Privacy notice
These notices explain under the GDPR how LuxCharity processes personal data on the website and in the app. They concern visitors, account holders, buyers, sellers, organisation contacts and people who contact us or report content. The data involved depends on the features actually used.
Information phase · Translations and operational release under reviewUpdated: September 20, 2026Who is responsible
The controller for LuxCharity is AI Finance Association Europe, Association for European Innovations in Finance, Friedrich Janik Gasse 3, 2345 Brunn am Gebirge, Austria, represented by Leszek Downarowicz, association register number 1153480125. You can contact us at aifae.org@gmail.com or +43 664 4446396. The authoritative association address is also provided in the legal notice.
You can send privacy requests directly to this email or postal address. The website and app have the same controller. Sellers, organisations and payment providers may be independently responsible for their own legal duties or contracts; this does not release LuxCharity from its obligations for its own processing.
Who these notices cover
These notices cover the public catalogue, enquiries, accounts and profiles, seller and organisation checks, messages, auctions, orders, affiliate participation and connected services. A data category is processed only when it arises in the relevant activity. Describing a technically available feature does not mean that payments, payouts or all external services are already available in production.
Professional contact details and information about representatives or members of a legal entity are also personal data. Information solely about a legal entity that does not relate to a person falls outside the GDPR. These notices are not blanket consent and do not replace any separate information required for new purposes.
Purposes and legal bases
We use data only for specific, necessary and transparent purposes. Article 6(1)(b) GDPR applies to performing a contract with you or taking steps before a contract at your request. For contacts at a company or association, necessary communication and authority checks rely on Article 6(1)(f) GDPR and the interest in reliable cooperation. A contract with the legal entity alone is not sufficient for point (b).
Processing required by law relies on Article 6(1)(c) GDPR. Optional analytics or other additional features requiring consent rely on Article 6(1)(a) GDPR. Security and abuse prevention rely on point (f), unless your rights override the specific interests identified. Necessary processing does not become consent-based merely because you accept terms or acknowledge privacy notices.
Health data, religious or political beliefs, trade union membership and other special categories under Article 9 GDPR are not necessary for an ordinary account. Please redact unnecessary sensitive information in supporting documents. If such data is nevertheless necessary, an additional exception under Article 9(2) GDPR must apply, for example for specific legal claims. Data about criminal convictions may be processed only under the conditions in Article 10 GDPR. We do not create sensitive profiles from the choice of a supported organisation.
The types of data involved
Technical data includes IP address, access time, requested page, browser and device, sign-in status and security events. Contact and account activities also involve email address, username, language, roles, messages and optional profile details. Passwords are processed for sign-in by the authentication service and are not stored as publicly readable profile content.
Depending on the role, we process proof of identity and authority, address, date of birth, business and registration details, organisation documents and proof of bank account. Listings and transactions involve images, item details, bids including confidential maximum bids, order references, delivery address, dispatch and receipt evidence, returns, reviews and payment and accounting status. Full card details and payment credentials entered on a payment page go directly to its provider.
Accessing the website
When pages are opened, hosting and delivery services process technical request data, particularly IP address, access time, requested address and browser information. The purposes are delivery, stability and abuse prevention. The legal basis is Article 6(1)(f) GDPR; our interest is operating the public pages securely.
Technical logs are needed for operation, security and investigating specific faults. Firebase states that its own hosting logs containing IP addresses are retained for a few months. This does not establish the same period for all LuxCharity data. Retention for a specific incident ends when the investigation or evidentiary purpose no longer applies, unless a legal obligation continues.
Public catalogue and profiles
Public catalogue lists and images are provided through Supabase. Its servers receive technical request data. Released listings and profile information are public, particularly usernames, images and information intended for publication. Private verification documents, private address details and confidential maximum bids are not part of public requests.
Providing the catalogue relies on Article 6(1)(f) GDPR and our interest in making the offering discoverable. Publishing your agreed listings and profile features relies on point (b); information about representatives of legal entities relies on point (f), and legally required trader information on point (c). A private profile setting cannot exclude mandatory trader information.
