Privacy Policy for the “Trade” Platform

This Privacy Policy explains how we process personal data when you use our AI-powered online marketplace platform “Trade” (web and app).

“Personal data” means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

2.1 Visiting the Platform (without registration)

When you use our platform purely for information purposes, we automatically collect the following data:

• IP address
• date and time of the request
• time zone difference to GMT
• content of the request (specific page)
• access status/HTTP status code
• amount of data transferred
• website from which the request originates (referrer)
• browser type, operating system, language and version of the browser software
• where applicable, app-specific device information (device ID, operating system, app version).

Purposes:

• provision of the platform and ensuring its technical functionality
• ensuring IT security (e.g. defending against attacks, detecting misuse)
• statistical analysis to improve our offering (in aggregated form).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable provision and improvement of our online services).

2.2 Registration and User Account

When you create a user account (buyer, seller, brand/advertiser), we process:

• master data (name, company name if applicable, legal form, address, country)
• contact details (email address, telephone number)
• login data (username, password in hashed form)
• role and profile data (e.g. vendor, buyer, advertiser, language settings, time zone)
• where applicable, evidence of business status (e.g. commercial register extract, VAT ID).

Purposes:

• creation and management of the user account
• authentication and access control
• communication with you in the context of the contractual relationship (e.g. service emails, security information).

Legal bases:

• Art. 6(1)(b) GDPR (performance of a contract/user agreement)
• Art. 6(1)(f) GDPR (legitimate interest in secure account management and prevention of misuse).

2.3 Use of Marketplace Functions

When you use the marketplace functions, we process:

• information about offers/products, seller profiles
• order and transaction data (e.g. shopping cart, prices, fees, time of transaction, status)
• communication data between users (e.g. messages, chat histories)
• ratings, feedback and user reports (e.g. reports of violations).

Purposes:

• execution of transactions between buyers and sellers
• invoicing of fees and commissions
• quality assurance and prevention of misuse (e.g. monitoring of unusual activities).

Legal bases:

• Art. 6(1)(b) GDPR (performance of a contract)
• Art. 6(1)(f) GDPR (legitimate interest in the secure and fair operation of the marketplace).

2.4 Payment Processing, E-Wallet and Cryptocurrencies

For payment processing and the use of an e-wallet as well as any crypto-related functions, we work with external, regulated payment service providers. Depending on the payment method, the following data may be transmitted to them:

• identification data (name, company name if applicable, address)
• payment data (e.g. bank details, credit card data – usually processed only by the payment provider)
• transaction data (amount, currency, time, transaction ID, purpose of payment)
• KYC/AML data (e.g. copies of ID documents, beneficial owners), where required by law.

Purposes:

• processing payments between buyers, sellers and HNAI TRADE
• managing balances within an e-wallet
• fulfilling statutory obligations in the areas of anti-money laundering, financial supervision and taxation.

Legal bases:

• Art. 6(1)(b) GDPR (performance of the payment relationship)
• Art. 6(1)(c) GDPR (compliance with legal obligations, e.g. under anti-money laundering and supervisory law)
• Art. 6(1)(f) GDPR (legitimate interest in secure payment processing and fraud prevention).

Payment service providers process personal data in their own responsibility. Please refer to the privacy notices of the respective providers for further information.

2.5 Live Communication, Streams and AI Functions

When you use chat, audio and video functions, live streams as well as AI-based matching and translation, we process:

• communication content (e.g. chat messages, metadata of audio/video sessions, where applicable stream content)
• usage data (e.g. duration of a session, interactions, reactions)
• for AI functions: texts/requests you enter and, if applicable, voice or other content transmitted to technical service providers for the provision of the function.

Purposes:

• provision of real-time communication and live streaming
• AI-supported features (e.g. translation, matching of supply and demand, fraud detection, moderation/content filtering)
• moderation and enforcement of community standards, prevention of abusive or unlawful content.

Legal bases:

• Art. 6(1)(b) GDPR (provision of the contractual features)
• Art. 6(1)(f) GDPR (legitimate interest in a secure, abuse-free platform and moderated content)
• where applicable, Art. 6(1)(a) GDPR (consent), insofar as specific AI functions go beyond what is necessary for operating the platform.

