PRIVACY POLICY

1. INTRODUCTION

This Privacy Policy explains how IPK collects, uses, stores, shares and protects personal data in connection with operation of the IPK Auctions Platform.

IPK is committed to processing personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation or "GDPR");
• applicable Portuguese data protection legislation;
• principles of transparency, fairness and accountability.

Users should read this Privacy Policy carefully before registering an account, participating in Auctions or using the Platform.

2. DATA CONTROLLER

The data controller responsible for processing personal data described in this Policy is:

ESCALA GALANTE UNIPESSOAL LDA

3. CATEGORIES OF PERSONAL DATA

Depending upon the user's interaction with the Platform, IPK may process:

• identity information;
• contact information;
• account information;
• verification information;
• payment-related information;
• bidding information;
• communication records;
• technical and usage information;
• complaint-related information.

The categories processed will depend upon the services used.

4. HOW PERSONAL DATA IS COLLECTED

Personal data may be collected

• directly from users;
• through account registration;
• during bidder activation;
• through identity verification procedures;
• through payment verification procedures;
• through use of the Platform;
• through communications with IPK;
• through third-party service providers acting on behalf of IPK.

5. ACCOUNT REGISTRATION DATA

When a user creates an account, IPK may collect information including:

• name;
• email address;
• telephone number;
• account credentials;
• account preferences;
• communication preferences.

This information is used to establish and administer the user's account.

6. BIDDER ACTIVATION DATA

When a Registered User seeks to become an Approved Bidder, IPK may process additional information relating to bidder activation.

This may include

• bidder status;
• activation records;
• acceptance of Platform documentation;
• verification status;
• audit trail information.

Such information assists with operation and integrity of the auction process.

7. IDENTITY VERIFICATION DATA

Where bidder activation requires identity verification, IPK may receive information from identity verification providers such as Veriff or equivalent providers.

Depending upon the verification process, information may include:

• identity document information;
• facial comparison results;
• liveness verification results;
• verification status;
• fraud prevention indicators.

IPK does not necessarily receive every item of information collected by the verification provider.

The scope of information received will depend upon the services utilised and configuration of the verification process.

8. PAYMENT-RELATED DATA

When payment verification procedures are completed, IPK and its payment providers may process information relating to:

• payment method registration;
• payment authorisation status;
• transaction references;
• payment verification outcomes;
• billing information where required.

Payment card details are generally processed through specialised payment service providers and are not ordinarily stored by IPK in full.

9. PURPOSES OF PROCESSING

IPK processes personal data for purposes including:

• account creation and administration;
• operation of the Platform;
• bidder activation;
• identity verification;
• payment verification;
• auction administration;
• auction result certification;
• fraud prevention;
• platform security;
• customer support;
• complaint handling;
• compliance with legal obligations;
• protection of legal rights;
• maintenance of audit trails and operational records.

Personal data shall be processed only for legitimate and specified purposes.

10. LEGAL BASES FOR PROCESSING

Depending upon the circumstances, IPK may process personal data on one or more of the following legal bases:

Performance of a Contract

Processing necessary to

• create and administer user accounts;
• provide Platform services;
• operate Auctions;
• administer bidder participation.

Compliance with Legal Obligations

Processing necessary to comply with

• applicable laws;
• regulatory requirements;
• lawful requests from public authorities.

Legitimate Interests

Processing necessary for legitimate interests including:

• fraud prevention;
• platform security;
• dispute resolution;
• operational management;
• auction integrity;
• protection of legal rights.

Consent

Where consent is required under applicable law, processing shall occur on the basis of the user's consent.

Users may withdraw consent where applicable, although withdrawal may affect the availability of certain services.

11. SHARING INFORMATION WITH SELLERS

Where a user becomes the Successful Bidder, IPK may disclose relevant personal information to the Seller for the purpose of facilitating implementation of the transaction.

Such information may include

• name;
• contact details;
• bidder identification information;
• information reasonably required to progress the transaction.

Information shall be limited to what is reasonably necessary for the relevant purpose.

12. SHARING INFORMATION WITH SELLER LAWYERS

Where a user becomes the Successful Bidder, IPK may provide information to the Seller Lawyer for purposes including:

• preparation and execution of transaction documentation;
• transaction administration;
• communication with the Successful Bidder;
• compliance procedures undertaken by the Seller Lawyer.

The Seller Lawyer acts independently of IPK and may process personal data under separate legal obligations and privacy arrangements.

13. SHARING INFORMATION WITH PARTNER AGENCIES

IPK may share relevant information with the Partner Agency involved in the relevant Property transaction.

Such sharing may occur for purposes including:

• auction administration;
• transaction coordination;
• communication with participants;
• implementation of the transaction.

Information shared shall be limited to what is reasonably necessary.

14. IDENTITY VERIFICATION PROVIDERS

IPK may utilise independent identity verification providers, including Veriff or equivalent providers.

Such providers may process information including:

• identity document information;
• facial verification information;
• liveness verification information;
• fraud prevention indicators.

The identity verification provider may act as an independent controller, processor or sub-processor depending upon the services provided and the contractual arrangements in place.

Users should review the privacy information provided by the relevant verification provider where applicable.

15. PAYMENT SERVICE PROVIDERS

IPK may utilise payment service providers including Stripe and associated payment infrastructure providers.

Payment service providers may process

• payment method information;
• authentication information;
• transaction information;
• fraud prevention information;
• payment verification information.

IPK does not ordinarily receive or store complete payment card details.

