Privacy policy

Junghard Software AB (org. nr 559217-6753), Jans väg 5, Göteborg, Sweden, runs cupsponsor and is the data controller for it. There are no accounts and no sign-up; this page lists everything the site handles about you and why. Questions go to magnus@junghard.com.

1. What we collect

When you place a bid

• Sponsor name, link and logo. Needed to run the auction and print the mug (performance of a contract, GDPR art. 6(1)(b)). These are public: they are shown on the site as the auction record, and the logo is printed and photographed if you win.
• Bid amount and status. Also public, for the same reason. The auction only works if everyone can see what the cup is held at.
• Email address, optional. Used for exactly two emails: that your hold is in place, and that you have been outbid and your hold is released. Nothing else, and no marketing. It is never shown publicly. Legal basis: performance of a contract.
• Payment. Your card details go straight from your browser to Stripe and never reach our server. We store Stripe's reference for the hold, so we can release or capture it. Stripe is an independent controller for the payment itself; see Stripe's privacy policy.

When you just look

• Live viewer count. Your browser sends a random session id every 45 seconds so the page can say how many people are watching. The id is generated in your browser, is not linked to anything else, and is deleted from our database within minutes of you leaving. Legal basis: legitimate interest in showing the live count.
• Analytics. We use a self-hosted instance of Plausible, which sets no cookies and stores no personal data. It counts page views and bids by hashing the visitor's IP address and user agent with a salt that changes daily, so visits cannot be tied to a person or followed across days.
• Server logs. Our web server keeps standard access logs (IP address, URL, time, user agent) for security and debugging, for at most 30 days. Legal basis: legitimate interest in keeping the site running and safe.

2. Cookies

The site itself sets none. The live viewer id is kept in your browser's session storage and goes when the tab closes. When you open the bid panel, Stripe's payment script loads and may set its own cookies for fraud prevention; those are necessary for taking a card and Stripe describes them in its own policy. Nothing loads before you open that panel.

3. Who else sees data

• Stripe (payments). Card data and the hold. Stripe Payments Europe Ltd, Ireland.
• Molted Mail (email delivery), also operated by Junghard Software AB, which in turn uses established email delivery providers to send the two transactional emails above.
• The print service that prints the winning mug receives the winning logo and nothing else.
• Our hosting provider, where the site and its database run, inside the EU.

We do not sell data, and we do not share it with anyone else unless the law requires it. Where a provider processes data outside the EEA, it does so under the European Commission's standard contractual clauses or an adequacy decision.

4. How long we keep it

• Bids, sponsor names, links and logos: for as long as the site is online, as its public record. Losing bidders' logos may be removed on request.
• Email addresses: deleted 30 days after the auction closes.
• Payment references: for as long as Swedish bookkeeping law requires (seven years) for captured payments; released holds are kept only as part of the bid record.
• Viewer session ids: minutes. Server logs: at most 30 days.

5. Your rights

Under the GDPR you can ask us for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interest, and ask for it in a portable format. Email magnus@junghard.com and we will answer within a month. If you are not happy with how we handle it, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your own country's supervisory authority.

6. Children

The service is for businesses. We do not knowingly collect data from anyone under 18.

7. Changes

If this policy changes, the date at the top moves and, if the change matters, we say so on the site. The terms of service cover the auction itself.