Privacy Policy
Last updated:
1. Who we are
LotCourier is operated by XPNNTL LTD, a private limited company registered in England and Wales under company number 17493975, with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom (“LotCourier”, “we”, “us” or “our”).
XPNNTL LTD is the controller of the personal data described in this policy. It is registered with the UK Information Commissioner’s Office (ICO) under registration number C2050711.
Privacy contact: privacy@lotcourier.com
Our representative in the European Union
Under Article 27 of the EU General Data Protection Regulation (“GDPR”), our representative in the European Union is:
Yegor Nyukhalov
Florastrasse 3, 40667 Meerbusch, Germany
yegor.nyukhalov@gmail.com
You may contact our representative instead of us about anything in this policy.
We have not appointed a data protection officer. Please send privacy questions and requests to privacy@lotcourier.com.
2. What this policy covers
This policy applies when you visit lotcourier.com, request a quote (on our website or through the form embedded on a partner platform’s website), place an order with us, send us a partner enquiry, or write to us.
3. Personal data we process
Visiting the website
When you open a page, our hosting provider processes the technical data needed to deliver it and keep the site secure: your IP address, the date and time, the page requested, the referring page, and your browser and device information (user agent). We do not use this data to identify you.
Quote requests
When you request a quote, we process what you enter in the form:
- the link to the lot;
- the service you need (inspection, pickup and shipping, or both) and the number of lots;
- the delivery country and postcode, or that you will collect from us in Cologne;
- your email address;
- whether you buy as a business or a private person (optional); and
- what you would like us to check (optional).
The form also sends, without you entering it: the partner reference and campaign parameters (utm_source, utm_medium, utm_campaign) of the link you came from, if any; the language and the page of the form; and the time the form was opened. Together with a hidden field that people do not see but automated programs often fill in, we use this time to filter out spam.
Our server checks the request, stores it in a spreadsheet, and sends two emails: a notification to us and a copy of your request to you. We then reply with your quote by email.
Orders
If you accept a quote, we collect by email the further data we need to carry out the order, in particular:
- your name and delivery address, or the details needed for collection from us;
- the documents needed to collect the lot, such as the signed pickup authorisation, the auction house’s invoice or proof of payment, and your bidder or invoice number;
- photos and videos we take of the lot at inspection, pickup and packing;
- tracking and delivery information for your parcels; and
- payment information: the amount, date and reference of your payment. You pay through a payment link we send you. The payment is processed by a payment service provider, which receives your payment details; we do not receive your full card or account details.
Partner enquiries
If you ask for a partner link for your auction platform, we process your work email address, your platform’s website, the language of the form and the time of the enquiry, and the content of any emails that follow.
Emails
If you write to us, we process your email address, your message and any details you include. Emails sent to our @lotcourier.com addresses are forwarded to our mailbox by our email routing provider.
Anonymous website analytics
We use PostHog in its EU Cloud to understand how the website is used. PostHog runs in cookieless mode: it stores nothing on your device, does not identify you and does not create profiles. We have switched off session recording.
To count unique visitors, PostHog’s servers calculate a one-way hash from your IP address, user agent and a random value (salt) that changes every day and is then deleted. The hash cannot be traced back to you and cannot recognise you on another day. Your IP address and user agent are used only to calculate the hash.
PostHog receives anonymous events: page views; clicks on links and buttons, without anything you type into forms; the submission of a quote or partner form with non-personal details (the service chosen, buyer type, number of lots, whether you will collect in Cologne, and the page); and technical errors in the website’s scripts. Analytics run only on lotcourier.com itself, and visits by automated browsers and known bots are not measured.
4. Where our data comes from
We receive personal data:
- from you, when you use our forms, accept a quote or write to us;
- automatically from your browser when you visit the website;
- from auction houses, for the details needed to collect your lot;
- from the parcel carrier, for tracking and delivery status; and
- from the payment service provider, for the confirmation of your payment.
5. Why we process data and our legal bases
Under the UK GDPR and the EU GDPR, we rely on these legal bases:
| Purpose | Main data | Legal basis |
|---|---|---|
| Prepare and send your quote | Quote form data, email address | Steps you request before entering into a contract (Art. 6(1)(b)) |
| Carry out your order: inspection, pickup, storage, packing, shipping or self-collection | Name, address, contact details, pickup documents, photos and videos, tracking data | Performance of our contract with you (Art. 6(1)(b)) |
| Take payment and keep accounting records | Payment details, order and invoice data | Performance of our contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Protect our forms against spam and keep the website secure | Form timing, hidden spam field, server log data | Our legitimate interests (Art. 6(1)(f)) |
| Understand which links and partner platforms bring requests, and pay partner commission | Partner reference, campaign parameters, language, page | Our legitimate interests (Art. 6(1)(f)) |
| Anonymous website analytics | IP address and user agent, used only to calculate the daily hash; anonymous events | Our legitimate interests (Art. 6(1)(f)) |
| Answer partner enquiries | Work email, platform website, messages | Our legitimate interests (Art. 6(1)(f)) |
| Answer your emails | Email address, message | Steps before or performance of a contract (Art. 6(1)(b)), otherwise our legitimate interests (Art. 6(1)(f)) |
| Establish, exercise or defend legal claims | Relevant order and email data | Our legitimate interests (Art. 6(1)(f)) |
| Comply with the law | Data required by a valid legal request | Legal obligation (Art. 6(1)(c)) |
Our legitimate interests are running a secure website free of spam, understanding how people find and use our service so that we can improve it, working with auction platforms, and answering the people who contact us.
