Cookies policy

This Cookies Policy (“Policy”) sets out the rules governing the use of cookies and similar technologies on the Artbidy.com Website. The Policy supplements the Website Privacy Policy.

Last updated: 2 November 2026

§1 Website Controller

The controller of the Artbidy.com Website and the controller of personal data processed through first-party cookies is BDB Investments Łukasz Kuca, ul. Nowomiejska 9, 96-100 Skierniewice, Poland, Tax Identification Number (NIP): 836-182-19-46 (“Controller” or “Artbidy”).
The Controller may be contacted:

a) by e-mail at: admin@artbidy.com or contact@artbidy.com,

b) by telephone at: +48 604 238 369,

c) by post at the address indicated in paragraph 1 above.

This Policy applies to the website available at https://artbidy.com, its language versions and all subpages and functionalities made available within the Website (“Website”).
Detailed information concerning the processing of personal data and the rights of data subjects is provided in the Privacy Policy available on the Website.

§2 Definition of cookies

Cookies are small files or pieces of information stored on the User’s device or read from that device while the User is using the Website.
The Website may also use technologies that operate in a manner similar to cookies, including in particular:

a) browser local storage – localStorage,

b) browser session storage – sessionStorage,

c) online identifiers,

d) web pixels and tags,

e) analytics scripts,

f) technologies used by embedded maps, media players, chat functionality and form security mechanisms.

All technologies referred to in paragraphs 1 and 2 above are collectively referred to in this Policy as “Cookies”.
Cookies may be:

a) session Cookies – deleted when a session ends, the browser is closed or after a short period of inactivity,

b) persistent Cookies – stored for a specified period or until they are deleted earlier by the User,

c) first-party Cookies – set directly within the Artbidy.com domain,

d) third-party Cookies – set or read by providers of external services used on the Website.

The following information may be processed through Cookies in particular:

a) session or browser identifier,

b) IP address,

c) date and time of the visit,

d) visited subpages and used functionalities,

e) source from which the User entered the Website,

f) information about the browser, operating system and device,

g) approximate location of the device,

h) selected language and currency,

i) information concerning the shopping cart, login status and followed content,

j) information concerning clicks, page scrolling and time spent on individual subpages – where the User has consented to analytics Cookies.

An IP address, online identifiers and information concerning the User’s activity may constitute personal data even if they do not directly contain the User’s name.

§3 Legal grounds for the use of Cookies

Strictly necessary Cookies may be used without the User’s separate consent where they are required to transmit a communication through a telecommunications network or to provide an electronic service expressly requested by the User.
The legal basis for the use of strictly necessary Cookies is Article 399(3) of the Polish Act of 12 July 2024 – Electronic Communications Law.
Where information obtained through strictly necessary Cookies constitutes personal data, the legal basis for its further processing shall, depending on the purpose, be:

a) Article 6(1)(b) of the GDPR – performance of a contract or taking steps prior to entering into a contract,

b) Article 6(1)(c) of the GDPR – compliance with a legal obligation imposed on the Controller,

c) Article 6(1)(f) of the GDPR – the Controller’s legitimate interests, consisting in particular in ensuring the security of the Website, preventing abuse and establishing, pursuing or defending legal claims.

Functional and analytics Cookies are activated only after obtaining the User’s freely given, specific, informed and unambiguous consent.
The legal basis for the use of optional Cookies is Article 399(1) and Article 400 of the Polish Electronic Communications Law and, where personal data is processed, Article 6(1)(a) and Article 7 of the GDPR.
Consent is not given by:

a) merely closing the Cookies notice,

b) scrolling the page,

c) continuing to use the Website,

d) the User’s inactivity,

e) settings selected by default.

Refusing consent to optional Cookies does not restrict access to the basic functionalities of the Website. However, certain additional features, such as chat, an interactive map or an embedded media player, may not be available.

§4 Strictly necessary Cookies

Strictly necessary Cookies ensure the security and proper operation of the Website and enable the User to use functionalities expressly requested by the User.
Strictly necessary Cookies may be used in particular for the following purposes:

a) protecting forms and requests against CSRF attacks,

b) maintaining the User’s session,

c) registration and login,

d) operating the shopping cart,

e) remembering the selected currency or language,

f) operating functionalities for following objects, artists, manufacturers and auctions,

g) operating forms, object submissions and valuation requests,

h) enabling purchases or participation in auctions,

i) remembering the User’s Cookies preferences,

j) protecting the Website and its forms against spam, automated submissions and other forms of abuse.

