Bavaria Auction House (“Bavaria”, “we”, “us”) is the responsible party for the personal information described in this policy. We run online auctions, valuations, consignments and the Second Time Around fixed-price marketplace.

Our Information Officer is responsible for making sure we comply with POPIA and for dealing with requests and complaints about personal information.

Information Officer: Georges Lupke
Email: info@bavariaauctionhouse.co.za
Address: 7 Rhodes Street, Kensington B, Randburg, Gauteng 2194

We collect only what we need for the service you are using. Depending on how you deal with us, this may include:

• Registration and your account: first name, surname, email address, mobile and telephone numbers, postal address (street, suburb, city, province, postal code and country) and your password, which is stored only in encrypted form.
• Bidder verification: your South African ID or passport number, used to verify your identity before you can bid, and your acceptance of our Terms & Conditions and this policy.
• Bidding and buying: auction registrations, bids (amount, lot and time), watchlists, lots you win, invoices, Second Time Around purchases and enquiries, and the payment references needed to match your payments.
• Valuations and consignments: your contact details and the details of the items you submit, such as descriptions, photographs, dimensions, condition, provenance, artist or maker, expected value and location. For consignments we also keep the consignment agreement, the lots created from your items, sale results and the settlement due to you.
• Estates and professional enquiries: if you contact us as an executor, attorney or other representative, your name, firm, position, contact details and the details of the estate or instruction.
• Questions, condition reports and contact forms: your name, contact details and the content of your message or request.
• Auction alerts: your email address and your subscription choice.
• Website use: technical information such as pages visited, device and browser type, and how you arrived at our site. We collect this through cookies only if you accept them (see section 9).

We do not ask for special personal information (such as health, religion or biometric information). Card payments are processed by our payment provider, Yoco: we never see or store your full card details. Payments by EFT are made directly to our bank account.

We use personal information for these purposes, and on these lawful grounds under section 11 of POPIA:

• To provide our services and perform our contract with you: creating and managing your account, approving bidders, running auctions, recording bids, issuing invoices, arranging collection, handling valuations and consignments, and settling sale proceeds.
• To meet legal obligations: keeping accounting and tax records, verifying identity, and responding to lawful requests from authorities.
• For our legitimate interests: preventing fraud, shill bidding and misuse of our platform, keeping our systems secure, resolving disputes and enforcing our Terms & Conditions.
• With your consent: sending auction alerts and other marketing, and using analytics and advertising cookies. You can withdraw consent at any time.
• To keep you informed about your bids and purchases: service emails such as outbid notices and invoices.
• To answer you: responding to questions about lots, condition report requests and general enquiries.

If you do not provide information we need, such as your ID or passport number for bidder verification, we may not be able to provide that service.

We send auction alerts and similar marketing only to people who have signed up for them or who are our customers, as section 69 of POPIA allows. Every marketing message tells you how to unsubscribe. You can also unsubscribe at any time by emailing info@bavariaauctionhouse.co.za.

Your information is stored in a secure database and file storage service provided by Supabase. Our website is hosted by Vercel. We protect it with reasonable technical and organisational measures, as section 19 of POPIA requires, including:

• encrypted connections (HTTPS) between your browser and our website;
• passwords stored only in encrypted (hashed) form;
• database access rules that let you see only your own records;
• access to personal information limited to staff who need it for their work.

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as section 22 of POPIA requires.

We do not sell personal information. We share it only where necessary, with:

• Service providers (operators) who process it for us: Supabase (database, user accounts and file storage), Vercel (website hosting), Resend (email delivery), Yoco (card payments) and, if you accept cookies, Google (advertising measurement and analytics) and Meta (advertising measurement on Facebook and Instagram). They may process it only on our instructions and must keep it secure.
• Parties to a sale, where needed: for example, telling a seller the outcome of their consignment. We do not give a buyer's or seller's contact details to the other party without consent unless the law requires it.
• Banks: to receive and make payments.
• Professional advisers: such as our auditors, accountants and attorneys.
• Authorities: such as SARS, the police or a court, where the law requires it.

Some of our service providers, including Supabase, Vercel, Resend, Google and Meta, may store or process information on servers outside South Africa. We only use providers that are bound by agreements or laws that give your information protection substantially similar to POPIA, as section 72 requires.

We use cookies and similar technologies to measure visits to our website and the performance of our adverts, through Google and Meta (Facebook and Instagram). These are switched off until you choose “Accept” in our cookie notice. If you choose “Decline”, we do not set them. Your choice is saved in your browser; to change it, clear our site data in your browser and choose again.

Our website also uses essential cookies to keep you signed in. These are needed for your account to work.

We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires:

• Account and bidder information: while your account is active, and for up to 5 years after your last transaction, so we can deal with queries, disputes and legal obligations.
• Invoices, payments and other accounting records: at least 5 years, as tax law requires, or longer where other laws require it.
• Valuation requests that do not lead to a consignment: up to 2 years.
• Consignment records and sale results: for as long as needed to settle with the seller and meet our accounting and legal obligations.
• Auction alert subscriptions: until you unsubscribe.
• Enquiries and messages: up to 2 years after we last dealt with you.

When we no longer need information, we delete it or remove anything that identifies you.

Under POPIA you have the right to:

• ask whether we hold personal information about you, and request a copy of it;
• ask us to correct information that is inaccurate, incomplete or out of date;
• ask us to delete information we are no longer entitled to keep;
• object to our processing of your information on reasonable grounds, including processing for direct marketing;
• withdraw your consent where we rely on it, without affecting processing done before you withdrew;
• complain to the Information Regulator (see section 12).

To use these rights, email our Information Officer at info@bavariaauctionhouse.co.za. We may ask you to verify your identity before acting on a request. Access requests are handled in line with POPIA and the Promotion of Access to Information Act, under which a prescribed fee may apply. We will respond within a reasonable time.

Please contact us first so we can try to resolve your concern. If you are not satisfied with our response, you may lodge a complaint with the Information Regulator:

Our services are intended for adults. You must be 18 or older to register or bid. We do not knowingly collect personal information from children.

We may update this policy from time to time. The current version is always published on this page with its effective date. If we make a significant change, we will tell registered users by email.