Catalogue data in the browser
The website keeps loaded catalogue data only in the memory of the open page. It does not create a new persistent catalogue copy in local browser storage. Ordinary technical caching by browsers and networks serves delivery of the requested page.
Local entries beginning with luxcharity.catalog. may remain from earlier versions. You can remove them in the cookie settings. This deletion affects only the relevant browser and deletes neither an app account nor data already transmitted to a server.
Contact form
We process name, email address, selected role, subject and message as required contact form information, together with language, optional telephone and organisation details, and technical security data. The purposes are routing and answering your enquiry and protecting against abuse. In the form, you confirm the terms and acknowledge these notices. This confirmation is not consent to advertising, AI processing or unrestricted disclosure.
Enquiries about your own contract or preparing one rely on Article 6(1)(b) GDPR. Other enquiries and communication with contacts rely on point (f) and the interest in providing an appropriate response; requests we are legally required to handle rely on point (c). We cannot reply without a reachable contact address. You can also contact us directly by email; exercising legal rights in particular does not require agreement to terms.
Recipients of enquiries
Form enquiries are stored in the operator system using Supabase and handled by responsible personnel. Necessary details are disclosed only to the technical service provider, authorised adviser or party you designate that is needed for the enquiry. Routine publication or disclosure to other sellers does not take place.
Legal and tax advisers receive data only for the specific advice or evidentiary purpose. Authorities receive data where a legal obligation or another valid legal basis exists. When email is delivered, the participating email services also process sender, recipient and message content.
AI assistance with enquiries
Additional processing of your enquiries by an external AI provider is not approved for the contact process described here. Acknowledging these notices or sending a message does not authorise transferring content to arbitrary AI services or using it to train third-party models.
Before such an extension, the provider, purpose, legal basis, data scope, retention and any transfers outside the EEA must be established and explained. Any required consent is obtained separately and voluntarily. Responsible people remain accountable for replies and decisions.
Account, sign-in and password changes
We use Supabase for account sign-in and managing email address, username, language, roles and session data. A requested confirmation or password reset involves your email address and a time-limited verification credential. If the Resend delivery service is configured, it receives the recipient address, language and content of the relevant account message, including the confirmation link.
Where available, you can choose Google or Apple sign-in. The chosen provider and Supabase process a provider identifier, verification credentials and shared profile information such as name and email address. Apple may provide a forwarding address instead of your actual address. Providers receive technical connection data; their own privacy notices also apply to their sign-in services.
LuxCharity processes the necessary account data for your requested sign-in and account operation under Article 6(1)(b) GDPR, and for abuse prevention under point (f). Using an external sign-in service is voluntary; the offered email sign-in remains an alternative. Choosing Google or Apple does not consent to additional analytics or advertising purposes.
The global username and published avatars, banners, descriptions and content may identify you. Public content may be read without an account and stored by search engines or third parties. Removing it from our service cannot always retrieve copies elsewhere. Closing an account does not cancel statutory retention obligations.
Seller profile and identity verification
The initial seller profile contains username, language, country of residence, dispatch location and optional images or descriptions. The separate identity check processes legal name, address, date of birth and necessary supporting documents. Any recorded gender does not authorise further profiling. Private addresses and identity documents are accessible only to authorised reviewers.
The checks support reliable seller identity, contract performance and abuse prevention under Article 6(1)(b) and (f) GDPR. Point (c) applies where specific statutory trader checks or tax obligations apply. We request only the evidence needed for those purposes. Unnecessary information should be redacted; bank passwords, PINs and transaction authentication codes are not such evidence.
For business sellers, company name, legal form, registered office, representatives and registration and tax details are added where necessary for verification, a listing or legal reporting. Mandatory information is provided in the listing; other optional profile fields follow your choices. Business verification is separate from applying as an organisation receiving donations.
