Privacy Policy
Last updated: 10 July 2026
This English translation is provided for convenience only. The Spanish version is the legally binding text.
At SubastasActivas we take your privacy seriously. Here we explain, in clear terms, what data we process, for what purposes, on what legal basis, how long we keep it and what rights you have. We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and the data protection regulations applicable in the EU.
1. Data controller
- Controller: DK Partner EOOD (a single-member company incorporated in Bulgaria).
- Company identification number (EIK): 207413740
- Contact email: [email protected]
- Website: https://subastasactivas.com
The controller is established in the European Union (Bulgaria), so the processing is carried out under the protection of the GDPR. We are not required to appoint a Data Protection Officer (DPO) given the nature of our activity, but you can direct any privacy question to the email address above.
2. What data we process
We process only the data necessary to provide you with the service:
| Category | Data |
|---|---|
| Account data | Name and email address. |
| Authentication data | Credentials and technical login information (email-based sign-in). |
| Alert preferences | The auctions and criteria you choose to follow. |
| Usage and analytics data | Information about how you use the site (pages viewed, interactions), in aggregated or pseudonymised form. |
| Payment data | If you purchase a paid plan, the transaction data. Payment is handled by Whop, an external provider; we do not store your full card details. See sections 6 and 7. |
| Cookies | See our Cookie Policy. |
Approximate location: in order to show you the auctions in your area by default, the home page may transiently estimate your approximate province from your connection (IP address). This data is used only at the moment of the query to order the content: it is not stored, not associated with your account and not shared with third parties. Your precise location (browser GPS) is only used if you expressly request it via the «Cerca de ti» ("Near you") option, and it is not stored either.
We do not request or process special categories of data (health, ideology, etc.). The Service is aimed at people over 18 years of age.
3. What we use your data for and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account and providing you with the Service. | Performance of the contract (Art. 6(1)(b)). |
| Sending you the auction alerts and notifications you configure. | Performance of the contract (Art. 6(1)(b)). |
| Managing the billing of paid subscriptions. | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)). |
| Handling your enquiries and providing support. | Performance of the contract / legitimate interest (Art. 6(1)(f)). |
| Maintaining security and preventing fraud. | Legitimate interest (Art. 6(1)(f)). |
| Analytics to improve the Service. | Consent (cookies) or legitimate interest, depending on the case. |
| Sending you commercial communications or a newsletter, if you subscribe. | Consent (Art. 6(1)(a)), revocable at any time. |
| Complying with legal obligations (tax, accounting). | Legal obligation (Art. 6(1)(c)). |
4. How long we keep your data
- Account data and preferences: for as long as you keep your account active. If you cancel it, we delete or anonymise the data, unless we must retain it due to legal obligations.
- Billing data: for the periods required by the applicable tax and commercial regulations.
- Support and enquiry data: for the time necessary to handle them and a reasonable period thereafter.
- Data for commercial communications: until you withdraw your consent.
5. Where your data is hosted
Your data is hosted on servers located in the European Union:
- Hetzner (hosting infrastructure, Germany – EU).
- Neon (PostgreSQL database, EU).
Being in the EU, your data remains under the protection of the GDPR without the need for international transfers for the main hosting.
6. Who we share your data with (data processors)
We do not sell or transfer your personal data to third parties for commercial purposes. We only use providers that help us deliver the Service, which act as data processors and are contractually obliged to protect your data in accordance with the GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner | Hosting / infrastructure. | Germany (EU). |
| Neon | Database. | EU. |
| Whop | Payment processing and subscription management. | United States (see section 7). |
7. International transfers
The main hosting of your data is in the EU. However, our payment and subscription provider, Whop, is established in the United States, so the processing of the data necessary to process your payment may involve an international transfer outside the European Economic Area (EEA).
These transfers are carried out with the appropriate safeguards provided for by the GDPR (Chapter V), such as the Standard Contractual Clauses approved by the European Commission and/or, where applicable, the provider's adherence to an applicable adequacy framework (for example, the EU–US Data Privacy Framework). These safeguards are intended to ensure that your data enjoys a level of protection equivalent to that of the EEA.
8. Your rights
You have the right to:
- Access: know what data of yours we process.
- Rectification: correct inaccurate data.
- Erasure ("right to be forgotten"): ask us to delete your data.
- Objection: object to certain processing operations.
- Restriction: ask us to restrict processing in certain cases.
- Portability: receive your data in a structured, commonly used format, or have us transmit it to another controller.
- Withdraw your consent at any time, without this affecting the lawfulness of the prior processing.
How to exercise them: write to us at [email protected] indicating the right you wish to exercise. We may ask you to verify your identity. We will respond within the legal deadline (one month, extendable in complex cases).
Complaint to the supervisory authority: as the controller is established in Bulgaria, the lead supervisory authority is Bulgaria's Commission for Personal Data Protection (CPDP / Комисия за защита на личните данни – КЗЛД) — www.cpdp.bg. However, if you reside in another EU country, you may also lodge your complaint with the data protection authority of your place of residence (in Spain, the Agencia Española de Protección de Datos (Spanish Data Protection Agency), www.aepd.es).
9. Security
We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration (access control, encryption in transit, backups, etc.). In the event of a security breach affecting your data, we will act in accordance with the GDPR, notifying the competent supervisory authority and, where appropriate, the affected individuals.
10. Changes to this policy
We may update this Privacy Policy to adapt it to legal changes or changes to the Service. The version in force will always be the one published on this page, with its date. If the changes are significant, we will notify you.