You do not have to give us your data. Without the required form fields we cannot prepare a quote, and without your name, the pickup documents and a delivery address we cannot carry out an order.
6. Who receives data
We share data only as needed for the purposes above:
| Recipient | What they do and the data involved |
|---|---|
| Vercel Inc. | Hosts the website and runs the server that checks form submissions and sends emails. Processes request data such as IP address and browser information. |
| Google (Google Sheets and Google Apps Script) | Stores quote requests and partner enquiries in a spreadsheet. |
| Plus Five Five, Inc. (Resend) | Sends the emails triggered by the forms: the notification to us and the copy to you, including your email address and the content of your request. |
| Cloudflare, Inc. | Provides DNS for lotcourier.com and forwards emails sent to our @lotcourier.com addresses (Cloudflare Email Routing), including the sender, recipient and content of those emails. |
| PostHog, Inc. | Anonymous website analytics in its EU Cloud, as described in section 3. |
| Subcontractors and service partners | Carry out inspections and pickups on our behalf and receive the details needed for that, such as the lot, the pickup authorisation and the auction house’s pickup details. |
| Auction houses | Receive the pickup authorisation and the details they need to hand over your lot. They act under their own privacy policies. |
| Parcel carrier (such as DHL) | Receives your name and delivery address and the parcel details to deliver your parcels. It acts under its own privacy policy. |
| Payment service provider | Processes payments made through our payment link. The payment page names the provider and links to its privacy policy. |
| Partner platforms | If you came to us through a partner link, we report completed orders to that partner so we can pay its commission. The report shows the partner reference, the lot and the date, not your name or contact details. |
| Professional advisers and authorities | Only where reasonably necessary to obtain advice, protect rights, or comply with a valid legal requirement. |
We have data processing terms with our service providers where the law requires them. We do not sell personal data, and we do not share it for advertising.
7. International transfers
We are established in the United Kingdom. The European Commission has recognised the United Kingdom as providing adequate protection for personal data, so data can flow from the EU to us without further safeguards. The UK recognises the European Economic Area as adequate.
Some providers, including Vercel, Google, Resend, Cloudflare and PostHog, and their subprocessors, may process data in other countries, including the United States. Where the UK GDPR or the EU GDPR applies, we rely on an adequacy decision or the UK extension to the EU-US Data Privacy Framework where available, or on the EU Standard Contractual Clauses with the UK addendum, or the UK International Data Transfer Agreement.
Email privacy@lotcourier.com for information about the safeguard for a particular transfer.
8. How long we keep data
| Data | How long we keep it |
|---|---|
| Quote requests and related emails that do not lead to an order | 12 months after the request |
| Partner enquiries that do not lead to a partnership | 12 months after the last contact |
| Order and accounting records, including the quote, your acceptance, payment and invoice data | 6 years after the end of the financial year in which the order was completed |
| Pickup documents, photos and videos of your lot | With the order records |
| Server logs at our hosting provider | A short period under the provider’s log retention, at most 30 days |
| Analytics events | These events are anonymous: the daily salt is deleted, so they cannot be linked to you |
We may keep data longer where the law requires it or while it is needed for a legal claim.
9. Your rights
Under the UK GDPR and the EU GDPR, you have the right to:
- be informed about how we use your data;
- access your data and get a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use your data;
- receive data you gave us in a portable format; and
- complain to a data protection authority.
Right to object: where we process your data on the basis of our legitimate interests (Art. 6(1)(f)), you have the right to object at any time, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data for a legal claim.
To exercise your rights, email privacy@lotcourier.com from the address you used with us. We may ask for a little more information to confirm the request is yours. We reply within one month, as the law requires.
You can complain to the UK Information Commissioner’s Office (ico.org.uk). If you are in the EU, you can complain to the data protection authority in the country where you live or work, or where you think the problem happened. We would be grateful for the chance to resolve your concern first, but you do not have to contact us before complaining.
10. Cookies and storage
This website sets no cookies. It also stores nothing in your browser’s local storage or session storage, and our analytics work without them, as described in section 3. That is why we do not show a cookie banner.
We host the website’s fonts ourselves, so opening a page does not send requests to font providers.
11. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our spam filter automatically discards form submissions that look automated. If you think your request did not reach us, email hello@lotcourier.com.
12. Security
We protect personal data with measures suited to a small online service, including encrypted connections, access controls, a secret shared between our server and the spreadsheet, and limited access for the people who work on your order. No online service is completely secure, so please do not send us more information than we ask for.
13. Other websites
Our website links to auction houses and other websites, and partner platforms may embed our quote form on their own pages. Their privacy practices are governed by their own policies.
14. Changes to this policy
We may update this policy when our service, our providers or the law change. The current version and its date are always on lotcourier.com. If a change materially affects how we use your data, we will also tell customers with an open order by email.
15. Contact
XPNNTL LTD (trading as LotCourier)
128 City Road, London, EC1V 2NX, United Kingdom
Email: privacy@lotcourier.com