Organisation applications and cooperation
We process the names and functions of contacts and representatives, contact and location details, project information, necessary registration documents, statutes and charitable status evidence, proof of bank account, memberships, confirmations and review decisions. Additional information may come from association, business or other relevant public registers.
Necessary processing of personal data about contacts and representatives relies on Article 6(1)(f) GDPR: we need to check authority, work with the organisation and reliably identify donation recipients. Point (b) applies only where the individual is themselves a contracting party or requests corresponding precontractual steps. Statutory evidence and reporting rely on point (c) where actually applicable. Optional marketing requires its own legal basis and, where necessary, consent.
Private documents remain restricted to authorised members and reviewers; complete bank details are reserved for finance roles. Private files have access controls. Approved profile fields and required legal information are public. The organisation must lawfully disclose other people’s data; our own duty to inform those individuals remains.
Messages and attachments
In the messenger and organisation chat, we process participating accounts, message text, attachments, timestamps and delivery or access status. Authorised participants see the relevant history; group access follows membership and roles. Public comments on a live auction are visible to the relevant audience.
Your requested communication relies on Article 6(1)(b) GDPR; communication by contacts of legal entities relies on point (f) and the interest in their cooperation. Support or reviewer access is limited to necessary specific cases and a permissible legal basis. Applicable communications confidentiality rules also govern confidential communications. Private messages are not public; end-to-end encryption is not promised. Recipients may keep their own copies.
Orders, Stripe and recipient accounts
Orders involve participating accounts, item, amount, currency, delivery details, receipt and return information, and payment status. Buyers and sellers receive the information necessary for their contracts; the relevant shipping services receive necessary delivery information. Organisations receive what is needed to allocate and document their amounts, rather than general access to buyers’ private account details.
Stripe is technically integrated for hosted payment pages and setting up recipient accounts. Starting these processes transmits, in particular, email address, account or order reference, item description, amount and currency. Information entered on Stripe pages goes directly to Stripe. LuxCharity receives, in particular, references, verification and payment status, and accounting data. The technical integration does not promise already approved payment or payout operations.
LuxCharity relies on Article 6(1)(b) GDPR for your requested process, point (c) for actually applicable accounting and retention duties, and point (f) for security and resolving payment errors. The explained basis under point (f) applies to contacts of legal entities. Depending on the activity, Stripe acts as a processor or an independent controller, for example for its own statutory checks. Further details are available at stripe.com/at/privacy and on the relevant payment page.
Technical services and other recipients
The website and app are delivered through Google Firebase Hosting. Supabase provides the database, authentication and file storage. Resend, operated by Plus Five Five, Inc., is technically provided for account email delivery where that route is configured. Firebase Cloud Messaging supports optional device notifications. These services receive the technical or content data needed for their tasks.
Service providers acting on our instructions require an agreement under Article 28 GDPR. Where providers pursue their own purposes, such as certain security or statutory payment checks, their obligations as controllers also apply. General provider documents alone do not establish a LuxCharity-selected storage region or an agreement concluded in the operator account. Further information is available at firebase.google.com/support/privacy, supabase.com/privacy and in Resend’s privacy notices.
Other recipient categories include authorised IT support, email services, legal and tax advisers, participating contracting parties and competent authorities where lawful disclosure or reporting duties apply. We restrict internal and external access to the relevant purpose. We identify specific recipients of your personal data within your right of access.
Transfers outside the EEA
International providers may also process data outside the European Economic Area, particularly in the United States. According to Google, Firebase Hosting and Cloud Messaging use global infrastructure; Supabase, Resend, Stripe and optional Google or Apple services may also involve international recipients. Exclusively European storage is not promised.
Such transfers require a basis under Chapter V GDPR, such as an adequacy decision under Article 45 applicable to the specific recipient, or appropriate safeguards under Article 46 including necessary supplementary measures. Merely accepting the terms or these notices does not replace those requirements. Information about the safeguards relevant to your processing and a copy are available at aifae.org@gmail.com. Account-specific contracting entities and safeguards may be described as confirmed only after the operator documents have been checked.
