Privacy notice

Under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). Last updated: 9 November 2026

1. Data controller

PUNTO LUCE S.R.L.S., VAT no. 04240850927, registered office in Via Calamattia 21, 09134 Cagliari (CA), Italy. Contacts: info@careauctions.co, PEC puntoluce.srls@pec.it.

2. Data we process

• Browsing data: IP address, device, pages visited, date and time.
• Registration and account data: name, email, encrypted password, preferred language.
• Contact and request data: messages sent to the chat, emails, content of the request.
• Purchase data: chosen plan, amount, payment status, transaction identifier (full card details are processed by the payment provider, not by us).
• Consultancy data: information about the lot and the user's situation, to the extent necessary for the service.

3. Purposes and legal bases

• Providing the service and managing the account — performance of a contract (Art. 6(1)(b)).
• Managing payments, invoices and tax obligations — legal obligation (Art. 6(1)(c)).
• Responding to requests and providing support — performance of a contract and legitimate interest (Art. 6(1)(b) and 6(1)(f)).
• Security, abuse and fraud prevention — legitimate interest (Art. 6(1)(f)).
• Marketing communications — consent (Art. 6(1)(a)), withdrawable at any time.
• Aggregate statistics — legitimate interest, using aggregated or anonymised data.

4. Provision of data

Data required for the contract is mandatory: without it we cannot provide the service. Marketing data is optional and its absence does not affect the service.

5. Recipients

Data may be disclosed to: payment providers (PayPal, Stripe), hosting and infrastructure providers, email providers, tax and legal advisers, and competent authorities where required by law. Providers processing data on our behalf are appointed as processors under Art. 28 GDPR.

6. Transfers outside the EU

Some providers may process data outside the European Union. In such cases the transfer is based on adequacy decisions or on standard contractual clauses approved by the European Commission.

7. Retention

Account data: for the duration of the relationship and up to 24 months after the last activity. Tax and accounting data: 10 years, as required by law. Marketing data: until consent is withdrawn. Security logs: up to 12 months.

8. Your rights

You may at any time request: access to your data, rectification, erasure, restriction of processing, portability, objection to processing, and withdrawal of consent. Write to info@careauctions.co: we reply within one month.

9. Complaints

If you believe the processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of your country of residence.

10. Cookies

For cookies and similar technologies see the cookie policy.