Privacy notice
Effective 30 September 2026. This notice covers the Big Sale Live auction website.
Who is responsible
SIA Damija, 40203487197, Ģerāniju iela 11, Rīga, LV-1067, Latvia, is the controller of auction customer data. info@damija-sia.com · +371 25706123.
What we process and why
- Account and order fulfilment (GDPR Article 6(1)(b)): account ID, email, full name, buyer number, delivery address or parcel locker/store choice, optional phone, bids, purchases, delivery status and service emails. We use these to identify you, administer the auction, deliver purchases and answer order enquiries. Email and full name plus a delivery or collection choice are required to complete registration; phone is optional. Without the required details we cannot fulfil an order.
- Accounting and tax duties (Article 6(1)(c)): invoice, payment and transaction records required by Latvian law.
- Security and disputes (Article 6(1)(f)): technical request information, authentication and auction activity records help prevent fraud, enforce auction rules and establish or defend claims. Our legitimate interests are a secure, fair auction and protection of our rights. You may object to processing based on these interests.
- Optional visitor counting and external video (Article 6(1)(a)): these run with your permission. You can refuse or withdraw permission through Cookie settings without losing access to bidding or orders. Auction registration does not subscribe you to marketing.
Sign-in, recipients and external services
Sign-in takes place on big-sale.lv. Its account service passes your account ID, verified email, name and phone, if present, to the auction. Apple or Google is contacted only when you choose that sign-in method; we do not receive your social-account password. The central Big Sale account has its own privacy notice. Big Sale.
Authorised staff and service providers receive only the data needed for their work: hosting and IT support, Big Sale account and email services, Microsoft 365 for email, accounting advisers and the selected delivery provider (for example DPD or Unisend). Authorities may receive records where the law requires it. Other visitors see auction prices and outcomes, not your private contact details. We do not sell customer data.
External sign-in and video providers may process data outside the EEA under their own notices. Where we transfer personal data outside the EEA, the transfer must be covered by an applicable adequacy decision or appropriate safeguards, such as EU standard contractual clauses. Contact us for information about the safeguards relevant to your data and a copy where applicable.
Apple · Google · Microsoft · TikTok
How long data is kept
Account details are kept while needed to provide your account and fulfil outstanding orders. You can request account closure at the contact above. Closure does not erase records we must retain for accounting or unresolved claims. There is no blanket statutory retention period for every customer profile.
Under Section 28 of Latvia’s Accounting Law, invoices and other ordinary source documents are retained for at least five years and longer when needed for transaction traceability; accounting registers and inventory lists are retained for ten years. Relevant evidence may also be retained while a dispute or legal duty remains. These duties do not justify retaining unrelated profile data indefinitely. Grāmatvedības likums, 28. pants.
Visitor-count records expire from the live count after 75 seconds without activity and are scheduled for deletion once older than five minutes. Browser-storage lifetimes are listed below. Operational security records are kept only while needed to investigate incidents, prevent abuse or resolve related claims; you can ask us about records relating to you.
Your rights
You may request access, correction, erasure, restriction or portability where the GDPR conditions apply. You may object to legitimate-interest processing and withdraw consent at any time; withdrawal does not affect earlier lawful processing. Email info@damija-sia.com. We may need proportionate identity verification and normally respond within one month. If a lawful extension is needed, we will explain it within that month.
You may complain to Latvia’s Data State Inspectorate or the supervisory authority where you live or work. Auction timers and bid validation use automated rules; staff confirm awards and can review account restrictions. Contact us to dispute an outcome or request a human review. Datu valsts inspekcija, pasts@dvi.gov.lv.
Cookies and browser storage
- bigsale_live
- Essential sign-in cookie; 30 days, renewed with use. Sign out to remove it. For the test customer, this protected cookie also holds the test profile.
- __Host-bigsale_sso
- Essential sign-in security state; up to 10 minutes, removed on callback.
- .AspNetCore.Mvc.CookieTempDataProvider
- Essential temporary order-action feedback, cleared when read; browser session.
- .AspNetCore.Antiforgery.*
- Essential protection against forged form requests; browser session.
- live_language
- Remembers the language you choose; up to one year.
- live_cookie_choice
- Essential record of your cookie choice; 180 days. Change it in Cookie settings.
- __Host-bigsale-live-visitor
- Optional visitor counting, only after permission; browser session. A random browser ID distinguishes tabs from separate visitors. The live count records session, last activity and whether the visitor is signed in, without storing their name, email or IP in the presence table.
- live-video-consent / live-tiktok-consent
- Session storage remembers that you chose to play external video in this tab. Reset through Cookie settings or close the tab. The video provider may use additional storage under its own privacy notice.
- live-rules-* / live-wins:*
- Local browser storage remembers the auction instructions you acknowledged and which win notifications have been shown (up to 200 per buyer). It avoids repeating messages; it is not advertising tracking. It remains until cleared in your browser settings.
Cookies used on the separate big-sale.lv sign-in site are described in that site’s privacy and cookie notices.