Política de privacidad

Last updated: 15 September 2026

1. Who we are

Aurora y Athena S.L., Calle de Aragón 208-210, 3º 6ª, 08011 Barcelona, Spain, is the data controller for the personal data described here. Contact: contact@auroraathena.com.

2. What data we process, and why

Visitors. Technical data (IP address, browser, pages viewed) for security and to understand how the site is used. Basis: our legitimate interest in running a safe, working website.

Enquiries and newsletter. The details you give us in a contact form or when subscribing (name, e-mail, message). Basis: your consent, which you can withdraw at any time.

Accounts and bidding. Name, e-mail, phone, address, country, your bids and purchases, and your acceptance of our Conditions of Sale. Basis: the contract between us (registering to bid, buying a work) and the steps you ask us to take before it.

Identity and anti-money-laundering checks. As an auction house and art dealer we are an obliged subject under Spanish Law 10/2010 and Royal Decree 304/2014. For purchases of €1,000 or more, for every business relationship, and in the further cases the law sets out, we must identify our clients and keep the records. For that we process: a copy of your passport or national ID and the data it contains; a live photo or a recorded video session in which you show your document and your face; your declarations about political exposure and sanctions; your occupation, the purpose of the purchase and the source of the funds; the name of the account holder who pays; and, where you buy for a company or for another person, the company’s registration data, the identity of its owners of 25 % or more, the authorisation you act under and the identity of the person you buy for. We also check the people concerned against sanctions, politically-exposed-person and adverse-media lists. Basis: a legal obligation. Without these data we cannot complete the sale.

Payments. Bank transfer details we see on our statements, and card payments processed by Stripe (we never see your full card number). Basis: the contract, and our legal obligations in tax and accounting.

Auction communications. E-mails and, if you opt in, text messages about sales you registered for, your bids and your purchases. Basis: the contract and, for reminders you opt into, your consent.

3. Who receives your data

We share data only with providers who work for us under a contract that binds them to protect it:

• Sumsub (Sum and Substance Ltd, UK/EU) — identity document checks, recorded video identification and list screening. Your document and face data are processed on their platform and a copy of the result is kept by us.
• Stripe — card payments.
• Google Workspace — our e-mail.
• Cloudflare — website security and delivery.
• Twilio — text messages, if you opt in.
• Hostinger — hosting, servers in the European Union.

Where a provider processes data outside the European Economic Area, the transfer rests on the European Commission’s standard contractual clauses or an adequacy decision (the United Kingdom holds one).

We disclose data to public authorities only where the law requires it, including the Spanish financial intelligence unit (SEPBLAC) in the cases Law 10/2010 provides for.

4. How long we keep your data

• Identity and anti-money-laundering records: ten years from the end of our relationship, as Law 10/2010 requires. During that period we cannot delete them at your request.
• Invoices and accounting records: the periods set by tax and commercial law (generally six years).
• Account data: while your account exists, and up to twelve months after your last activity.
• Enquiries and newsletter data: until you withdraw consent or ask us to delete them.
• A passport copy given by someone who never buys: deleted twelve months after it was given.

5. How we protect your data

Identity documents and video recordings are stored encrypted, outside the public part of our website, and can be opened only by the staff who handle sales; every access is logged. We use HTTPS throughout, and access to our systems is limited to the people who need it.

6. Automated checks

Document checks and list screening are performed automatically by our provider, but no decision to refuse a client or a sale is taken without a person at Aurora & Athena reviewing the result. You can ask us to explain a result and to have it reviewed.

7. Your rights

You can ask to access, correct, delete or receive your data, to restrict or object to its processing, and to withdraw consent, by writing to contact@auroraathena.com. Deletion and objection do not apply to records we must keep under Law 10/2010 or tax law. You can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).

8. Cookies

Strictly necessary cookies keep you signed in and protect forms from abuse; analytics cookies help us understand how the site is used and are set only with your consent; embedded content from other sites (videos, maps) may set its own cookies under those sites’ policies.

9. Changes

We update this policy when our processing changes and show the date of the last change at the top.