This Privacy Policy explains how Harchives ("we", "us", "our") collects, uses, and protects your personal data when you use harchives.com (the "Site"). Please read it carefully.

1. Who We Are

The Data Controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) is:

Francesco Spatola
Resident in: Arezzo (AR), Italy
Contact Email: harchives.group@gmail.com

2. What Data We Collect

We collect the following categories of personal data:

• Account data: first name, last name, email address, and a securely hashed password
• Artist account data (if applicable): Instagram handle and portfolio photos you upload
• Activity data: votes cast on events, bids placed on auctions, Club Membership status
• Technical data: IP address, device/browser details, and a session cookie used to keep you logged in (see Section 6)

We do not directly store payment card data. Payments, if any, are processed securely through third-party payment providers.

3. Why We Collect It (Legal Basis)

• To create and manage your account (performance of a contract - Art. 6(1)(b) GDPR)
• To operate voting, auctions, and Club Membership features (performance of a contract - Art. 6(1)(b) GDPR)
• To maintain Site security, prevent fraud, and improve performance (legitimate interest - Art. 6(1)(f) GDPR)
• To comply with tax, legal, and accounting obligations (legal obligation - Art. 6(1)(c) GDPR)

4. Who We Share Data With

We do not sell your personal data. We only share data with trusted third-party service providers (Data Processors) essential for operating the Site, such as hosting providers, cloud databases, and email infrastructure providers. If any of these providers process data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

5. How Long We Keep Your Data

We retain your account data for as long as your account remains active. If you request account deletion, we will delete or anonymize your personal data within 30 days, except where we are required to retain certain transaction records by law (e.g., accounting or legal compliance).

6. Cookies

The Site uses strictly necessary session cookies to maintain your login status and secure your browsing experience. Under the GDPR and ePrivacy Directive, essential technical cookies do not require prior user consent. We do not currently use third-party analytics, tracking, or advertising cookies.

7. Your Rights Under GDPR

As a user located in the EU/EEA, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) and data portability (Art. 20 GDPR)
• Right to rectification (Art. 16 GDPR) of inaccurate data
• Right to erasure / "right to be forgotten" (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR) and to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority (in Italy: Garante per la protezione dei dati personali - garanteprivacy.it)

To exercise any of these rights, please contact us at harchives.group@gmail.com.

8. Data Security

Passwords are stored using industry-standard hashing (bcrypt) and are never stored in plain text. We implement appropriate technical and organizational measures to protect your personal data, though no internet transmission is 100% secure.

9. Children's Privacy

The Site is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors.

10. Changes to This Policy

We may update this Privacy Policy periodically. Any updates will be reflected by updating the "Last updated" date above.