Retention and deletion
Accounts and necessary profile details are stored for the duration of use. Enquiries, messages, verification documents and drafts are needed while the relevant matter is handled or a continuing evidentiary purpose exists. For rejected or withdrawn applications, retention ends once necessary complaint handling or the defence of specific claims is completed. We do not keep full identity document copies indefinitely merely because of a general interest.
Where section 132 of the Austrian BAO applies, tax-relevant books, records and supporting documents must generally be kept for seven years from the end of the relevant calendar year. Pending proceedings or special legal obligations may require longer. This period applies only to the documents actually covered and does not justify blanket retention of all profiles, chats or identity documents.
When all lawful purposes cease, data is deleted or effectively anonymised. Data retained solely for a retention duty or a specific legal dispute may not be reused freely. Backups and provider systems may have delayed deletion cycles; restricted old data must not thereby return to ordinary use. Account closure and deletion requests are handled under these criteria.
Required and optional information
Information marked as required in a process is needed for its purpose: a reachable email address for an account and replies, proof of identity and authority for the relevant check, and delivery and payment information for a specific order. Without it, the relevant feature or approval cannot be completed. Legally required trader or tax information is identified as such.
Avatars, banners, descriptions, additional social addresses and analytics consent are not prerequisites for exercising legal rights. Consent to additional features remains voluntary and withdrawable. Refusing it must not prevent the ordinary service where the additional processing is unnecessary for that service.
Security of processing
Safeguards include encrypted transmission, role-based access, checks on private file access and limited download permissions. Measures must correspond to the relevant risk under Article 32 GDPR. Private supporting documents are not provided as public profile images.
Files may be checked, re-encoded or sanitised for security. Send only necessary content and no bank passwords, PINs or transaction authentication codes. No system can promise absolute security or retrieval of copies held by authorised message recipients.
Personal data breaches
If we become aware of a personal data breach, we assess its impact and take necessary protective measures. Where Article 33 GDPR requires notification, we notify the competent authority generally within 72 hours of awareness; any necessary delay must be explained.
Affected individuals are informed without undue delay under Article 34 GDPR where a high risk to their rights is likely and no statutory exception applies. The information describes the incident, significant consequences, safeguards and a reachable contact point.
Your rights under the GDPR
Subject to the statutory conditions, you have rights of access under Article 15 GDPR, rectification under Article 16, erasure under Article 17 and restriction under Article 18. Under Article 20, you may receive data you provided in a structured, commonly used and machine-readable format, or have it transferred where technically possible, if automated processing relies on your consent or a contract with you.
You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation. We then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims. You may object to direct marketing at any time without giving special reasons. You may withdraw consent at any time with effect for the future; the lawfulness of earlier processing is unaffected.
Send your request to aifae.org@gmail.com or our postal address. You need neither an open account nor acceptance of terms. We reply without undue delay and no later than one month. Any necessary extension by up to two further months is explained within the first month. Additional identity information is requested only where there are reasonable doubts and only to the necessary extent.
Any restriction of a right is specifically explained; an ongoing contract does not exclude privacy rights generally. Recipients are informed of rectification, erasure or restriction under Article 19 GDPR unless a statutory exception applies. The first data copy and exercising rights are generally free of charge; exceptions follow, in particular, Article 12(5) and Article 15(3) GDPR.
What access includes
Access covers your processed data, purposes, categories, recipients, retention periods or criteria, the origin of information from others and information about your rights. If automated decisions within Article 22 GDPR exist, meaningful information about the logic and significance and consequences is included.
We provide an intelligible copy while respecting other people’s rights. Confidential third-party information may need redaction; it does not justify blanket refusal of your own data. For transfers outside the EEA, we also explain the appropriate safeguards under Article 46 GDPR.
Complaints to a supervisory authority
Under Article 77 GDPR, you can complain to a data protection supervisory authority, particularly in the Member State of your habitual residence, workplace or the suspected infringement. For the operator in Austria, the Austrian Data Protection Authority is particularly relevant.