If content is recorded (e.g. for abuse prevention or to improve our services), we will clearly indicate this and limit the storage period.

2.6 Marketing, Newsletters, Product Information

If you have given your consent, we use your email address to send you information about new features, offers and promotions regarding “Trade”.

Legal basis: Art. 6(1)(a) GDPR (consent) or, for existing customers within the narrow scope of Section 7 of the German Unfair Competition Act (UWG), Art. 6(1)(f) GDPR.

You may withdraw your consent at any time with effect for the future, e.g. via an unsubscribe link in every email or by contacting us.

2.7 Log Data, Fraud Prevention and Legal Obligations

We may analyse log data and certain usage patterns in order to:

• detect and fix technical errors
• investigate security incidents
• detect and prevent fraud, money laundering and other unlawful activities
• provide information to authorities where we are legally obliged to do so.

Legal bases:

• Art. 6(1)(c) GDPR (legal obligations)
• Art. 6(1)(f) GDPR (legitimate interest in securing our service and enforcing our rights).

We use cookies and similar technologies (e.g. local storage, SDKs in the app) on the platform.

• Technically necessary cookies are used for functions such as login, session management and security. Legal basis: Art. 6(1)(f) GDPR.
• Optional cookies/tools (analytics, marketing) are used only with your consent, where implemented.

Legal basis: Art. 6(1)(a) GDPR.

Details on the tools used (e.g. web analytics, crash reporting, performance monitoring) and how they work are provided in a separate cookie/tool banner or overview on the platform. There you can also manage your consent settings.

We only share personal data where this is permitted, in particular:

• with payment service providers for processing payments and KYC/AML checks
• with hosting and infrastructure providers for providing servers, databases, security and content delivery functions
• with communication and streaming providers for real-time communication and live video
• with AI and analytics providers for matching, translation, fraud detection and moderation (where technically necessary and legally permissible)
• with logistics or fulfilment providers where required to process orders (usually via the seller)
• with legal advisors, courts and authorities where there is a legal basis (e.g. disputes, requests for information).

We conclude data processing agreements pursuant to Art. 28 GDPR with processors. They process personal data exclusively on our instructions.

Where service providers or recipients are located outside the European Union (EU) or the European Economic Area (EEA), we ensure – unless there is an adequacy decision by the European Commission – that appropriate safeguards within the meaning of Art. 44 et seq. GDPR are in place (e.g. EU Standard Contractual Clauses, supplementary protective measures). We will provide information on this upon request.

We store personal data only for as long as necessary for the respective purposes. Afterwards, the data is deleted or anonymised, unless statutory retention obligations require longer storage (e.g. commercial or tax law retention periods of up to 10 years).

• Account data: for the duration of the contractual relationship; after termination, for the period required by law and for asserting or defending claims (usually up to 3 years after the end of the year in which the relationship ended).
• Contract and payment data: in accordance with commercial and tax law requirements (typically 6–10 years).
• Log data: generally for a few weeks to months, as far as necessary for security and error analysis.
• Communication and streaming data: only as long as necessary for the respective purpose (e.g. handling a case, moderation, legal enforcement).

With regard to your personal data, you have the following rights (Art. 15–21 GDPR):

• right of access to the personal data we process
• right to rectification of inaccurate data and completion of incomplete data
• right to erasure where no retention obligations or other legal reasons oppose this
• right to restriction of processing
• right to data portability, where the legal requirements are met
• right to object to processing based on Art. 6(1)(e) or (f) GDPR on grounds relating to your particular situation
• right to withdraw consent with effect for the future.

To exercise your rights, you can contact us at any time; see the contact details under “Controller”.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Providing certain data (e.g. registration data, payment information, KYC data) is necessary for using our platform and for carrying out transactions. Without this data, we cannot provide certain features or can only provide them to a limited extent.

We use AI-based functions on the platform (e.g. matching, translation, fraud detection). These serve to improve the user experience and increase security. As a rule, we do not use solely automated decision-making with legal or similarly significant effects on you within the meaning of Art. 22 GDPR. Should such a fully automated decision be envisaged in an individual case, we will inform you separately and ensure the statutory options for contesting the decision and obtaining human review.

We may amend this Privacy Policy from time to time, for example in the event of changes in the law or our services. The current version is always available on our platform.