1. Information We Collect

We collect information that you provide directly, information collected automatically when you use the Site, and information we receive from third parties.

1.1 Information You Provide to Us

• Account information: name, email address, phone number, password, billing and shipping address.
• Identity verification (KYC) information: government-issued ID, date of birth, proof of address, and other documentation required to verify your identity and eligibility to bid.
• Bidding & purchase information: bid history, auctions you participate in, items won, invoices, and communications related to a transaction.
• Payment information: billing details and payment method information (processed through our payment processor — see Section 7).
• Communications: messages you send us via contact forms, email, phone, or live chat, including any attachments.

1.2 Information Collected Automatically

• IP address, browser type, device identifiers, operating system.
• Pages visited, time spent on pages, referring/exit URLs, click activity.
• Approximate location derived from IP address.
• Cookie and pixel data (see Section 5).

1.3 Information from Third Parties

• Identity verification providers used to confirm the information you submit during KYC.
• Advertising partners (e.g., Meta, TikTok, Google) that share aggregated or pseudonymized campaign performance data with us.
• Publicly available sources, where applicable, for fraud prevention purposes.

2. How We Collect Information

We collect the information described above through:

• Direct interactions — when you create an account, register for bidding, complete KYC, place a bid, or contact us.
• Automated technologies — cookies, pixels, and similar tracking technologies deployed on the Site (see Section 5).
• Third-party sources — identity verification vendors, advertising platforms, and analytics providers.

3. How We Use Your Information

We use the information we collect for the following purposes:

4. KYC, Identity Verification & Bidder Eligibility

Because TwoTraderAuctions facilitates the sale of bank-repossessed and institutional vehicles, watercraft, and equipment, we require certain users to complete a Know Your Customer (KYC) registration process before they are permitted to bid. This may include submission of a government-issued photo ID, proof of address, and other documentation reasonably necessary to confirm your identity and bidding eligibility.

KYC documentation is stored securely, access is restricted to authorized personnel, and this information is never used for marketing purposes. We retain KYC records for the period required to comply with applicable legal and recordkeeping obligations (see Section 8).

5. Cookies, Pixels & Tracking Technologies

We use cookies and similar tracking technologies to operate the Site and to support our advertising efforts. Specifically, we use:

You can control cookies through your browser settings. Disabling cookies may limit certain features of the Site, such as remaining logged in or placing bids. Where required by law, we will present a cookie consent banner allowing you to accept or reject non-essential cookies before they are set.

6. How We Share Your Information

We do not sell your personal information for monetary consideration. We may share information in the following circumstances:

• Service providers: identity verification vendors, payment processors, hosting providers, email/SMS providers, and analytics/advertising platforms (Google, Meta, TikTok) who process data on our behalf.
• Legal & safety: when required to comply with a legal obligation, court order, or governmental request, or to protect the rights, property, or safety of TwoTraderAuctions, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of all or a portion of our assets, in which case personal information may be transferred as part of that transaction.
• With your consent: in any other case where you have given us explicit permission to share your information.

7. Payments & Financial Information

Payment card and bank information you submit to complete a purchase is processed by our third-party payment processor. TwoTraderAuctions does not store full payment card numbers on our own servers. Our payment processor's use of your information is governed by its own privacy policy, and we encourage you to review it.

8. Data Retention

We retain personal information for as long as necessary to fulfill the purposes outlined in this Policy, including:

• For as long as your account remains active, plus a reasonable period thereafter;
• As required to comply with legal, tax, accounting, or KYC/anti-fraud recordkeeping obligations;
• As needed to resolve disputes and enforce our agreements.

When information is no longer needed for these purposes, we will securely delete or anonymize it.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS/TLS), restricted internal access to KYC and payment-related data, and regular security reviews.

10. Your Privacy Rights (General)

Depending on your location, you may have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion of your personal information, subject to legal recordkeeping requirements;
• Object to or restrict certain processing of your information;
• Withdraw consent where processing is based on consent (e.g., marketing communications).

To exercise any of these rights, please contact us using the details in Section 18.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides you with specific rights regarding your personal information.

11.1 Categories of Information Collected

In the preceding 12 months, we have collected the categories of personal information described in Section 1, which may include identifiers, commercial information, internet/electronic activity, and, where you complete KYC, government ID information.

11.2 Your CCPA Rights

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: request deletion of personal information we have collected, subject to certain exceptions (e.g., KYC and legal recordkeeping requirements).
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: we do not sell personal information for monetary consideration. To the extent our use of advertising pixels (Meta, TikTok) is considered "sharing" for cross-context behavioral advertising under the CCPA, you may opt out by adjusting your cookie preferences or contacting us.
• Right to Limit Use of Sensitive Personal Information: where applicable, you may request that we limit the use of sensitive personal information (such as government ID numbers) to purposes necessary to provide the Services.
• Right to Non-Discrimination: we will not discriminate against you for exercising any CCPA right.

To submit a CCPA request, contact us via the details in Section 18. We may need to verify your identity before processing your request, which may include confirming information already on file (e.g., from your KYC verification).

12. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation ("GDPR") provides you with additional rights regarding your personal data.

12.1 Legal Basis for Processing

12.2 Your GDPR Rights

• Right of access to your personal data;
• Right to rectification of inaccurate data;
• Right to erasure ("right to be forgotten"), subject to legal exceptions;
• Right to restrict processing;
• Right to data portability;
• Right to object to processing based on legitimate interest or for direct marketing;
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• Right to lodge a complaint with your local data protection supervisory authority.

13. Children's Privacy

Our Services are not directed to individuals under the age of 18, and bidding eligibility requires that participants be at least 18 years old. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly.

14. Third-Party Links

The Site may contain links to third-party websites or services that are not owned or controlled by TwoTraderAuctions. This Privacy Policy does not apply to those third-party sites, and we encourage you to review their respective privacy policies before providing any personal information.

15. International Data Transfers

TwoTraderAuctions is based in the United States, and the information we collect is primarily processed in the United States. If you are accessing the Site from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate, which may have data protection laws different from those in your jurisdiction. Where required, we take steps to ensure such transfers comply with applicable law (e.g., Standard Contractual Clauses for transfers from the EEA/UK).

16. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. Because there is not yet a common industry standard for how to respond to DNT signals, our Site does not currently respond differently based on DNT browser settings.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last Updated" date at the top of this page indicates when this Policy was last revised. Material changes will be communicated through a notice on the Site or by other reasonable means prior to the change becoming effective.