Contact: Austrian Data Protection Authority, Barichgasse 40 to 42, 1030 Vienna, email dsb@dsb.gv.at, website dsb.gv.at. Contacting LuxCharity first is not a prerequisite. Judicial remedies and any compensation claims remain unaffected.
Automated processes and human review
Technical checks support sign-in, required fields, access rights, bids and payment status. Proxy bids are executed within your chosen maximum under the auction rules. Executing your instruction and performing technical plausibility checks are distinct from exclusively automated evaluation of you as a person.
The described process does not use exclusively automated decisions under Article 22 GDPR about your personal reliability, identity approval or organisation certification. Responsible people review the corresponding refusals and complaints. If future processing falls within Article 22, its legal basis, logic and effects and the required opportunities for human review and challenge must be explained in advance.
Adult users
Personal accounts and use as a buyer, seller or authorised organisation representative are intended for people aged 18 or over. The website is not specifically directed at children. The contractual minimum age is separate from the rules about minors’ consent under data protection law.
If we learn that an account belongs to a minor who is not allowed to have that account, we assess whether to restrict or close the account. We delete personal data that is no longer necessary. We retain any evidence that the law requires us to keep. The individual’s rights remain protected. A request concerning this data does not require access to the account.
External links and YouTube
An ordinary link to a social network does not send data to its destination merely when our page is displayed. If you open the link, that external service’s privacy notices apply. Public social addresses are supplied by the relevant profile holders.
The app includes a YouTube component for rooms with a linked video. Loading it may send IP address, device data, page context, video identifier and playback data to Google; association with a signed-in Google account is possible. Google’s notices identify Google Ireland Limited as the entity responsible for processing data of EEA users. Further information is available at https://policies.google.com/privacy.
An embed involving unnecessary storage on or access to a device requires prior voluntary consent under section 165(3) TKG 2021 and Article 6(1)(a) GDPR. The existing technical video component does not replace these consent controls. Until this requirement is met for a room, the external embed there is not approved for production use. Merely entering an auction does not consent to YouTube processing.
Changes and language versions
The date of these notices appears above. We inform you in good time before processing for new purposes or material changes to recipients and processing. Any required new consent is obtained separately; changing a text does not replace it.
All offered language versions are intended to convey the same information. Translation differences restrict neither your GDPR rights nor mandatory transparency requirements. You can send privacy requests to the stated contacts regardless of the language selected.
Reports, evidence and complaints
Reports and complaints involve the content and its identifier, reasons, necessary contact details and evidence, review decisions and communications. Data may come from you, other reporting people, rights holders or authorities. We need it to assess infringements, protect affected people and handle decisions transparently.
Article 6(1)(c) GDPR applies where statutory duties, particularly under the Digital Services Act or product safety rules, apply. Otherwise, point (f) applies with our interest in a safe, lawful marketplace and handling specific claims. The other party receives necessary information for a response and decision, rather than routinely receiving the reporter’s identity. Special category and criminal data additionally fall under Articles 9 and 10 GDPR.
The case is retained for handling, any applicable complaint period and necessary statutory or specific evidentiary purposes. Data no longer needed is then deleted or anonymised. A report alone does not create a public accusation or definitive account suspension.
Referral links and account attribution
Voluntary affiliate participation involves link identifier, accepted visits, expiry time, a server-side hash of a random attribution credential and, where applicable, account, order and remuneration references. The dedicated click counter stores no IP address or device fingerprints; technical operational logs are separate. Linking an account makes the random identifier personal data.
The technical process provides for the first referral link with a period of 30 days. A browser-stored credential may be attributed once to a previously unattributed account at registration or sign-in. The account origin then remains stored; the remuneration window is not extended. The 30 days limit remuneration attribution and are not a general deletion period for server-side evidence.
