Privacy notice

This notice describes how Antiqa S.r.l. collects and processes the personal data of users who visit and use the website www.antiqa.it and the services made available through the Antiqa platform (the "Platform").

The notice concerns, in particular, visitors to the Platform, registered users, buyers, users who apply to operate or operate as sellers, as well as users who subscribe to the newsletter, use waiting lists, save products to their favourites or request other notifications and communications through the Platform.

Personal data is processed in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability set out in the GDPR and in the applicable national data protection legislation.

The Data Controller is Antiqa S.r.l., with registered office at Via San Paolo 232, 59100 Prato (PO), Italia, VAT number 02640580979, e-mail: privacy@antiqa.it.

For any request relating to the processing of personal data, or to exercise the rights granted by the applicable legislation, the Controller can be contacted using the details given above.

Antiqa has appointed a Data Protection Officer ("DPO"), who can be contacted at the e-mail address: dpo@antiqa.it.

For certain transactions, the Seller may be required, under the legislation applicable to them, to identify the Buyer before proceeding with the transaction.

Solely as regards the processing of the Buyer’s data and documents carried out within that identification procedure, the Seller acts as Data Controller: the Seller determines the purpose of the processing, verifies the Buyer’s identity and decides whether the transaction may be carried out.

In that context, Antiqa acts as Data Processor on behalf of the Seller pursuant to art. 28 GDPR: it provides the Document Transmission Tool through which the Buyer sends the required documentation, keeps that documentation temporarily in encrypted form and makes it available to the Seller concerned.

Within this processing carried out on behalf of the Seller, Antiqa does not take the decision on the identification of the Buyer, nor does it decide whether the transaction may be carried out. Those activities and decisions remain the responsibility of the Seller.

This distinction does not affect the processing that Antiqa carries out for its own purposes in managing the Platform and the services provided directly to users, for which Antiqa acts as an independent Data Controller.

Antiqa processes different categories of personal data depending on how the user uses the Platform and on the features requested.

The IT systems and software procedures that run the Platform acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols.

This category includes, by way of example, IP addresses, domain names of the devices used, URIs/URLs of the resources requested, the date and time of the request, the method used to submit the request to the server, the response status code, and information about the user’s device, browser, operating system and computing environment.

Logs and technical information needed to ensure the security of the Platform, prevent abuse and fraud and detect anomalies may also be processed.

The Platform uses cookies and/or similar technologies necessary for its operation.

Any use of cookies or other tools that are not strictly necessary takes place in accordance with the applicable legislation and, where required, after obtaining the user’s consent.

For the types of cookies and tools actually used, their purposes, duration, providers and how to manage your preferences, please refer to the Cookie Policy available on the Platform. Go to the Cookie Policy

When the user creates an account or uses the Platform as a buyer, Antiqa may process, as Data Controller, the following data:

• first name and surname;
• date of birth and tax code, where necessary in relation to the purchase or to applicable obligations;
• e-mail address and other contact details;
• account and authentication data;
• telephone number, where provided;
• shipping and/or billing address;
• information relating to orders and to the products purchased;
• information relating to returns, refunds, complaints and disputes;
• communications with Antiqa and support requests;
• any tax data required under the applicable legislation;
• information relating to identity verification having been carried out and to its outcome or status;
• information relating to favourites, waiting lists, requested notifications and other features used through the account.

Where provided for, the user may also register or authenticate through third-party services, namely Google. In that case Antiqa may receive from the relevant provider the data necessary for authentication, in accordance with the permissions granted by the user.

When, in relation to a given transaction, the Seller has to identify the Buyer, the following may be processed through the Document Transmission Tool made available on the Platform:

• the Buyer’s identification and personal details;
• the details of the identity document;
• images or copies of the identity document uploaded by the Buyer;
• information relating to the order and to the file to which the document refers;
• the date and time of the upload and download operations;
• the fingerprint (hash) of the files and the technical logs relating to the transmission;
• information relating to the outcome of the procedure recorded by the Seller on the Platform.

For this processing, the Seller acts as Data Controller and Antiqa processes the data on behalf of the Seller as Data Processor pursuant to art. 28 GDPR, within the limits of the technical activities entrusted to it.

The Buyer uploads the documentation through the Platform; Antiqa keeps it temporarily in encrypted form and makes it accessible only to the Seller concerned and, to the extent strictly necessary for the technical management of the service, to Antiqa’s authorised staff.

The Seller examines the documentation, verifies the Buyer’s identity, records the outcome of the verification and decides whether the transaction may proceed. The Seller also downloads the documentation and retains it in their own systems for the period required by the legislation applicable to them.

