Privacy Policy

Personal Data We Collect

We may collect and process the following categories of personal data:

Account and Identity Data: Full name, job title, company name, company registration number, VAT number, proof of identity documents, and login credentials.

Contact Data: Email address, telephone number, postal address, and business address.

Financial and Transaction Data: Bank account details, payment records, invoices, security deposits, bid history, purchase history, and transaction amounts.

Technical Data: IP address, browser type and version, operating system, device identifiers, time zone setting, and browsing actions on the Marketplace.

Usage Data: Information about how you use the Marketplace, including pages visited, search queries, auction participation, equipment viewed, and interaction patterns.

Communication Data: Records of correspondence between you and Haubot, including emails, chat messages, voice notes, attachments and support requests.

Voice and Audio Data: Lifecycle metadata of voice calls placed between users (start time, end time, caller, callee, duration, end reason), and — only where the user explicitly selects the SecureCall mode and both parties consent — the audio recording of the call. SecureCall recordings are processed on the lawful basis of consent under Article 6(1)(a) GDPR. Non-recorded voice calls do not produce a stored audio recording; only the lifecycle metadata is retained.

Network and Social Data: Posts, stories, polls, follow relationships and engagement signals generated by your use of the Haubot Network feature.

How We Collect Your Data

We collect personal data through the following means:

• Directly from you: When you register an account, place a bid, list equipment, complete a transaction, contact our support team, or subscribe to our communications.
• Automatically: When you browse or interact with the Marketplace, through cookies and similar technologies (see our Cookie Policy for details).
• From third parties: From business partners, credit reference agencies, identity verification services, and publicly available registers such as chambers of commerce.

Legal Bases and Purposes of Processing

We process your personal data based on the following legal grounds under the GDPR:

Performance of a Contract (Article 6(1)(b)): Processing necessary to fulfill our contractual obligations, including account registration and management, processing bids and purchases, facilitating payments and invoicing, arranging equipment delivery and logistics, and providing customer support related to transactions.

Legal Obligation (Article 6(1)(c)): Processing necessary to comply with legal requirements, including tax and accounting obligations, anti-money laundering (AML) and Know Your Customer (KYC) checks, customs and export control compliance, and responding to lawful requests from regulatory authorities.

Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, including improving and optimizing the Marketplace, fraud prevention and security monitoring, business analytics and reporting, enforcing our terms and conditions, and sending relevant business communications about equipment and services.

Consent (Article 6(1)(a)): Where required, we obtain your explicit consent for marketing communications and newsletters, placement of non-essential cookies, and any other processing that requires consent under applicable law. You may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

Sharing of Personal Data

We may share your personal data with the following categories of recipients:

• Haubot Group Entities: Our subsidiaries and branches, including Haubot International FZCO (Dubai), for purposes of facilitating transactions and providing services.
• Transaction Counterparties: Buyers and sellers involved in a transaction, to the extent necessary for completing the sale, delivery, and transfer of equipment ownership.
• Service Providers: Third-party providers that assist us with payment processing, identity verification, logistics, IT hosting, analytics, and customer support. These providers process data only on our behalf and under contractual data processing agreements.
• Professional Advisors: Lawyers, auditors, accountants, and insurers who provide professional services to Haubot.
• Regulatory Authorities: Tax authorities, customs agencies, law enforcement, and other regulatory bodies, where required by law or in response to lawful requests.
• Debt Collection Agencies: In cases of non-payment or default, as described in our Buyer Terms & Conditions.

We do not sell your personal data to third parties.

International Data Transfers

As Haubot operates internationally, your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United Arab Emirates where our subsidiary Haubot International FZCO operates.

Where personal data is transferred outside the EEA, we ensure that adequate safeguards are in place in accordance with the GDPR, including:

• Transfers to countries with an adequacy decision by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other appropriate safeguards as permitted under Article 46 of the GDPR

You may request a copy of the safeguards in place by contacting us using the details provided below.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. The specific retention periods depend on the nature of the data and the purpose of processing:

• Account Data: Retained for the duration of your account and for up to 2 years after account closure, unless longer retention is required by law.
• Transaction and Financial Data: Retained for 7 years after the transaction to comply with Dutch tax and accounting legislation.
• KYC/AML Documentation: Retained for 5 years after the end of the business relationship, as required by anti-money laundering regulations.
• Communication Records: Retained for up to 3 years after the last interaction, unless related to a dispute or legal claim.
• SecureCall Recordings: Retained for the duration of the active conversation and for up to 3 years after the conversation is closed, in line with the Communication Records retention. A longer retention period may apply where required for dispute resolution, fraud prevention, legal compliance, or the establishment, exercise or defence of legal claims. Removal applies only on the grounds set out in the Platform Services Terms (failed processing, binding legal order, breach of Terms, or a successful Article 17 GDPR erasure request following a balancing of interests). Non-recorded voice calls do not produce a stored recording; only the call lifecycle metadata is retained under Communication Records.
• Technical and Usage Data: Retained for up to 26 months for analytics purposes.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption of data in transit and at rest
• Secure access controls and authentication mechanisms
• Regular security assessments and monitoring
• Employee access restrictions on a need-to-know basis
• Contractual obligations imposed on third-party data processors

While we take all reasonable precautions to protect your data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal data.

Your Rights

Under the GDPR, you have the following rights with regard to your personal data:

• Right of Access (Article 15): You have the right to obtain confirmation of whether your personal data is being processed and, if so, to access the data and receive a copy.
• Right to Rectification (Article 16): You have the right to request the correction of inaccurate personal data and to have incomplete data completed.
• Right to Erasure (Article 17): You have the right to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
• Right to Restriction of Processing (Article 18): You have the right to request that processing of your personal data be restricted in certain situations.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
• Right to Object (Article 21): You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within one month of receipt, in accordance with the GDPR. In certain circumstances, this period may be extended by two further months, in which case we will inform you accordingly.

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your country of residence.

Children's Privacy

The Marketplace is designed exclusively for business-to-business transactions and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete such data promptly.

Changes to This Privacy Policy

Haubot reserves the right to update this Privacy Policy at any time. Any changes will be posted on this page with a revised effective date. Where changes are significant, we will make reasonable efforts to notify you, for example by email or by placing a prominent notice on the Marketplace. We encourage you to review this Privacy Policy periodically.

Contact Information

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a complaint about how we handle your personal data, please contact us at:

• Haubot International B.V.
• Diemerhof 42, Diemen 1112 XN, Netherlands
• Email: [email protected]

Dutch Data Protection Authority (Autoriteit Persoonsgegevens): www.autoriteitpersoonsgegevens.nl