Data necessary for the agreement with a participating affiliate relies on Article 6(1)(b) GDPR, or point (f) for contacts of legal entities. Storing an unnecessary referral credential on a visitor’s device and tracking based on it require that visitor’s prior voluntary consent under section 165(3) TKG 2021 and Article 6(1)(a) GDPR. The affiliate’s participation does not replace the visitor’s consent. Without configured consent controls, this tracking is not approved for production use.
Existing attribution and remuneration evidence remains necessary only where lawful accounting, limited prevention of duplicate remuneration or statutory retention requires it. After consent ends, separate legal bases and the general deletion criteria apply to that evidence. Withdrawal stops new consent-dependent tracking and extends no period.
Data received from others
In addition to your own information, we may receive data from a chosen sign-in service, payment providers, participating buyers and sellers, representing organisations, reporting people, authorities and public registers. This may concern contact and authority details, identity confirmations, transaction status or complaint content. Public availability alone does not allow unrestricted reuse for any purpose.
Where we do not collect data from you, we generally fulfil Article 14 GDPR within one month at the latest, or at an earlier first communication or disclosure. In particular, we explain the source and categories. Statutory exceptions, for example where you are already informed or expressly regulated confidentiality applies, are assessed individually. Informing an organisation does not automatically replace this obligation.
Optional device notifications
Where configured, you can allow device notifications. Firebase Cloud Messaging processes an installation identifier and delivery token; LuxCharity links the delivery token to your account, platform and registration status. The message type, necessary references and notification content are sent for delivery. Apple’s notification service may also participate on Apple devices.
Optional notifications rely on your voluntary consent under Article 6(1)(a) GDPR. You can disable them for the future in device or browser settings and ask us to remove an association. Permission to display messages does not allow additional advertising purposes. Any technical initialisation of the service must be assessed separately from consent to notifications.
Statutory seller reporting
Where LuxCharity is required to act as a reporting platform operator under the Austrian DPMG implementing DAC7, it processes the legally required identity, address, tax and residence information, along with remuneration, fees, transaction counts and, where applicable, payment account details. The purpose is meeting the applicable due diligence and reporting duty, based on Article 6(1)(c) GDPR.
Recipients are the legally competent tax authorities; statutory international exchange may follow. Affected sellers are informed about the information to be reported about them and their required cooperation. An ordinary enquiry or a buyer-only account does not trigger blanket seller reporting. This description does not claim an already active automated reporting service.
Google Analytics 4 — only with consent
With your voluntary consent under Article 6(1)(a) GDPR, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for statistical analysis of website use. Without consent, neither the Google tag is loaded nor analytics data sent to Google.
Page views, pseudonymous browser identifiers, and technical device and usage data are collected. Google also processes the IP address for transmission; according to Google, Google Analytics 4 does not store individual IP addresses. We do not transmit names, email addresses, account or payment details, URL query parameters or fragments, or a User-ID. Advertising features and Google Signals remain disabled; form contents are not collected.
The cookies _ga and _ga_<identifier> recognize the browser and associate sessions. Their lifetime is set to a maximum of 60 days and is not extended on every page view. A two-month retention period is planned for user and event data in the Analytics property; aggregated reports may remain longer. We store your consent choice locally as luxcharity.analytics.consent.v1 for a maximum of 180 days.
You may withdraw your consent at any time in the cookie settings with effect for the future. We then stop measurement and delete accessible Analytics cookies; this does not retroactively delete data already transmitted. Google may also process data outside the EEA, particularly in the United States. Google cites adequacy decisions and standard contractual clauses among the bases for this. Further information is available in Google’s privacy information; your data protection rights remain unaffected.
- Google: privacy and data transfers
Your analytics choice
When Analytics is configured, we store your decision locally under luxcharity.analytics.consent.v1 for a maximum of 180 days. This entry contains only your choice, the version and the timestamp. You can change your choice or withdraw consent in the cookie settings. Local catalog storage remains separate.
Contacts and legal remedies
- Reports and complaints
- aifae.org@gmail.com
- Data protection authority
- DSB
- Payment provider privacy notice
- Stripe