Privacy statement

1. Which data and why

Account: your name, e-mail address, country, language, phone number, account type and, for a business, the company name and VAT number. Needed to run your account and to send you the e-mails of the auction.

Verification: your date of birth, invoice address, mobile number (confirmed with a code) and a copy of your identity document. Needed because everyone is verified before the first bid or sale (auction rules). The document is deleted as soon as the check is decided; the details you gave and the outcome are kept as proof of the check.

Bidding and selling: your bids and maxima, the horses you register with their dossiers, your questions and answers, your watchlist, your purchases and sales, the sales contracts, the payment statements and the invoices. Needed to perform the agreements.

Payout and tax: the bank account and holder for payouts, and the tax identification number and country that platforms have to report about sellers (DAC7). Needed to pay you out and to meet TROTTERA's legal reporting duties.

Problem reports: what you wrote, the page address, your device type and a screenshot you attached, when you use the "Report a problem" button in the test phase. Needed to fix what goes wrong.

Technical: an audit trail of what was done with your account (with the IP address stored only as a hash), error reports without personal data, and the e-mails sent to you. Needed for security, fraud prevention and proof.

2. On which basis

Performing the agreement with you (account, bids, sales, payments, payouts); a legal obligation (identity verification, tax and reporting duties, the retention of invoices); TROTTERA's legitimate interest in a secure and honest auction (audit trail, fraud prevention, error reports); and your consent for anything else, such as news by e-mail, which you can withdraw at any time.

3. Who else sees your data

Bidders see each other only as an alias with a country. The seller and the buyer of a sold horse receive each other's name, e-mail address, phone number and the horse's location, for the pickup and the studbook transfer.

TROTTERA uses service providers that process data on its behalf, under a processing agreement: Supabase (database, files and login, in the EU), Vercel (hosting, with the application running in Frankfurt), Resend (e-mail), Cloudflare (video), Sentry (error reports, without personal data) and Inngest (scheduled jobs; Inngest runs in the United States and receives only record identifiers, never names, e-mail addresses or amounts). Later: the payment partner, the identity verification partner and, in case of non-payment, a collection agency.

TROTTERA shares data with the tax authorities where the law requires it (for example the yearly DAC7 report on sellers) and with a court or authority when it is obliged to.

4. Where your data is

In the European Union. The only exception is Inngest in the United States, which receives identifiers only, as described above.

5. How long

Your account data for as long as you have an account. The copy of your identity document until the verification is decided, then it is deleted. Invoices, contracts, payment statements and the audit trail for seven years after the year they belong to (Dutch tax law), also after you delete your account; the personal data in them is then reduced to what the law requires. Screenshots of problem reports 90 days. Notifications in the app one year. An account whose e-mail address is never confirmed is deleted after 30 days.

6. Your rights

You can see and download everything TROTTERA holds about you from the account page (data export) and correct your details there. You can delete your account from the account page when you have no open obligations; TROTTERA then anonymises your personal data and keeps only what the law requires. You can object to a processing based on a legitimate interest and withdraw a consent. Write to info@trottera.eu for anything else; TROTTERA answers within a month. You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

7. Security

Data travels encrypted and is stored in the EU. Documents are in private storage that opens only for the people entitled to them and for ten minutes at a time. Only TROTTERA's admins see names behind aliases. Everything done with an account is in the audit trail.

8. Cookies

TROTTERA uses functional cookies only; see the cookie notice.

9. Changes

This statement has a version and a date. TROTTERA updates it when the processing changes, for example when the payment partner and the verification partner are connected, and shows the current version here.