Payment service providers process personal data in accordance with their own privacy policies and applicable legal requirements.

16. SERVICE PROVIDERS

IPK may share personal data with service providers engaged to assist with operation of the Platform.

Such providers may include

• cloud hosting providers;
• software providers;
• communication providers;
• cybersecurity providers;
• customer support providers;
• fraud prevention providers;
• analytics providers;
• professional advisers.

Such providers shall only receive information reasonably necessary for the services they provide.

17. REGULATORY DISCLOSURES

IPK may disclose personal data where required:

• by law;
• by regulation;
• by court order;
• by lawful request from competent public authorities.

IPK may also disclose information where reasonably necessary to:

• protect legal rights;
• investigate suspected fraud;
• protect auction integrity;
• enforce contractual rights.

18. INTERNATIONAL DATA TRANSFERS

Some service providers utilised by IPK may process personal data outside Portugal or outside the European Economic Area.

Where international transfers occur, IPK shall seek to ensure that appropriate safeguards are implemented in accordance with GDPR requirements.

Such safeguards may include

• adequacy decisions;
• standard contractual clauses;
• other legally recognised transfer mechanisms.

Users may request further information regarding applicable safeguards by contacting IPK.

19. DATA RETENTION

IPK retains personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected and to comply with legal, regulatory, contractual and operational requirements.

Retention periods may vary depending upon:

• the nature of the information;
• the user's relationship with the Platform;
• legal obligations;
• regulatory obligations;
• dispute resolution requirements;
• fraud prevention requirements;
• operational requirements.

Where personal data is no longer required, IPK will seek to securely delete, anonymise or otherwise dispose of such information in accordance with applicable law.

20. USER RIGHTS

Subject to applicable law, users may have the following rights regarding their personal data:

Right of Access

To obtain confirmation regarding whether personal data is being processed and, where applicable, access to such data.

Right to Rectification

To request correction of inaccurate or incomplete personal data.

Right to Erasure

To request deletion of personal data where applicable legal conditions are satisfied.

Right to Restriction of Processing

To request restriction of processing in certain circumstances.

Right to Data Portability

To receive personal data in a structured, commonly used and machine-readable format where applicable.

Right to Object

To object to certain processing activities where permitted by law.

Rights Relating to Consent

Where processing is based upon consent, users may withdraw consent at any time.

Withdrawal of consent shall not affect the lawfulness of processing undertaken before withdrawal.

21. EXERCISING DATA PROTECTION RIGHTS

Requests relating to personal data rights may be submitted to:

support@ipk.pt

or

complaints@ipk.pt

IPK may request reasonable information to verify the identity of the person making the request before responding.

Requests shall be handled in accordance with applicable data protection legislation.

22. AUTOMATED DECISION-MAKING

IPK may utilise automated systems in connection with:

• account security;
• fraud prevention;
• bidder activation workflows;
• payment verification processes;
• platform administration.

Such systems are intended to support operational efficiency and platform integrity.

IPK does not generally make decisions producing legal effects solely through automated processing without appropriate safeguards.

Where applicable law requires additional information regarding automated decision-making, such information shall be provided upon request.

23. SECURITY MEASURES

IPK implements reasonable technical and organisational measures intended to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• accidental loss;
• misuse;
• alteration;
• destruction.

Such measures may include

• encryption technologies;
• secure hosting environments;
• access controls;
• authentication procedures;
• monitoring and logging systems;
• vendor security controls.

No internet-based system can be guaranteed to be completely secure, and users should also take appropriate steps to protect their own information.

24. THIRD-PARTY WEBSITES

The Platform may contain links to third-party websites, services or resources.

IPK is not responsible for the privacy practices, content or security of third-party websites.

Users should review the privacy policies of third-party services before providing personal information.

25. CHILDREN

The Platform is intended for use by adults who are legally capable of entering into binding agreements.

IPK does not knowingly collect personal data from children.

If IPK becomes aware that personal data relating to a child has been collected inappropriately, reasonable steps shall be taken to remove such information.

26. COMPLAINTS RELATING TO PERSONAL DATA

Users who have concerns regarding the processing of personal data are encouraged to contact IPK in the first instance.

Privacy-related enquiries or complaints may be submitted to:

complaints@ipk.pt

IPK will seek to investigate and respond within a reasonable period.

27. RIGHT TO COMPLAIN TO THE CNPD

Users have the right to lodge a complaint with the competent data protection supervisory authority.

In Portugal, the competent supervisory authority is:

Comissão Nacional de Proteção de Dados (CNPD)

Website

Nothing in this Privacy Policy limits any rights available under applicable data protection legislation.

28. LIVRO DE RECLAMAÇÕES

Consumers may also submit complaints through the Portuguese Livro de Reclamações system.

Information regarding the Livro de Reclamações Eletrónico is available at:

The availability of the Livro de Reclamações does not affect rights available under GDPR or applicable data protection legislation.

29. CHANGES TO THIS PRIVACY POLICY

IPK may amend this Privacy Policy from time to time.

The most recent version shall be published on the Platform.

Users should review the current version periodically.

Where required by law, users may be asked to accept an updated version before continuing to use certain Platform services.

30. CONTACT DETAILS

31. FINAL OBSERVATION

IPK is committed to processing personal data responsibly, transparently and in accordance with applicable law.

The Platform has been designed to balance:

• user privacy;
• auction integrity;
• fraud prevention;
• operational efficiency;
• legal and regulatory compliance.

Users who do not agree with this Privacy Policy should not use the Platform or participate in Auctions.