The following strictly necessary Cookies may be used on the Website:

Name or technology	Provider	Purpose	Duration
XSRF-TOKEN	Artbidy	Protecting forms and requests against CSRF attacks and ensuring the integrity of communications	2 hours; the duration may be renewed during an active session
artbidycom_session	Artbidy	Maintaining the session, login status and the state of Website functionalities	2 hours; the duration may be renewed during an active session
remember_web_*	Artbidy	Maintaining login status where the User selects the “Remember me” option	Up to 30 days or until the User logs out earlier
cartCount – localStorage	Artbidy	Displaying the number of objects in the shopping cart	Until the shopping cart is emptied, the value is overwritten or the Website data is deleted from the browser
is_show_modal – localStorage	Artbidy	Remembering that the newsletter pop-up has been closed so that it is not displayed again	Until the setting is changed or the Website data is deleted from the browser
artbidy_cookie_consent or an equivalent entry used by the consent management platform	Artbidy or the consent management platform provider	Remembering the User’s selection and demonstrating that consent was given or refused	6 months, unless the purposes or providers of Cookies change earlier
_GRECAPTCHA	Google reCAPTCHA	Protecting forms against spam, automated submissions and abuse; activated only in connection with the use of a protected form	Up to 6 months

Strictly necessary Cookies cannot be disabled through the consent management panel. The User may delete them through the browser settings; however, this may result in the User being logged out, the loss of the current session or shopping cart and the inability to use forms and other Website functionalities properly.

§5 Functional Cookies

Functional Cookies enable the User to use additional Website functionalities provided by third parties.
Functional Cookies are disabled by default and may be activated only after obtaining the User’s consent.
The following functional Cookies may be used on the Website:

Name or technology	Provider	Purpose	Duration
lc_cid, lc_cst and the widget’s local or session storage	LiveChat – TEXT S.A. or Text, Inc.	Activating chat, recognising a conversation session, securing access to the conversation and maintaining its continuity	Up to 2 years; session data may be stored for a shorter period
Google Maps Cookies and browser storage, including NID, SOCS or AEC	Google	Displaying an interactive map, remembering settings and ensuring the security of the service	Depending on the Cookie – from the duration of the session up to 24 months
YouTube player Cookies, including YSC, VISITOR_INFO1_LIVE, PREF or CONSENT	YouTube or Google	Displaying and playing video content and remembering player settings	Depending on the Cookie – from the duration of the session up to 24 months
Spotify player Cookies, including sp_landing or sp_t	Spotify	Displaying and playing podcasts and ensuring the operation of the player	Depending on the Cookie – from 1 day up to 12 months

Until the User gives consent, a message allowing the User to activate the relevant functionality may be displayed instead of a map, chat widget or media player.
Merely placing an ordinary link to an Artbidy profile on a social media platform does not activate that platform’s Cookies. However, after clicking the link, the User is redirected to an external website governed by the privacy and Cookies rules established by its controller.

§6 Analytics Cookies

Analytics Cookies help the Controller to:

a) measure Website traffic,

b) prepare statistics concerning the use of the Website,

c) understand how individual functionalities are used,

d) identify technical and usability problems,

e) improve the functionalities, appearance and content of the Website.

Analytics Cookies are disabled by default and may be activated only after obtaining the User’s consent.
The following analytics Cookies may be used on the Website:

Name or technology	Provider	Purpose	Duration
_ga, ga*	Google Analytics – Google Ireland Limited	Distinguishing Users and sessions and preparing aggregated statistics concerning the use of the Website	Up to 24 months, subject to shorter restrictions applied by the browser
_gid	Google Analytics – Google Ireland Limited	Distinguishing Users for the purpose of short-term statistics	24 hours
_gat, gat*	Google Analytics – Google Ireland Limited	Limiting the number of requests sent to the analytics service	Approximately 1 minute
_hjSessionUser_2969964	Hotjar or Contentsquare	Attributing subsequent visits to the Website to the same pseudonymous identifier	365 days
_hjSession_2969964	Hotjar or Contentsquare	Linking events and page views within a single session	30 minutes; the duration may be renewed during activity
_hjAbsoluteSessionInProgress, _hjFirstSeen, _hjIncludedInSessionSample_2969964, _hjTLDTest and other _hj* entries	Hotjar or Contentsquare	Determining the beginning of a session, selecting the analytics sample, verifying the correct operation of Cookies and analysing the manner in which the Website is used	From several seconds or the duration of the session up to 30 minutes; entries relating to surveys or feedback may operate for up to 365 days

Analytics data linked to identifiers is stored in accordance with the configuration of the relevant tool, as a rule for no longer than 14 months, after which it is deleted or aggregated.
As at the date of the last update of this Policy, the Website does not use separate advertising Cookies intended for cross-site profiling or remarketing.
If advertising Cookies are introduced, they will not be activated without the User’s prior consent. The consent management panel and this Policy will be updated accordingly.

