1. Introduction

Welcome to Auction Ace ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this privacy notice, or our practices with regards to your personal information, please contact us at info@auction-ace.com.

This privacy policy applies to all information collected through our application (Auction Ace), and/or any related services, sales, marketing or events.

2. Age Requirement

Auction Ace is intended for users who are 16 years of age or older. In accordance with GDPR Article 8, we do not knowingly collect personal data from individuals under 16 without verifiable parental consent.

During account setup we ask every user for a date of birth to verify they meet this requirement, and an account cannot be created by someone under 16. If a parent or guardian wishes to request an account on behalf of a minor, please contact us at info@auction-ace.com.

You must be 18 or older to purchase auction credits, because a contract with a minor is not enforceable. Where we hold a date of birth showing you are under 18, we will decline the purchase; a parent or guardian may buy on your behalf.

If we become aware that we have inadvertently collected personal data from a child under 16 without appropriate consent, we will delete that data promptly.

3. Information We Collect

We collect personal information that you voluntarily provide to us when you register on the application. This includes:

• Personal Info: Name, Email address, Date of Birth (for age verification), and Profile Picture (via Google Sign-In).
• App Activity: Auction history, bidding logs, and team/player management data.
• Device Info: Device tokens for Push Notifications (via Firebase Cloud Messaging).

4. How We Use Your Information, and Our Legal Basis

Article 6 of the GDPR requires us to have a lawful basis for each purpose we use your data for. Ours are set out below.

5. Third-Party Data Processors

We act as the data controller and engage the following sub-processors to operate our application. Each processor has an applicable Data Processing Agreement (DPA) in place with us. By using Auction Ace, you acknowledge that your data may be processed by these parties in accordance with their own privacy terms:

For data transfers outside the EEA, these processors rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms approved by the European Commission.

6. Other Recipients and Third-Party Sources

Separately from the processors above, the Application exchanges data with the following services. These act independently of us rather than solely on our instructions, and their own privacy terms govern what they do with the data.

Where we share data

Where we retrieve data

Auction organisers can look up publicly available player statistics from the services below. When a lookup is performed we send the search term or player identifier and receive publicly published profile information in return, which may include a player name, profile image, and performance statistics.

If you are a player whose statistics were looked up: we obtained that information from the source named above rather than from you directly, at the request of the organiser running your auction. You have the same rights over it as over any other personal data we hold — see section 11 — and you can ask us to remove it by emailing info@auction-ace.com.

7. Account Deletion

You have the right to request the deletion of your account and all associated data at any time.

You can initiate this process directly within the application:

1. Navigate to your Profile.
2. Select Delete Account.
3. Confirm the action to permanently remove your personal data from our systems.

Alternatively, you may email info@auction-ace.com to request data deletion. Upon deletion, all your personal identifiable information (PII) will be removed, though non-identifiable auction logs may be retained for system integrity.

8. Device Permissions

The app may request access to certain device features:

• Notifications: To send alerts about auction activity.
• Camera/Storage: To upload profile pictures or team logos.

9. Data Retention

We keep personal data only as long as we need it for the purpose it was collected for. In practice that means:

• Account data (name, email, date of birth, profile picture) — for as long as your account is open. Deleted when you delete your account.
• Auction, team, and bidding data — for as long as the owning account is open, so that organisers and participants retain their tournament records. Deleted when the owning account is deleted.
• Push notification tokens — until you disable notifications, uninstall the app, or delete your account.
• Payment and transaction records — retained for 6 years after the transaction, because Irish tax and company law requires us to keep accounting records for that period. This applies even after you delete your account, and is limited to what the law requires.
• Security and audit logs — up to 12 months, after which they are deleted automatically.
• Support and feedback correspondence — up to 24 months after the matter is closed.
• Analytics data — retained by Google Analytics under its own retention settings, and only where you consented.

Where we are required to keep data after you close your account, we keep the minimum necessary and do not use it for any other purpose. Some non-identifying auction records may be retained so that other participants' tournament history remains intact; where possible we remove or anonymise your identifying details in those records.

10. Security

We have implemented appropriate technical and organizational security measures via Google Cloud Platform to protect your personal information. However, please remember that no transmission over the internet is 100% secure.

11. Your Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data ("right to be forgotten").
• Right to Data Portability: Download your data in a structured, machine-readable format directly from your Profile page.
• Right to Restrict Processing: Request that we limit how we use your data.
• Right to Object: Object to processing of your personal data in certain circumstances.
• Right to Lodge a Complaint: Complain to a data protection supervisory authority if you believe we have not handled your personal data lawfully.

To exercise any of these rights, email us at info@auction-ace.com. We will respond within one month, as required by Article 12(3) GDPR.

You do not have to come to us first. Auction Ace is established in Ireland, so our lead supervisory authority is the Data Protection Commission (DPC), and you may complain to them directly at dataprotection.ie. If you live in another EEA country, you may instead complain to your own national data protection authority, or to the Information Commissioner's Office if you are in the UK.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:

• Notify our lead supervisory authority, the Irish Data Protection Commission, within 72 hours of becoming aware of the breach, where feasible.
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.
• Document all breaches internally, including those that do not require notification, in accordance with Article 33(5) GDPR.

Notifications to affected users will be sent to the email address associated with your Auction Ace account. To ensure you receive important security notices, please keep your account email up to date.

If you believe your personal data has been compromised, please contact us immediately at info@auction-ace.com with the subject line "Security Incident".

13. Updates To This Notice

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible.

14. Contact Us

The data controller responsible for your personal data is:

For GDPR subject access requests, data portability requests, or erasure requests please include "GDPR Request" in the subject line of your email. You also have the right to complain directly to the Irish Data Protection Commission — see section 11.