DATA PRIVACY POLICY

Version dated 03/02/2023

1. BASIC PRINCIPLES

Your privacy is very important to us. In drafting this data privacy policy, our intention is to explain which personal data we collect about you and process in our company.

In the course of our business activities, we are subject to Swiss data protection law, in particular the Federal Act on Data Protection (FADP) and, where applicable, foreign data protection legislation, particularly the European Union (EU) General Data Protection Regulation (GDPR).

By using our services and our platform, you consent to the processing of the data collected about you in the manner and for the purpose described below. You may only disclose third-party personal data to us if you are authorized to do so and the personal data is correct.

We may amend this data privacy policy at any time and without prior notice. The version published on our platform is the current applicable version in each case.

2. DATA PROTECTION OFFICER

INSIDERAUCTIONS AG, Zelglimatte 4, 6260 Reiden, is responsible for the content of this data privacy policy and for the data processing described above.

Your contact is:
Daniel Caccavo
contact@insider-auctions.com
+41 (0) 41 921 50 50

3. COLLECTING AND PROCESSING PERSONAL DATA

We process personal data received from our customers, users, business partners, employees, authorities, and other relevant persons in the course of our business activities with the latter, as well as from third parties, or data collected when operating our auction platform or other applications. In individual cases and as required, we also collect publicly accessible data (e.g. from the internet, social media, etc.), insofar as this is necessary and permissible to enable us to perform our business activities.

If you have an online account with us, you can access and update your data by logging in to your account. You may also contact us to update your information (see Section 5.2 below).

4. PURPOSES OF DATA PROCESSING AND LEGAL BASES

We process the data collected to comply with our legal and contractual obligations to our customers, users, business partners, employees, authorities, and other relevant persons.

In addition, we process personal data from you and other relevant persons, to the extent that this is permitted and deemed appropriate, for the following purposes in which we have a legitimate interest commensurate with the purpose:

• information about offers, services, websites and other platforms on which we have a presence;
• advertising and information about our services and offers;
• maintaining our business relationship with you;
• monitoring performance and improving our offering;
• asserting and defending legal claims in connection with legal disputes and official proceedings;
• preventing and investigating criminal offenses and other misconduct;
• providing guarantees for our operations, in particular IT, our websites, and other platforms;
• measures relating to IT, building and system security, and the security of our employees and other individuals;
• your purchase history, sales history, data on previous transactions with us or people we represent, commission agreements and other contractual obligations, your interest in certain vehicles or types of vehicles, plus financial and payment information (e.g. bank letters, bank account information, tax statements, credit information, credit documents, and credit cards);
• to provide you with information or services that you have requested or inquired about, including via mailshots, catalogs, and emails;
• to find out which auctions you want to participate in or have participated in previously;
• to facilitate registration procedures and transactions for buyers, sellers, and their agents at auctions.

If you have granted us consent to process your personal data for specific purposes (e.g. when you registered to receive newsletters or other requests via online forms on our website), we process your personal data within the scope of and on the basis of that consent, insofar as we have no other legal basis and we require a legal basis to proceed. Once granted, consent can be withdrawn at any time, but this does not affect data processing that has already taken place.

We process personal data in accordance with Swiss data protection law (Art. 4 et seq. FADP). Where justification is required to process your personal data, this is based either on your consent, or on a legal basis, or on our overriding private interest in the data processing. Your personal data may also be processed by other companies within the Group.

5. DATA PROCESSING IN CONNECTION WITH USING OUR AUCTION PLATFORM

5.1 COOKIES AND IMAGE ELEMENTS

Our website and applications use cookies and similar technologies to identify your browser or device. A cookie is a small file that is sent to your computer or automatically stored on your computer or mobile device by the web browser you use when you visit our website. If you visit this website again, we will be able to recognize you, even if we don’t know who you are. In addition to cookies that are only used during one session and are deleted after you visit our website (session cookies), cookies can also be used to store user settings and other information for a certain period of time (permanent cookies). However, you can set your browser to reject cookies, store them for only one session, or delete them before the specified time. Most browsers are set to accept cookies by default.

In our newsletters and other marketing emails, we also include visible and invisible image elements which, when retrieved by our servers, enable us to determine if and when you opened the email to help us understand how you use our auction platform and how we can improve it. You can block this in your email program; most are set to do so by default.

By using our website and other applications, and consenting to receive newsletters and other marketing emails, you consent to the use of these technologies. If you do not want this to happen, you must configure your browser or email program accordingly.

5.2 CONTACT FORM

We are happy to provide a contact form so you can get in touch with us. This allows you to collate and send the following data:

• name, email address, phone number, message.

