights
You can access your data, have it corrected or erased, object to or restrict its use, receive it in a portable format, withdraw a consent at any time, and give instructions for after your death. Some data cannot be erased while the law requires us to keep it (accounting, anti-money-laundering); we then keep only what is required.
Most of your data can be seen and changed in your settings. For anything else, write to [privacy@…]; we answer within a month. If you are not satisfied, you can complain to the CNIL (www.cnil.fr), the French data protection authority.
Security
Passwords are stored hashed, connections are encrypted, and access to member data within Numirama is limited to the staff who need it, with every administrative action recorded. Payment details are handled by our payment partner and never stored by Numirama.
Cookies
Numirama only uses the cookies it needs to work. They are listed on the cookies page.