Privacy Policy

Data controller

IOAH — 116 Avenue Parmentier, 75011 Paris, France
RCS Paris 938 704 830

Email : dedicated address to be configured before public launch

Data we process

• Buyer enquiries: name, email, optional phone number, message, relevant listing, landing/referrer URL, idempotency key and anti-abuse signals.
• Dealer applications: gallery/company name, contact, email, phone, city, country, specialties, inventory size, and website, Instagram, presentation and VAT/company number when supplied.
• Accounts: identifiers required for authentication, session management and access rights.
• Dealer profiles: professional information supplied by the dealer or obtained from publicly available professional sources (trading name, website, professional social profiles, location, services and relevant professional contact information).
• Technical data: information required for security, site operation, image/map delivery and Core Web Vitals.

Sources of data

Data is either supplied directly by the person concerned or, for some unclaimed dealer profiles, obtained from the professional’s official website, public professional profiles, official registries or other publicly available professional sources.

Where personal data is collected indirectly, IOAH informs the person concerned as soon as possible and, unless a GDPR exception applies, no later than one month after collection. If the data is used to contact the person before that deadline, the information is provided no later than that first contact.

Purposes and legal bases

• Transmit a buyer enquiry to the relevant dealer: consent collected when the form is submitted.
• Review a dealer application and contact the applicant: consent collected when the application is submitted.
• Build and maintain a relevant professional directory, verify information and offer profile claiming: The Dealers’ legitimate interest in operating a specialist professional directory, subject to the rights and interests of the people concerned.
• Manage accounts, sessions and permissions: performance of the requested service and service security.
• Prevent spam, abuse, fraud and security incidents: legitimate interest in protecting the platform and its users.
• Measure technical site performance: legitimate interest in maintaining and improving the service, with no advertising purpose.

Required and optional fields

For a buyer enquiry, name, email, message and privacy/consent confirmation are required; phone is optional. Without the required data, the enquiry cannot be transmitted.

For a dealer application, fields marked as required in the form are needed to review the application; optional fields may be left blank.

Recipients and providers

• IOAH / The Dealers and authorised personnel.
• The relevant dealer receives the buyer’s contact details and message when an enquiry is sent to them.
• Supabase — database and authentication.
• Vercel — hosting and Speed Insights.
• Postmark (ActiveCampaign) — transactional email.
• Cloudinary — image hosting and delivery.
• MapTiler — maps on pages that display a map.

Transfers outside the EEA

Some providers are established or may process data outside the European Economic Area. Where required, transfers rely on an applicable adequacy decision and/or standard contractual clauses and appropriate data-processing agreements. Information about applicable safeguards can be requested through the privacy contact.

Retention

• Buyer enquiries: 24 months after the last interaction related to the enquiry, unless a legal obligation or valid request requires otherwise.
• Dealer applications: 24 months after the last interaction related to the application, unless a legal obligation or valid request requires otherwise.
• Accounts: for as long as needed to operate the account, then for periods required or justified by security and legal obligations.
• Directory information: while it remains relevant to the listed professional activity, with correction, restriction or removal where justified.
• Technical logs and telemetry: according to provider configuration and only for as long as necessary for security and performance.

Your rights

Depending on the processing involved, you may exercise rights of access, rectification, erasure, restriction, objection and portability, and withdraw consent for the future where consent is the legal basis.

For processing based on legitimate interests, including operation of the professional directory, you have a right to object. Each request is assessed in light of your situation and any applicable compelling legitimate grounds.

Email : dedicated address to be configured before public launch

You may also lodge a complaint with the French data protection authority (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

Cookies, trackers and browser-loaded services

Inventory matching the current code. No Google Analytics, Meta Pixel or advertising tracker is intentionally enabled at this stage.

If advertising, retargeting or another tracker requiring prior consent is added, it must be blocked until consent and this inventory must be updated before activation.

Security

The Dealers applies technical and organisational measures intended to restrict data access to people and services that need it, including access controls, authentication, role separation and database access restrictions.

Updates

This policy is updated when processing, providers or features change. The latest update date appears at the top of this page.