§7 Third-party providers

In connection with the use of Cookies, recipients of data may include in particular:

a) Google Ireland Limited and other entities from the Google group – in connection with Google Analytics, Google Maps, YouTube and reCAPTCHA,

b) Hotjar Limited, Contentsquare S.A.S. or other relevant entities from the Contentsquare group – in connection with usability analysis and analysis of the manner in which the Website is used,

c) TEXT S.A. or Text, Inc. – in connection with the LiveChat service,

d) Spotify AB – in connection with embedded podcast players.

Depending on the type of service and the rules adopted by the relevant provider, third-party providers may act as processors processing data on the Controller’s behalf or as separate data controllers.
Information concerning the processing of data and the use of Cookies by the providers is available on the following websites:

a) Google – https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/cookies?hl=en,

b) Google Analytics – https://support.google.com/analytics/answer/11397207?hl=en,

c) Hotjar – https://www.hotjar.com/legal/policies/privacy/,

d) list of Hotjar Cookies – https://help.hotjar.com/hc/en-us/articles/6952777582999-Cookies-Set-by-the-Hotjar-Tracking-Code,

e) LiveChat – https://www.livechat.com/legal/privacy-policy/,

f) information concerning LiveChat Cookies – https://www.livechat.com/help/improving-your-cookie-banner-a-guide-for-livechat/,

g) Spotify – https://www.spotify.com/legal/privacy-policy/.

Third-party providers may process data outside the European Economic Area, in particular in the United States.
Any transfer of data outside the European Economic Area shall take place using the mechanisms provided for in Chapter V of the GDPR, in particular on the basis of a European Commission adequacy decision or standard contractual clauses together with any required supplementary safeguards.
The duration of Cookies specified in this Policy does not necessarily correspond to the period for which data is stored on the servers of the relevant provider.
If the User leaves the Website and proceeds to the website of a payment provider or another external service provider, that entity may use its own Cookies. Information concerning such Cookies is provided directly by the relevant service provider.

§8 Managing consent to Cookies

During the first visit to the Website, the User may:

a) accept all optional Cookies,

b) reject all optional Cookies,

c) separately select functional and analytics Cookies.

The “Accept all” and “Reject optional Cookies” options are available at the same level of the Cookies notice.
If the User does not make a selection, only strictly necessary Cookies will operate on the Website.
Consent to optional Cookies may be given separately for each category.
The User’s selection is stored for a period of 6 months. The Controller may request the User to make another selection earlier if the purposes of Cookies, their categories or their providers change materially.
The User may withdraw consent or change the selection at any time by using the permanent “Cookie settings” link available in the Website footer.
Withdrawal of consent does not affect the lawfulness of any processing carried out before consent was withdrawn.
Following the withdrawal of consent, the Website will cease to activate scripts belonging to the relevant optional categories.
Withdrawal of consent does not always result in the automatic deletion of Cookies previously stored on the User’s device. The User may delete such Cookies through the browser settings.
The User may also manage Cookies directly through the browser settings. Information concerning Cookies management is available in particular on the websites of browser providers:

a) Chrome – https://support.google.com/chrome/answer/95647?hl=en,

b) Firefox – https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox,

c) Safari – https://support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac,

d) Microsoft Edge – https://support.microsoft.com/en-us/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09.

Blocking or deleting strictly necessary Cookies may result in the User being logged out, the loss of the session, shopping cart or settings and the inability to use forms, purchases, auctions and other Website functionalities properly.

§9 User rights

To the extent that information collected through Cookies constitutes personal data, the User may have the following rights under the GDPR:

a) the right of access to personal data,

b) the right to rectification of personal data,

c) the right to erasure of personal data,

d) the right to restriction of processing,

e) the right to data portability,

f) the right to object to processing,

g) the right to withdraw consent at any time.

The scope of individual rights and the ability to exercise them depend on the legal basis and purpose of the processing.
Requests concerning personal data may be submitted to admin@artbidy.com.
The User has the right to lodge a complaint with the President of the Polish Personal Data Protection Office if the User believes that the processing of personal data infringes the applicable law.

§10 Amendments to the Cookies Policy

The Controller may amend this Policy for important reasons, including in particular:

a) amendments to the applicable law,

b) changes to the functionalities or operation of the Website,

c) the introduction of new categories of Cookies,

d) commencing or discontinuing the use of services provided by a particular provider,

e) changes to the manner in which personal data is processed.

The current version of the Policy is published on the English-language Cookies Policy page within the Website together with the date of its last update.
If an amendment concerns a new purpose, a new category of optional Cookies or a new provider for which consent is required, the Website will ask the User to make a new selection before activating such Cookies.
This Policy enters into force on the date of its publication on the Website.