1. Data Controllers

2. Personal Data We Collect

2.1 Data You Provide Directly

• Account registration: Full name, email address, phone number, company name, business type, country, and password;
• Seller profiles: Business address, trade/VAT registration number, bank account details (held by Stripe), company logo, and profile description;
• Listings: Equipment descriptions, specifications, photographs, videos, pricing, and location data;
• Communications: Messages sent via the Platform enquiry system, RFQ submissions, support tickets;
• Payments: Billing name, address, and payment method details (processed and stored by Stripe — we do not store raw card data);
• Contract Builder: Names, addresses, and transaction details entered when generating contracts;
• Profile completion: Industry, job title, buying/selling preferences, and notification settings.

2.2 Data Collected Automatically

• Usage data: Pages visited, search queries, listings viewed, filters applied, time spent, and click-through rates;
• Device data: IP address, browser type and version, operating system, device type, and screen resolution;
• Log data: Access logs, error reports, and performance metrics;
• Location data: Approximate geolocation derived from IP address (not precise GPS unless you grant permission);
• Cookies and tracking technologies: See our Cookie Policy for full details.

2.3 Data From Third Parties

• Stripe: Payment status, subscription details, and billing events;
• Social login providers: If you sign in via Google, LinkedIn, or similar, we receive basic profile information (name, email, profile picture) with your consent;
• Industry data: Publicly available equipment pricing from auction results (see Section 7 on Scraping);
• Forum/Community (Discourse): If you use integrated community features, activity data is shared between EasiMachines and the Discourse forum under separate authentication.

3. How We Use Your Personal Data

4. AI & Machine Learning Data Usage

EasiMachines uses AI and machine learning to power features such as equipment valuation, bulk specification extraction, smart search ranking, and hot-lead scoring. In connection with these features:

• Training data: Aggregated and de-identified listing data (make, model, year, condition, price) may be used to train and improve our valuation models. Personal data (names, contact details) is excluded from training datasets;
• Inference: When you use AI Bulk Upload or AI Valuation, your input data is processed by our model to generate outputs. Inputs and outputs may be logged for quality assurance and model improvement purposes;
• No selling to third parties: We do not sell individual-level data to third parties for advertising or profiling;
• AI-generated outputs are not advice: AI valuations, extracted specs, and generated contracts are informational only — see our AI Features Disclaimer.

Where processing is based on legitimate interest, you have the right to object. Contact legal@easimachines.com to exercise this right.

5. Data Sharing

We share personal data only in the following circumstances:

5.1 Between Buyers and Sellers

When a buyer sends an enquiry or RFQ, the buyer's name, company, and message are shared with the relevant seller to enable them to respond. Sellers' publicly listed information (name, company, location, contact) is displayed on their profile.

5.2 Service Providers

We share data with trusted service providers who help us operate the Platform, under data processing agreements:

• Stripe — payment processing (PCI-DSS compliant);
• Amazon Web Services (AWS) / Vercel — hosting and infrastructure;
• Resend / SendGrid — transactional email;
• Discourse — community forum (if enabled);
• Analytics providers — platform usage analytics (data is aggregated or pseudonymised).

5.3 Legal Requirements

We may disclose your data if required to do so by law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect our legal rights, prevent fraud, or ensure the safety of our Users.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, personal data may be transferred to the acquiring entity. We will notify you by email or Platform notice before your data is subject to a different privacy policy.

5.5 No Selling of Personal Data

EasiMachines does not sell personal data to third parties. We do not share personal data with advertisers for their own independent use.

6. Cookies & Tracking Technologies

We use cookies, local storage, and similar tracking technologies to provide and improve the Platform. See our full Cookie Policy for details on cookie types, purposes, and how to manage your preferences. By continuing to use the Platform, you consent to cookies as described in that policy (subject to your browser/cookie settings).

7. Web Scraping & Third-Party Data Sources

To power our AI valuation and market intelligence features, EasiMachines may collect publicly available equipment pricing data from third-party sources, including:

• Public auction result pages (Ritchie Bros, BVA, IronPlanet, Troostwijk, and similar) where results are publicly accessible without authentication;
• Manufacturer specification sheets and publicly available product documentation;
• Voluntary user-reported sale prices (post-transaction data provided by sellers);
• Licensed data feeds from industry pricing providers (e.g., EquipmentWatch, Sandhills IronGuides).

Our scraping practices:

• We respect robots.txt directives and rate limits of target websites;
• We collect only publicly visible, non-authenticated data;
• We do not collect personal data (seller names, contact details) from third-party websites for storage in our systems;
• Data collected is used exclusively for market intelligence and valuation purposes;
• We comply with relevant intellectual property and database rights laws.

If you are an operator of a third-party website and have concerns about our data collection practices, contact us at legal@easimachines.com.

8. International Data Transfers

EasiMachines operates globally with servers and service providers in multiple countries, including India, the United States, and the European Union. Personal data may be transferred to and processed in countries outside your own. We ensure that such transfers comply with applicable data protection laws through:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EU/EEA;
• Adequacy decisions where available;
• Appropriate contractual safeguards with all international service providers;
• Compliance with the Indian DPDP Act 2023 cross-border transfer provisions, including notification requirements where applicable.

9. Data Retention

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

10.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you;
• Correction: Request that we correct inaccurate or incomplete personal data;
• Deletion: Request deletion of your personal data (subject to legal retention obligations);
• Objection: Object to processing based on legitimate interest;
• Withdraw consent: Where processing is based on consent, withdraw it at any time (without affecting prior processing).

10.2 Additional Rights — EU/UK Users (GDPR)

• Portability: Receive your data in a structured, machine-readable format;
• Restriction: Request restriction of processing while a dispute is resolved;
• Automated decision-making: Not be subject to solely automated decisions with significant legal effects without human review;
• Lodge a complaint: With your national supervisory authority (e.g., ICO in the UK, or the relevant EU DPA).

10.3 California Users (CCPA/CPRA)

• Right to Know what personal information is collected, used, shared, or sold;
• Right to Delete personal information (with exceptions for legal compliance);
• Right to Opt-Out of sale of personal information — we do not sell personal information;
• Right to Non-Discrimination for exercising CCPA rights;
• Right to Correct inaccurate personal information;
• Right to Limit Use of Sensitive Personal Information.

10.4 Indian Users (DPDP Act 2023)

• Right to access information about personal data processed;
• Right to correction and erasure;
• Right to grievance redressal — contact our Data Protection Officer;
• Right to nominate another person to exercise rights on your behalf in case of death or incapacity.

11. Security

EasiMachines implements appropriate technical and organisational security measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest;
• Access controls restricting employee access to personal data on a need-to-know basis;
• Regular security assessments and vulnerability management;
• PCI-DSS compliant payment processing via Stripe;
• Content Security Policy (CSP) headers and other web security measures.

Despite our efforts, no method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law (within 72 hours for GDPR; within applicable windows under Indian DPDP Act rules).

12. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact legal@easimachines.com and we will promptly delete it.

13. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email (where held) or in-Platform notice at least 30 days before taking effect. The "Last Updated" date at the top of this page indicates when the latest revision was made.

14. Contact & Data Protection Officer