1. INTRODUCTION

Tradoly of Europe, SL Spain S.L. ("Tradoly of Europe, SL", "we", "our", or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, and protect information when you use our platform, website (www.tradoly.com), mobile application, or any associated services (collectively, the "Services").

This Privacy Policy is designed to comply with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and applicable national data protection laws.

It explains not only what data we collect, but also how and why we process it in the context of operating a digital vehicle marketplace.

By accessing or using our Services, you acknowledge that you have read and understood this Policy.

2. DATA CONTROLLER INFORMATION

Tradoly of Europe, SL is responsible for determining the purposes and means of processing your personal data under Article 4(7) of the GDPR.

2.1 Role of Tradoly as Data Controller

Tradoly of Europe, SL acts as the data controller for personal data processed in connection with user registration, account management, platform access, communication logs, and service optimization. In this capacity, Tradoly determines the purposes and means of processing such personal data in accordance with applicable data protection laws.

2.2 Separation of Data Controller Responsibilities

Where users upload, share, or transmit personal data to other users through the platform (including messages, listings, or transaction-related exchanges), the respective user receiving such data acts as an independent data controller. Tradoly of Europe, SL does not assume responsibility as a data controller for such user-to-user exchanges.

If you have questions or wish to exercise your data rights, contact our Data Protection Officer (DPO) at support@tradoly.com.

2.3 Marketplace Roles and Data Responsibility Clarification

Tradoly operates as a digital marketplace connecting buyers and sellers of vehicles.

In this context:

• Sellers (including dealers or private users) act as independent data controllers for personal data included in listings, offers, and communications they initiate.
• Buyers (dealers) act as independent data controllers when they contact sellers or share personal data through the platform.

Tradoly processes such data only to facilitate the platform functionality (enabling messaging, displaying listings, and ensuring platform security), and does not determine the purpose of such user-to-user data exchanges.

Platform users included, individual car dealers, authorized automotive dealer firms, professional trader firms, individual private sellers, vehicle brokers, fleet owners, and leasing or remarketing partners acting as sellers.

3. PERSONAL DATA WE COLLECT

We collect personal data directly from you, automatically through your interactions, and from third parties as described below.

3.1. Information You Provide Directly

When you use Tradoly of Europe, SL, you may provide:

• Account Data: name, surname, email, phone number, password, business address, and business registration details (where applicable).
• Profile Information: profile photo, location, preferences, language, and vehicle interests.
• Listing Data: car descriptions, registration number (VIN), price, images, mileage, technical specifications, and contact information. This information is made visible to other relevant users of the platform to enable listings, offers, and communication between buyers and sellers.

Visibility of Listing Data: Listings created by users (including vehicle details, images, pricing, and seller contact preferences) are visible to other users of the platform based on platform functionality and user settings.

Listing data visible only to registered and logged-in users of the platform, with certain seller contact details and transaction-level data becoming accessible only after mutual interaction or acceptance within the platform's communication system. Trader-exclusive listings are visible only to selected dealers upon login.

Users are solely responsible for the personal data they choose to include in listings or communications.

• Transaction Data: billing address, payment method, VAT details, or bank account information.
• Communications: messages exchanged with other users, customer support interactions, and feedback. Tradoly may store and process such communications for customer support, dispute resolution, compliance, and platform security purposes.
• Consent Records: marketing preferences and cookie consent status.

3.2. Information We Collect Automatically

When you interact with our platform, we may automatically collect:

• Device and Technical Data: IP address, device ID, browser type, operating system, and language.
• Usage Data: pages visited, search filters, time spent, referral URLs, and interaction data.
• Location Data: approximate or precise geolocation (if permitted by your device settings).
• Cookies and Similar Technologies: used for analytics, personalization, and advertising (see our separate Cookie Policy).

This includes interaction data such as clicks, navigation patterns, session duration, and feature usage, which are used to analyze user behavior and improve platform performance and user experience.

