Data controller
Next PAL Innovations
CVR 26762138
Salamanderparken 209
8260 Viby J
Denmark
For privacy and security matters: [email protected]
Categories of personal data
We process the following categories of personal data:
- Account and profile data: email address, display name, public handle, password hash, avatar, locale, timezone, currency, and content-language preferences.
- Authentication and security data: password hashes, encrypted TOTP secrets, hashed recovery codes, and hashed/revocable session credentials.
- Collection and content data: items, collections, descriptions, media, provenance, valuations, and related metadata you upload.
- Community data: posts, comments, messages, club memberships, event participation, and moderation status.
- Technical and log data: IP address, browser type, device type, session identifiers, and service logs used for security and troubleshooting.
- Communications: support requests and transactional emails such as verification and password-reset messages.
Purposes of processing
We process personal data to provide, secure, and improve the service, to authenticate users, to enable community and trading features, to respond to support requests, to comply with legal obligations, and to enforce our terms.
GDPR legal bases
Processing is based on performance of a contract, legitimate interests, consent where required, and legal obligations. For example, account data is necessary for the user contract, security logs are necessary for our legitimate interest in service security, and email consent is not required for transactional messages.
Private and public visibility
You control the visibility of your profile, collections, and content. Private content is visible only to you and those you explicitly authorise. Public content may be visible to other members. See the Account Security settings.
Security
Passwords are stored using one-way password hashing. Session credentials are protected using one-way token hashing and can be revoked. TOTP MFA secrets are encrypted at rest. Recovery codes are stored using one-way hashing. We use TLS in transit and apply access controls.
Processors and categories of recipients
We use processors for hosting, database services, and transactional email (Google Workspace / Gmail). We do not sell personal data. We only share data with recipients where necessary to operate the service or comply with legal obligations.
International transfers
Personal data may be processed in multiple jurisdictions. Transfers outside the European Economic Area use appropriate safeguards, including Standard Contractual Clauses where applicable.
Retention
We retain personal data for as long as necessary to provide the service, comply with legal obligations, resolve disputes, and enforce our terms. Some records may be retained for legal, tax, or security reasons after account deletion.
Data-subject rights
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object to, or port your personal data. You can request an export or deletion review from your Account page where available. We will respond in accordance with applicable law.
Children and minimum age
CollectLeague is intended for users who meet the applicable minimum age. We do not knowingly collect personal data from children under the minimum age.
Changes to this Policy
We may update this Privacy Policy from time to time. Members will be notified of material changes, and continued use after the effective date constitutes acceptance.
Complaints
If you are in the EU and believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with your local supervisory authority or the Danish Data Protection Agency (Datatilsynet).
Contact
For privacy and security questions, contact us at [email protected].