When a User applies to operate or operates on the Platform as a Seller, the following may be processed:

• identification and personal details;
• contact details;
• account information;
• professional and commercial data;
• administrative and tax data;
• information relating to sales;
• data relating to transactions, commissions, payouts, refunds and disputes;
• communications and support requests;
• photographs and videos of the items offered for sale;
• certificates and other documentation relating to the products, where uploaded;
• descriptions, characteristics, price and further information entered for the purposes of publishing the listings;
• information relating to the performance of the listings and to the activity carried out on the Platform.

Personal data is processed for the following purposes:

• browsing, operation and security of the Platform: to allow the services to function correctly, ensure the security of the systems and prevent unauthorised access, fraud and malfunctions. The legal basis is the performance of the service requested, pursuant to art. 6(1)(b) GDPR where applicable, and Antiqa’s legitimate interest in the security and correct operation of the Platform, pursuant to art. 6(1)(f) GDPR;
• registration and account management: to create and manage the account, authenticate the user and allow them to use the reserved features. The legal basis is art. 6(1)(b) GDPR;
• management of purchases and sales: to allow the conclusion and performance of the transactions carried out on the Platform and to manage orders, payments, deliveries, commissions, payouts, returns, refunds and disputes. The legal basis is art. 6(1)(b) GDPR;
• compliance with legal obligations: to comply with administrative, accounting and tax obligations and with any further obligations applicable to the sale of the goods offered on the Platform. The legal basis is art. 6(1)(c) GDPR;
• identity verification: to verify the user’s identity where this is required in order to use certain features or complete a purchase, to prevent fraud, ensure the security of the marketplace and comply with any applicable obligations. Depending on the specific purpose, the processing is based on art. 6(1)(b), (c) and/or (f) GDPR;
• payment management: to allow payments to be executed, verify their outcome and manage any refunds, reversals and disputes. The legal basis is art. 6(1)(b) GDPR and, where applicable, art. 6(1)(c) GDPR;
• support: to respond to the user’s requests and provide assistance. The legal basis is art. 6(1)(b) GDPR where the request concerns the contractual or pre-contractual relationship and, in other cases, Antiqa’s legitimate interest in responding to the requests received pursuant to art. 6(1)(f) GDPR;
• newsletter, promotional communications and notifications: to send newsletters and promotional communications concerning Antiqa and its services, on the basis of the data subject’s consent pursuant to art. 6(1)(a) GDPR. Consent is optional and may be withdrawn at any time. Notifications regarding product availability, favourites, waiting lists or other features expressly requested by the user are instead service communications and are processed pursuant to art. 6(1)(b) GDPR. In the e-mails sent by the Platform, Antiqa records in aggregate form whether the message is opened and the clicks on the links it contains, to check that it was delivered and to understand which communications are useful; for promotional communications this measurement is based on the same consent, for service communications on Antiqa’s legitimate interest pursuant to art. 6(1)(f) GDPR;
• analytics and improvement of the Platform: to analyse the use of the Platform, produce statistics, improve the services and provide sellers with information and suggestions relating to their activity. Depending on the specific feature, the processing is based on the performance of the service requested pursuant to art. 6(1)(b) GDPR or on Antiqa’s legitimate interest in improving its services pursuant to art. 6(1)(f) GDPR, without prejudice to consent where required for the use of cookies or other tracking tools;
• features based on artificial intelligence: to provide sellers with tools supporting the preparation of listings, including by processing the images and the information relating to the items in order to generate proposed descriptions and other supporting content. The processing is based on the performance of the service requested pursuant to art. 6(1)(b) GDPR. On the basis of the features currently envisaged, these tools do not involve decisions based solely on automated processing which produce legal effects or similarly significantly affect the data subject pursuant to art. 22 GDPR;
• protection of rights and prevention of abuse: to prevent and counter fraudulent or abusive conduct and to establish, exercise or defend a right of Antiqa or of the users. The legal basis is legitimate interest pursuant to art. 6(1)(f) GDPR.

Within the Antiqa Protect service, where activated and in accordance with the relevant contractual terms, Antiqa may process the data of the Buyer and of the Seller, information relating to the order, the communications exchanged, and the elements and documentation provided by the parties for the handling of the dispute.

Antiqa processes this data as an independent Data Controller in order to provide the Antiqa Protect service, handle the dispute and take the decisions within its competence relating to the refund and to the payout, in accordance with the applicable terms.