Behavioral Tracking and Platform Usage: Tradoly tracks user interactions such as listing views, search queries, saved vehicles, clicks on listings, and communication attempts between users.

This data is used to:

• Improve matchmaking between buyers and sellers
• Rank and display relevant listings
• Detect fraudulent or abusive behavior

This AI-based ranking system under the recommendation engine uses Tradoly in-house built machine learning models to prioritise vehicle listings based on relevance, user preferences, price range, location proximity, and historical interaction behavior.

3.3. Information from Third Parties

We may receive limited information from:

• Payment processors (from Stripe, and / or PayProff) to confirm transaction status.
• Vehicle data partners for VIN or car history verification from CarsXE APIs.
• Advertising and analytics partners for campaign performance and personalization.
• Social login providers (Google or Facebook) when you sign in using those accounts, in such cases, Tradoly accesses only publicly available profile information necessary for identity verification and account creation. This may include data obtained from publicly available sources, business registers, or public authorities, where permitted by applicable law.

Third-Party Data Enrichment: Tradoly enhances vehicle listings using third-party data sources (CarsXE VIN decoding, vehicle history providers, ASG vehicle damage report providers) for vehicle history, mileage validation, and damage report enrichment.

4. PURPOSES AND LEGAL BASES OF PROCESSING

4.1 Legal Basis for Processing

Tradoly of Europe, SL processes personal data in accordance with the following legal bases under the General Data Protection Regulation (GDPR):

Article 6(1)(b) – Processing is necessary for the performance of a contract or to take steps prior to entering into a contract (e.g., account creation, facilitating transactions).

Article 6(1)(f) – Processing is necessary for the purposes of legitimate interests pursued by Tradoly, including platform improvement, fraud prevention, system security, and certain direct marketing activities, provided that such interests are not overridden by the rights and freedoms of users.

4.2 Legitimate Interest Assessment

Where processing is based on Article 6(1)(f) GDPR, Tradoly has conducted a balancing test to ensure that its legitimate interests (such as platform security, fraud prevention, service improvement, and limited direct marketing) are not overridden by the rights and freedoms of users. Users may object to such processing at any time (see Section 8).

5. DATA RETENTION PERIOD

We store personal data only as long as necessary for the purposes described above or as required by applicable law:

After expiry, data will be securely deleted or anonymized.

Additional Retention Logic Based on Platform Activity:

• Inactive Accounts: Accounts with no activity for 24 months may be flagged for deletion after prior notification.
• Listings: Listings may remain visible even after account inactivity unless actively deleted by the user.
• Messages: Messages between users may remain accessible to recipients even after account deletion, unless legally required to delete.

Users may request deletion at any time via account settings.

6. DATA SHARING AND DISCLOSURE

Tradoly of Europe, SL does not sell or rent personal data.

However, we may share data under the following conditions:

6.1. Service Providers

We share data with carefully selected third parties who help us operate our Services:

• Hosting and cloud providers (e.g., AWS, Google Cloud)
• Payment processors and banking partners
• Analytics and marketing platforms
• Customer support systems
• Security and anti-fraud tools

All providers act as Data Processors under strict contractual obligations (Art. 28 GDPR).

6.2. Legal and Regulatory Authorities

We may disclose data when legally required by courts, regulators, or public authorities to comply with applicable law.

6.3. Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred as part of the transaction — always under GDPR safeguards.

6.4 Platform-Based Data Sharing Between Users

As part of the marketplace functionality, personal data included in listings, profiles, and communications may be shared with other users.

This includes:

• Seller contact details (when interaction is initiated or accepted)
• Listing information and associated content
• Messages exchanged via the platform

Such sharing is necessary for the performance of the contract (Art. 6(1)(b) GDPR).

Tradoly does not control how other users process this data once shared.