Mandatory information is marked with an asterisk (*). Personal data may be provided in other fields or in the context of any other contact (e.g. by email, telephone) on a voluntary basis. Under the GDPR, this data is processed for the purpose of initiating or fulfilling a contract (Art. 6(1)(b) GDPR) or on the basis of our legitimate interest in processing inquiries submitted to us (Art. 6(1)(f) GDPR), or based on your consent (Art. 6(1)(a) GDPR).

5.3 GOOGLE INC.

We use Google Inc. and similar services on our website. We use features of the Google Analytics web analytics service, Google Tag Manager, Google AdSense, and Google Ads. We also use Google Maps to embed maps, Google Fonts to use fonts, and Google reCAPTCHA to protect our platform from spam and misuse.

Google Ireland Limited (Gordon House, Barrow Street Dublin 4, Ireland) is responsible for all Google services in Europe. In addition to our own policies, you can find Google Inc.’s privacy policy via the following link.

Google: https://policies.google.com/privacy. 

5.3.1 Google Analytics

Google Analytics uses cookies to analyze how you use the platform. The information generated by cookies about how you use our platform is transmitted to and stored in Google servers (which may also be located in the USA).

5.3.2 Google Tag Manager

Google Tag Manager is a solution that allows us to manage website tags via an interface. Google Tag Manager is a cookie-free domain that does not collect any personal data. Google Tag Manager triggers other tags that can collect additional data. Google Tag Manager does not access this data.

5.3.3. Google AdSense

Google AdSense uses cookies and web beacons (invisible graphics). Google uses web beacons to evaluate information (e.g. number of clicks) on these websites. The resulting information about how you use our platform (including your IP address) and how advertising formats are delivered is transmitted to and stored in Google servers (which may also be located in the USA).

5.3.4 Google Maps

On our auction platform, we use Google Maps to embed maps. By using Google Maps, data is transmitted to and stored by Google (under certain circumstances this may also take place in the USA).

5.3.5 Google Web Fonts

Our auction platform uses web fonts provided by Google to ensure that fonts are displayed consistently. Google fonts are installed locally. There is no connection to Google servers during this process. For more information about Google Web Fonts, see: https://developers.google.com/fonts/faq. 

5.3.6 reCAPTCHA

We use the Google reCAPTCHA service on our auction platform. The associated tests are used to distinguish whether entries (e.g. in the contact form) are made by a human or by “bots” (automated machine processing). The test includes sending the IP address and any other data required by Google for the reCAPTCHA service to Google. Your input will be transmitted to Google and used there. However, Google will truncate your IP address beforehand in EU member states or other states that have signed up to the Agreement across the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated on arrival. Google uses this information to evaluate how you use the service. According to Google, the IP address transmitted by your browser as part of reCAPTCHA is not combined with other Google data. By clicking on the test, you consent to your data being processed in this way, which means that the data is processed on the basis of your consent.

5.4 PAYMENTS

We may offer paid products and/or services (subscriptions). In this case, we may use third-party services to process payments. The use of your personal data and payment information by these third-party providers is governed by their data privacy policy. 

Stripe

We use the services of Stripe. The provider is Stripe Inc., South San Francisco, California U.S. (“Stripe”).

When making a payment via Stripe, your payment data is forwarded from our platform to Stripe via an interface to their e-payment platform in order to make the payment. More information on how Stripe handles your personal data can be found in their privacy policy (insert hyperlink from stripe).

Within the scope of the DSGVO, the transfer of your data to stripe is based on the execution of the contract (Art. 6 para. 1 lit. b DSGVO) as well as on our legitimate interest (Art. 6 para. 1 lit. f DSGVO) in the use of reliable and secure payment processes

5.5 NEWSLETTER

You have the option of subscribing to our newsletter, which tells you about our offers, products, and information at regular intervals. So that we can send you a personalized newsletter, we need your first and last name, email address, and information that allows us to check that you are the owner of the specified email address and that you have agreed to receive the newsletter. We only use this data for the newsletter. We do not forward this personal data to third parties outside our company or group.

You may withdraw your consent to the storage of your personal data and this being used to send the newsletter at any time. Every newsletter contains a link pointing this out. 

5.6 CLOUD SERVICE PROVIDERS

We use the following external cloud service providers to process and store your personal data:

Microsoft 365 (incl. Exchange, SharePoint, Teams, OneDrive): the above services are provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”). According to Microsoft, data is stored exclusively on servers located in Switzerland. In addition to our own policies, you can find Microsoft’s data privacy policy by clicking on the following link:

https://privacy.microsoft.com/en-us/privacystatement.

6. Plug-ins/USE OF SOCIAL MEDIA
   6.1 Plug-ins

We use plug-ins from social networks such as Instagram on our websites. This will be clearly visible (via corresponding symbols). We have configured these elements to be deactivated by default. If you activate them, the operators of the respective social networks may register that you are on our website (including from where they access our website) and may use this information for their own purposes. It is then the responsibility of this operator to process your personal data in accordance with its data privacy rules. We do not accept any liability in this respect because this is beyond our control.

