Draft v2026-07-11.1 — for review; not yet legal advice. Placeholders marked in [brackets].
Ordella Privacy Notice
Version: 2026-07-11.1
Status: DRAFT — for legal review only
Controller: [LEGAL ENTITY NAME], [REGISTERED ADDRESS], [CONTACT EMAIL]
This Privacy Notice explains how Ordella processes personal data under the GDPR and Dutch implementation law.
1. Data we process
| Category | Examples | Purpose |
|---|---|---|
| Account | Email, name, phone (if verified) | Account, communication, fraud prevention |
| Seller submission | Photographs, notes, attestations | Catalogue, evidence, disputes |
| Buyer activity | Bids, questions, payment status | Auctions, fulfilment |
| Technical | IP address, device, logs | Security, audit trail |
| Communications | Messages via Ask the House | Moderation, dispute files |
Photographs may contain incidental personal data (e.g. backgrounds). Please minimise this.
2. Legal bases (Article 6 GDPR)
- Contract — providing the platform, auctions, payments, shipping coordination.
- Legitimate interests — fraud prevention, marketplace integrity, dispute evidence, service improvement (balanced against your rights).
- Legal obligation — tax, anti-money-laundering where applicable.
- Consent — where explicitly requested (e.g. optional marketing).
3. AI processing
3.1 We use AI providers (including Anthropic for catalogue and concierge features) to analyse photographs and text on our instructions.
3.2 Providers act as processors under data processing agreements. We do not permit them to use your submission data to train public models for their own purposes unless disclosed and consented where required.
3.3 AI output is reviewed by you (seller) before publication where applicable.
4. Sharing
We share data with:
- Payment providers (e.g. Stripe) for transactions;
- Carriers for delivery;
- Infrastructure providers (hosting, storage) under contract;
- Authorities when legally required.
We do not sell personal data.
5. Retention
- Account data — while active plus statutory periods.
- Transaction and dispute evidence (including photographs, bids, attestations) — typically 7 years after transaction closure or longer if litigation requires.
- Server logs — limited period unless needed for security investigations.
6. Your rights
You may request access, rectification, erasure, restriction, portability, and objection where applicable. Contact [CONTACT EMAIL]. You may lodge a complaint with the Autoriteit Persoonsgegevens (Dutch DPA).
Some rights are limited where we must retain evidence for disputes or legal obligations.
7. International transfers
If data is transferred outside the EEA, we use Standard Contractual Clauses or other approved mechanisms.
8. Security
We apply appropriate technical and organisational measures. No system is perfectly secure; report concerns to [CONTACT EMAIL].
9. Children
Ordella is not directed at children under 18.
10. Changes
We will notify material changes and update the version identifier.
End of Privacy Notice — version 2026-07-11.1