The legal basis is the performance of the contract or of pre-contractual measures pursuant to art. 6(1)(b) GDPR and, for any subsequent retention necessary to protect Antiqa’s rights, legitimate interest pursuant to art. 6(1)(f) GDPR.

Personal data may be disclosed or made accessible, within the limits of the purposes described above:

• to Antiqa’s staff, collaborators and other authorised persons;
• to providers of IT, hosting, cloud, database and other services necessary for the operation of the Platform;
• to the providers of the authentication services, where the user chooses to log in through third parties;
• to Stripe, through the applicable Stripe Connect configuration, and to any other providers involved in the management of payments and of the related transactions;
• to the providers used to send e-mails and newsletters;
• to the providers of the analytics and artificial intelligence services used by the Platform;
• to sellers, limited to the buyer’s data necessary to manage the order and, where applicable, to the regulatory obligations connected with the sale;
• to the parties involved in the shipment and delivery of the products;
• to banks and intermediaries involved in the management of the transactions;
• to consultants, accountants, lawyers and other professionals;
• to the authorities and other parties to whom disclosure is mandatory by law or necessary to establish, exercise or defend a right.

With specific regard to the documentation sent by the Buyer for the identification requested by the Seller, Antiqa makes the data and documents accessible to the Seller concerned, who acts as Data Controller for that processing. Any technology providers that Antiqa involves in carrying out that activity on behalf of the Seller are governed in accordance with art. 28 GDPR and with the agreement between Antiqa and the Seller.

The parties who process personal data on behalf of Antiqa, where Antiqa acts as Data Controller, are appointed as Data Processors pursuant to art. 28 GDPR, where the conditions for that are met.

Some parties may instead act, for certain activities, as independent Data Controllers.

The up-to-date list of the Data Processors may be requested from Antiqa using the contact details given in this notice.

Where the involvement of some of Antiqa’s technology providers may entail transfers of personal data outside the European Economic Area (the "EEA"), such transfers will be carried out in accordance with arts. 44 et seq. GDPR and, depending on the case, on the basis of:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses;
• other appropriate safeguards provided for by the applicable legislation;
• where the conditions for it are met, one of the derogations provided for by art. 49 GDPR.

The data subject may request further information from Antiqa about the transfers carried out and the safeguards applied, using the contact details given in this notice.

Personal data for which Antiqa acts as Data Controller is retained for as long as necessary for the purposes for which it was collected and, subsequently, for the period that may be necessary to comply with regulatory obligations and to protect the rights of Antiqa and of the data subjects.

In particular, data relating to the account, purchases, sales, transactions and relationships with users is retained for the duration of the relevant relationship and, subsequently, for the periods provided for by the applicable legislation or necessary to handle any disputes; tax and accounting documentation is retained, where applicable, for up to 10 years.

By contrast, the images of the Buyer’s identity documents that Antiqa processes on behalf of the Seller within the identification procedure are kept by Antiqa temporarily, in encrypted form, for the time needed to make them available to the Seller and, in any event, for no longer than 7 days from the first download of the file and no longer than 30 days from upload. The images are also deleted if the order is cancelled, in accordance with the technical arrangements of the service.

The Seller independently retains the downloaded documentation for the period required by the legislation applicable to them.

The document details, the fingerprint (hash) of the files and the technical logs of the operations may be kept separately from the document images, solely to document the transmission and the operations carried out, in accordance with the instructions applicable to the relationship between the Seller and Antiqa, for 24 months from the order.

Data processed within Antiqa Protect is retained for the period necessary to handle the relevant dispute and, subsequently, for the period necessary to protect rights and handle any disputes, in accordance with the applicable time limits.

Data processed for newsletter and marketing purposes is retained for 24 months and in any case no longer than any withdrawal of consent or request for erasure. Further data, including data relating to support, favourites, waiting lists, notifications, analytics and security, is retained for a period that is proportionate and strictly necessary for the respective purposes.

Pursuant to arts. 15 et seq. GDPR, the data subject may, in the cases provided for by the legislation, obtain access to, rectification or erasure of their personal data, request the restriction of processing, exercise the right to data portability and object to the processing. The data subject may also withdraw at any time any consent given, and object at any time to processing carried out for direct marketing purposes.

These rights may be exercised by contacting Antiqa or the DPO at the contact details given in this notice. The Controller responds without undue delay and, as a rule, within one month of the request, save for the extensions permitted by the GDPR. The data subject also retains the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or to bring proceedings before the competent courts.

Antiqa may update this notice as a result of regulatory, organisational or technological changes or changes to the services offered. The updated version will be made available on the Platform.