6.2 USE OF SOCIAL MEDIA

We maintain the publicly accessible profiles listed below on social networks. You can find linked graphics for the respective networks on our platform. By clicking on the corresponding graphic, you will be redirected to the selected social network, whereupon the network collects and processes your information thereafter.

When you visit our profiles on social networks, personal data may be collected about you. For example, if you are logged into your social network accounts and visit our profile at the same time, the portal operator may assign this visit to your user account. Even if you have logged out of your account or if you do not have an account with the respective portal, your personal data may still be collected. Such data may also be collected, especially by placing cookies or web beacons. By collecting data in this way, the portal operators are able to create user profiles and display adverts based on your interests. Please refer to the data privacy policies of the respective portals, for which we cannot accept any liability.

Under the GDPR, the use of social networks and the associated data processing are based on our legitimate interest (Art. 6(1)(f) GDPR). Our specific aim in this respect is to present ourselves online and increase our reach.

We use features of the Instagram service. The provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. If you are logged into your Instagram account, you can link the content of this platform to your Instagram profile by clicking on the Instagram button. This allows Instagram to associate your visit to this platform with your user account. We cannot accept any liability, as we have no knowledge of the content of the transmitted data and how it will be used.

You can learn more about this in Instagram’s data privacy policy: https://instagram.com/about/legal/privacy/.

7. TRANSFER OF DATA TO THIRD PARTIES

We do not pass on, sell or otherwise transfer your personal data to third parties. In exceptional cases, we will pass on your personal data if this is necessary for the purpose of contract processing or to fulfill our statutory duties, or if you have granted your express consent (e.g. to guarantee the security of our input forms on the website). In addition, data may be transmitted to third parties insofar as we are obliged by law or by enforceable official or court judgments.

Some recipients of such data are in Switzerland, but they may be anywhere in the world. If we transfer data to a country without adequate statutory data protection, we ensure an appropriate level of protection through the use of appropriate contracts. You can request further information on this subject from our data protection officer at any time. However, we reserve the right to redact copies for reasons of data privacy or confidentiality or to provide only excerpts.

8. PERSONAL DATA STORAGE PERIODS

We process and store your personal data for as long as is necessary to fulfill our contractual and statutory obligations or for the purposes for which this data is processed, i.e. for the entire duration of the business relationship (from registration and processing to termination of a contract) and beyond in accordance with the statutory storage and documentation obligations. Personal data may be stored for as long as claims can be made against our company or if we are otherwise legally obliged to do so, or if required by legitimate business interests (e.g. for evidence and documentation purposes). If your personal data is no longer required for these purposes, it will be deleted or anonymized. Shorter storage periods of 12 months or less apply to operating data (e.g. system protocols, logs).

9. DATA SECURITY

We do everything in our power to take measures to protect the user data we collect from unauthorized access. Please note, however, that no company can guarantee 100% information security. We’re doing the best we can.

10. OBLIGATION TO PROVIDE PERSONAL DATA

As part of our business relationship, you must provide us with the necessary personal data to enter into and conduct a business relationship, and to fulfill the associated contractual obligations (as a rule, you do not have a legal obligation to provide us with data). Without this data, we will generally not be able to conclude or process a contract with you. Nor will it be possible to use the website unless certain information to guarantee data traffic (such as IP address) is disclosed. Thank you for your understanding.

11. PROFILING AND AUTOMATED DECISION-MAKING

Personal data is not used as a basis for automated decision-making. We do not carry out profiling using personal data.

11. RIGHTS OF THE DATA SUBJECT

Under the data protection legislation that applies to you, you have the right to access, correct and delete information, the right to restrict data processing, and also the right to object to how we process your data and other legitimate interests in processing, as well as the right to the release of certain personal data for the purpose of transferring it to another body.

We reserve the right to enforce the restrictions provided for by law, for example if we are obliged to store or process certain data, have an overriding interest in such data, or require this data to assert claims. If you incur costs, we will inform you in advance and as transparently as possible. You acknowledge that exercising these rights may conflict with contractual agreements and may lead to consequences such as early termination of the contract, which may in turn lead to cost implications or claims for compensation.

Exercising such rights usually requires you to provide unambiguous proof of your identity (e.g. by sending a copy of a national ID card or passport).

You also have the right to assert your claims in court or to lodge a complaint with the competent data protection authority.  The responsible data protection authority in Switzerland is the Federal Data Protection and Information Commissioner (http://www.edoeb.admin.ch).

12. AMENDMENTS

We may amend this data privacy policy at any time without prior notice. The current version published on our website shall always apply. If the data privacy policy forms part of an agreement with you, we will notify you of any updates or amendments by email or in another suitable manner.