7. INTERNATIONAL DATA TRANSFERS

If we transfer personal data outside the European Economic Area (EEA), we ensure that:

• The destination country has an adequacy decision by the European Commission, or
• The transfer is governed by Standard Contractual Clauses (SCCs) and other appropriate safeguards.

You can request a copy of these safeguards by contacting support@tradoly.com.

8. USER RIGHTS (DATA SUBJECT RIGHTS)

Under the GDPR and LOPDGDD, you have the following rights:

How to Exercise Your Rights:

Users can exercise their rights in the following ways:

• Via account Settings > Privacy (for access, deletion, and profile updates)
• By contacting support@tradoly.com

Requests will be processed within one month in accordance with GDPR requirements. Tradoly may request identity verification before fulfilling requests.

By adjusting Tradoly account settings (Settings > Privacy), the user chooses how their data is used for personalization, advertising, analytics, location-based services, communications, and sharing with third parties, in accordance with applicable data protection laws and the Privacy Policy. The user may also exercise their rights to access, correct, delete, restrict, or object to the processing of their personal data, and withdraw consent at any time through settings or by contacting support.

9. COOKIES AND TRACKING TECHNOLOGIES

Tradoly of Europe, SL uses cookies and similar technologies to:

• Enhance website functionality
• Measure site traffic and analytics
• Provide personalized recommendations
• Deliver relevant ads

You can manage cookie preferences via our Cookie Consent Banner or through browser settings at any time. A detailed explanation is available in our separate Cookie Policy.

10. SECURITY MEASURES

We apply appropriate technical and organizational measures to safeguard data against unauthorized access, alteration, loss, or disclosure, including:

• TLS/SSL encryption
• Firewalls and intrusion detection
• Role-based access control
• Regular penetration testing
• Secure password hashing
• Periodic data protection audits

While we maintain high security standards, no system can guarantee 100% protection. Users are advised to maintain strong passwords and safeguard login credentials.

Platform-Specific Security Measures:

• Monitoring of listings and user activity to detect fraudulent listings or scams
• Automated and manual moderation of content
• Rate limiting and abuse prevention mechanisms on messaging systems
• KYC/KYB verification for traders and dealers, identity verification checks, and business validation processes integrated with payment providers and compliance partners such as Stripe and PayProff

11. CHILDREN'S PRIVACY

Tradoly of Europe, SL's Services are intended for users aged 18 and above. We do not knowingly collect personal data from minors.

If a parent or guardian believes a child's data has been collected, contact us immediately at support@tradoly.com, and we will delete it promptly.

12. AUTOMATED DECISION-MAKING AND PROFILING

Tradoly uses profiling to:

• Recommend vehicles based on search behavior, filters, and previous interactions
• Rank listings in search results
• Personalize marketing content (where consent is given)

No automated decisions are made that produce legal or significant effects without human oversight (as per GDPR Art. 22).

Ranking factors include vehicle price competitiveness, listing completeness, geographic relevance, user search filters, dealer verification status, engagement metrics (views, clicks, saves), and recency of listing activity.

13. LINKS TO THIRD-PARTY WEBSITES

Our platform may contain links or integrations to third-party websites and services, including but not limited to dealer or trader websites, logistics providers (such as TransConnect or similar API-based transport services), vehicle history and report/inspection platforms (ASG service provider), and payment or escrow service providers (such as Stripe and PayProff).

Tradoly of Europe, SL is not responsible for the content, data protection practices, availability, security, or accuracy of these external websites or services.

When users are redirected to or interact with third-party services, they do so under the terms and privacy policies of those third parties, which may act as independent data controllers.

Users are strongly advised to review the applicable privacy policies and terms of service of any third-party provider before sharing personal data or completing transactions.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect operational, legal, or regulatory changes. The "Last Updated" date will always indicate the latest revision. Continued use of our Services after such updates constitutes acceptance of the new terms.

15. CONTACT INFORMATION

For any privacy-related queries, requests, or complaints, contact: