1. Data Controller

2. Personal Data We Collect

2.1 Data You Provide Directly

• Account registration: Full name, email address, phone number, company name, business type, country, and password;
• Seller profiles: Business address, trade/VAT registration number, bank account details (held by our payment processor), company logo, and profile description;
• Listings: Equipment descriptions, specifications, photographs, videos, pricing, and location data;
• Communications: Messages sent through the Platform enquiry system, Wanted Request submissions, support tickets, and conversations you start with an EasiMachines WhatsApp number;
• Payments: Billing name, address, and payment method details (processed and stored by our PCI-DSS-compliant payment processor — we do not store raw card data);
• Contract Builder: Names, addresses, and transaction details entered when generating contracts;
• Profile completion: Industry, job title, buying/selling preferences, and notification settings.

2.4 EasiMachines Assist WhatsApp Data

If you choose to message an EasiMachines WhatsApp number, we receive the sender number and available profile name, the EasiMachines number you contacted, message text, photographs, voice notes or documents you send, timestamps, delivery identifiers, and conversation-routing metadata. We use this information to answer your request, route it to a human specialist, prevent duplicate processing, and—when you ask to sell equipment—prepare a private listing draft for review. A WhatsApp conversation alone does not create an EasiMachines account, accept our Terms for you, or publish a listing.

An automated extraction service may read seller-supplied equipment text and images to suggest structured listing fields. A human reviews the result, and the seller must claim the draft through an eligible existing account or normal signup before a listing record is created. Buyer/Wanted and support conversations remain human-assisted in the current service.

2.2 Data Collected Automatically

• Usage data: Pages visited, search queries, listings viewed, filters applied, time spent, and click-through rates;
• Device data: IP address, browser type and version, operating system, device type, and screen resolution;
• Log data: Access logs, error reports, and performance metrics;
• Location data: Approximate geolocation derived from IP address (not precise GPS unless you grant permission);
• Cookies and tracking technologies: See our Cookie Policy for full details.

2.3 Data From Third Parties

• Payment processor: Payment status, subscription details, and billing events;
• Social login providers: If you sign in via Google, LinkedIn, or similar, we receive basic profile information (name, email, profile picture) with your consent;
• Industry data: Publicly available equipment pricing from auction results (see Section 7 on Scraping);
• Community forum: If you use integrated community features (not active in the current phase), activity data is shared between EasiMachines and the forum provider under separate authentication.

3. How We Use Your Personal Data

4. AI & Machine Learning Data Usage

EasiMachines uses AI and machine learning to power features such as equipment valuation, bulk specification extraction, smart search ranking, and hot-lead scoring. In connection with these features:

• Training data: Aggregated and de-identified listing data (make, model, year, condition, price) may be used to train and improve our valuation models. Personal data (names, contact details) is excluded from training datasets;
• Inference: When you use AI Bulk Upload or AI Valuation, your input data is processed by our model to generate outputs. Inputs and outputs may be logged for quality assurance and model improvement purposes;
• WhatsApp extraction: Equipment descriptions and media sent in an EasiMachines Assist seller conversation may be processed by an AI provider to suggest listing fields. The result is reviewed by a person and is never autonomous publication authority;
• No selling to third parties: We do not sell individual-level data to third parties for advertising or profiling;
• AI-generated outputs are not advice: AI valuations, extracted specs, and generated contracts are informational only — see our AI Features Disclaimer.

Where processing is based on legitimate interest, you have the right to object. Contact legal@easimachines.com to exercise this right.

5. Data Sharing

We share personal data only in the following circumstances:

5.1 Between Buyers and Sellers

When a buyer sends an enquiry or Wanted Request, the buyer's name, company, and message are shared with the relevant seller to enable them to respond. Sellers' publicly listed information (name, company, location, contact) is displayed on their profile.

Separately, sellers on Dealer Pro+ and above plans can see "buyer intent" signals for their own listings when a buyer favorites one — simply viewing a listing does not trigger this. If your account represents a registered business (dealer, manufacturer, rental company, auctioneer, or contractor), your company name is shown to that seller automatically, since a company name identifies an organization, not an individual — if your business account has not set a company name, your first name is shown instead until you add one. If you are an individual buyer, your name is attached to the signal only if you have turned on "Show my interest to sellers" in your notification settings — this is off by default. Either way, an approximate region may be shown, and your contact details (email, phone) are never revealed through this feature. A seller may send you one message about a listing you favorited; it reaches you by email/WhatsApp and a reply page, without exposing your contact details to them — those are only shared once you choose to reply or otherwise send an enquiry, as above.

5.2 Service Providers (Processors)

We rely on a small number of third-party service providers to run the Platform. Each processes personal data only on our documented instructions, only for the purposes below, and under a written data processing agreement with appropriate security and confidentiality obligations. We describe them here by category rather than by name; we will identify the specific providers currently in use on request — contact legal@easimachines.com.

• Payment processing — subscription billing, payment records, invoicing, and payment-fraud prevention. Card details are handled by a PCI-DSS-compliant payment processor; we do not receive or store raw card numbers.
• Infrastructure and hosting — operation of the Platform's servers, database, and backups.
• Content delivery and media storage — hosting and delivery of listing images, documents, and other files you upload.
• Email, SMS and messaging — sending account and transactional emails, account phone-verification codes by SMS, and notifications through email or WhatsApp using the contact details you provide.
• EasiMachines Assist — Meta's WhatsApp Business Platform and our messaging processor, MSG91 (Walkover Web Solutions Pvt Ltd; its WhatsApp delivery chain may include its disclosed Business Solution Provider), transmit and manage the business conversation. These providers receive the message and account/routing data needed to deliver and manage it. Their own notices also apply to their independent processing.
• Optional Hello contact recognition — if this feature is enabled, we may sync an eligible account holder's name, verified phone number and a limited routing tag to MSG91 so our agent can recognise an existing user. It is not used to create an account or infer consent, and it must remain disabled until its deletion and retention controls are operationally verified.
• AI and machine-learning processing — generating equipment valuations, extracting specifications from photos or documents you upload, ranking search results, scoring enquiries, and drafting contract text. Content you submit to these features is sent to our AI provider to produce the result; under our agreement it is not used to train that provider's models. See our AI Features Disclaimer.
• Error monitoring and analytics — diagnosing faults and understanding aggregated, pseudonymised Platform usage.
• Community forum — only where community features are enabled (not active in the current phase).

5.3 Legal Requirements

We may disclose your data if required to do so by law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect our legal rights, prevent fraud, or ensure the safety of our Users.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, personal data may be transferred to the acquiring entity. We will notify you by email or Platform notice before your data is subject to a different privacy policy.

5.5 No Selling of Personal Data

EasiMachines does not sell personal data to third parties. We do not share personal data with advertisers for their own independent use.

6. Cookies & Tracking Technologies

We use cookies, local storage, and similar tracking technologies to provide and improve the Platform. See our full Cookie Policy for details on cookie types, purposes, and how to manage your preferences. By continuing to use the Platform, you consent to cookies as described in that policy (subject to your browser/cookie settings).

7. Web Scraping & Third-Party Data Sources

To power our AI valuation and market intelligence features, EasiMachines may collect publicly available equipment pricing data from third-party sources, including:

• Public auction result pages (Ritchie Bros, BVA, IronPlanet, Troostwijk, and similar) where results are publicly accessible without authentication;
• Manufacturer specification sheets and publicly available product documentation;
• Voluntary user-reported sale prices (post-transaction data provided by sellers);
• Licensed data feeds from industry pricing providers (e.g., EquipmentWatch, Sandhills IronGuides).

Our scraping practices:

• We respect robots.txt directives and rate limits of target websites;
• We collect only publicly visible, non-authenticated data;
• We do not collect personal data (seller names, contact details) from third-party websites for storage in our systems;
• Data collected is used exclusively for market intelligence and valuation purposes;
• We comply with relevant intellectual property and database rights laws.

If you are an operator of a third-party website and have concerns about our data collection practices, contact us at legal@easimachines.com.

8. International Data Transfers

EasiMachines operates globally with servers and service providers in multiple countries, including India, the United States, and the European Union. Personal data may be transferred to and processed in countries outside your own. We ensure that such transfers comply with applicable data protection laws through:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EU/EEA;
• Adequacy decisions where available;
• Appropriate contractual safeguards with all international service providers;
• Compliance with the Indian DPDP Act 2023 cross-border transfer provisions, including notification requirements where applicable.

9. Data Retention

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

10.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you;
• Correction: Request that we correct inaccurate or incomplete personal data;
• Deletion: Request deletion of your personal data (subject to legal retention obligations);
• Objection: Object to processing based on legitimate interest;
• Withdraw consent: Where processing is based on consent, withdraw it at any time (without affecting prior processing).

10.2 Additional Rights — EU/UK Users (GDPR)

• Portability: Receive your data in a structured, machine-readable format;
• Restriction: Request restriction of processing while a dispute is resolved;
• Automated decision-making: Not be subject to solely automated decisions with significant legal effects without human review;
• Lodge a complaint: With your national supervisory authority (e.g., ICO in the UK, or the relevant EU DPA).

10.3 California Users (CCPA/CPRA)

• Right to Know what personal information is collected, used, shared, or sold;
• Right to Delete personal information (with exceptions for legal compliance);
• Right to Opt-Out of sale of personal information — we do not sell personal information;
• Right to Non-Discrimination for exercising CCPA rights;
• Right to Correct inaccurate personal information;
• Right to Limit Use of Sensitive Personal Information.

10.4 Indian Users (DPDP Act 2023)

• Right to access information about personal data processed;
• Right to correction and erasure;
• Right to grievance redressal — contact our Data Protection Officer;
• Right to nominate another person to exercise rights on your behalf in case of death or incapacity.

11. Security

EasiMachines implements appropriate technical and organisational security measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+) and at rest;
• Access controls restricting employee access to personal data on a need-to-know basis;
• Regular security assessments and vulnerability management;
• PCI-DSS compliant payment processing via our payment processor;
• Content Security Policy (CSP) headers and other web security measures.

Despite our efforts, no method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law (within 72 hours for GDPR; within applicable windows under Indian DPDP Act rules).

12. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact legal@easimachines.com and we will promptly delete it.

13. Updates to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email (where held) or in-Platform notice at least 30 days before taking effect. The "Last Updated" date at the top of this page indicates when the latest revision was made.

14. Contact & Data Protection Officer