Last updated: 16 September 2026
1. Who we are
Aurora y Athena S.L., Calle de Aragón 208-210, 3º 6ª, 08011 Barcelona, Spain, is the data controller for the personal data described here. Contact: contact@auroraathena.com.
2. What data we process, and why
Visitors. Technical data (IP address, browser, pages viewed) for security and to understand how the site is used. Basis: our legitimate interest in running a safe, working website.
Enquiries and newsletter. The details you give us in a contact form or when subscribing (name, e-mail, message). Basis: your consent, which you can withdraw at any time.
Accounts and bidding. Name, e-mail, phone, address, country, your bids and purchases, your acceptance of our Conditions of Sale, and, while you are signed in, which lots of a catalogue you open. Basis: the contract between us (registering to bid, buying a work) and the steps you ask us to take before it; for the lots you open, our legitimate interest in seeing the interest a sale attracts and in writing to you about the works you looked at. If you win with us under a new e-mail address and your name and country match an account whose identity we have already verified, we link the purchase to that account and write to that account’s e-mail address, so you are not identified twice; you can ask us to separate them.
Identity and anti-money-laundering checks. As an auction house and art dealer we are an obliged subject under Spanish Law 10/2010 and Royal Decree 304/2014. For purchases of €1,000 or more, for every business relationship, and in the further cases the law sets out, we must identify our clients and keep the records. For that we process: a copy of your passport or national ID and the data it contains; a live photo or a recorded video session in which you show your document and your face; your declarations about political exposure and sanctions (telling us you are, or are close to, a politically exposed person does not stop a purchase; it means the additional checks the law requires); your occupation, the purpose of the purchase and the source of the funds; the name of the account holder who pays; and, where you buy for a company or for another person, the company’s registration papers and data, the identity of its owners of 25 % or more, the confirmations you give on our site that you act with authorisation and that the company or the person you buy for pays from their own account (we keep the wording, the date and the connection details of each confirmation), and the identity of the person you buy for. If our identification provider cannot verify an identity, we tell the person and they may try again; a final rejection is reviewed by our staff before anything else happens. We also check the people concerned against sanctions, politically-exposed-person and adverse-media lists. Basis: a legal obligation. Without these data we cannot complete the sale.
Reading documents with AI. To save you typing and to speed up our review, the company papers you upload may be read by an artificial-intelligence model (Anthropic’s Claude, through its programming interface), which lists the details they show and fills in the company form for you to check; the same model may draft the notes our staff write when they review a purchase file. The model only reads what you have uploaded and what you have told us; its output is a suggestion that a person checks, and no decision about you is taken by it. Basis: our legitimate interest in an accurate and fast check, alongside the legal obligation above.
Payments. Bank transfer details we see on our statements, and card payments processed by Stripe (we never see your full card number). Basis: the contract, and our legal obligations in tax and accounting.
Auction communications. E-mails and, if you opt in, text messages about sales you registered for, your bids and your purchases. Basis: the contract and, for reminders you opt into, your consent.
3. Who receives your data
We share data only with providers who work for us under a contract that binds them to protect it:
- Sumsub (Sum and Substance Ltd, UK/EU) — identity document checks, recorded video identification and list screening. Your document and face data are processed on their platform and a copy of the result is kept by us.
- Anthropic (Anthropic PBC, USA) — AI reading of uploaded company papers and drafting of our review notes. Data sent for this purpose is processed to answer our request and is not used to train the model.
- Stripe — card payments.
- Google Workspace — our e-mail.
- Cloudflare — website security and delivery.
- Twilio — text messages, if you opt in.
- Hostinger — hosting, servers in the European Union.
Where a provider processes data outside the European Economic Area, the transfer rests on the European Commission’s standard contractual clauses or an adequacy decision (the United Kingdom holds one; for the United States, the EU–US Data Privacy Framework where the provider is certified, otherwise the standard clauses).
We disclose data to public authorities only where the law requires it, including the Spanish financial intelligence unit (SEPBLAC) in the cases Law 10/2010 provides for.
4. How long we keep your data
- Identity and anti-money-laundering records: ten years from the end of our relationship, as Law 10/2010 requires. During that period we cannot delete them at your request.
- Invoices and accounting records: the periods set by tax and commercial law (generally six years).
- Account data: while your account exists, and up to twelve months after your last activity.
- Enquiries and newsletter data: until you withdraw consent or ask us to delete them.
- A passport copy given by someone who never buys: deleted twelve months after it was given.
5. How we protect your data
Identity documents and video recordings are stored encrypted, outside the public part of our website, and can be opened only by the staff who handle sales; every access is logged. We use HTTPS throughout, and access to our systems is limited to the people who need it.
6. Automated checks
Document checks and list screening are performed automatically by our provider, but no decision to refuse a client or a sale is taken without a person at Aurora & Athena reviewing the result. The same applies to what an AI model reads from your documents and to the linking of a purchase to an existing account by name and country: they prepare the work of our staff and never decide on their own. You can ask us to explain a result and to have it reviewed.
7. Your rights
You can ask to access, correct, delete or receive your data, to restrict or object to its processing, and to withdraw consent, by writing to contact@auroraathena.com. Deletion and objection do not apply to records we must keep under Law 10/2010 or tax law. You can complain to the Spanish Data Protection Agency (AEPD, www.aepd.es).
8. Cookies
Strictly necessary cookies keep you signed in and protect forms from abuse; analytics cookies help us understand how the site is used and are set only with your consent; embedded content from other sites (videos, maps) may set its own cookies under those sites’ policies.
9. Changes
We update this policy when our processing changes and show the date of the last change at the top.
Frequently Asked Questions
Selected works may also be viewed in our showroom by prior appointment.
For auction purchases, payment is due within 14 days of the auction. For gallery purchases and private sales, payment terms are agreed individually.
For auction purchases, where applicable, KYC documentation and payment must both be completed within 14 days of the auction.