Privacy Policy

1. Data controller

BidAKey is operated by QWERTY KEY SRL, CUI 44393084, Str. Oituz no. 3A, Baia Mare, Maramureș, Romania. For privacy questions or requests, email contact@qwertykey.ro.

2. Data we handle

• brand name, email, website, description and contact details;
• selected key or strap, bid value and history, terms acceptance and review status;
• logo, selected strap colour, artwork file, filename and review result;
• Stripe payment identifiers and statuses, but not full card numbers;
• messages, operational records, IP address and technical security logs.

An approved bidder's name, website, description, logo and strap colour may be shown publicly on the claimed spot.

3. Why we use data

We use data to verify email and artwork, administer bids, process and refund payments, communicate results, produce the limited edition, issue invoices, prevent fraud, secure the service and comply with legal obligations.

Our legal bases are pre-contractual steps, contract performance, legal obligations, legitimate interests in operating and protecting the service, and consent where required.

4. Providers and transfers

We do not sell personal data. We may share only what is necessary with providers for hosting and databases, storage, email, security, payments and invoicing, and with advisers or authorities where legally required. Stripe handles card details under its own notice.

Some providers may process data outside the European Economic Area. Where needed, we rely on adequacy decisions or approved contractual safeguards.

5. Local storage and cookies

The site stores only the language preference locally. Logo previews remain in page memory and disappear on reload. After submission, artwork is stored privately for review. We do not currently use advertising or behavioural analytics cookies; if added later, we will update this notice and any required consent mechanism before activation.

6. Retention

Verification challenges expire quickly. Unsuccessful bid records and files may be retained for up to 12 months for administration, security and disputes, then deleted or anonymised unless a longer duty applies. Transaction records, invoices and winning-bid data are retained for statutory periods and as needed for production and legal claims.

7. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction, portability or objection, and may withdraw consent. Email contact@qwertykey.ro. You may complain to Romania's data-protection authority.

8. Security and changes

We apply reasonable technical and organisational safeguards, but no online service is risk-free. The service is intended for people aged 18 or over. We may update this policy when the service or law changes; the date above identifies the current version.