Privacy notice Dome Auctions B.V.

July 2025

1 Introduction

Dome Auctions B.V. offers an online auction platform where users can place bids, conclude sales agreements and complete transactions. The platform is primarily intended for business sellers and buyers. However, private individuals may occasionally make purchases, in which case the provisions of this policy apply to them as well.

If you register for an account, participate in auctions, or use our platform in any way, we need your personal data (hereinafter: data) to provide our services.

We treat your data with care and keep it secure. What we do with your data and why we need it is explained in this privacy policy. If you have any questions or complaints after read-ing our privacy policy, please feel free to contact us.

2 Who is responsible for processing your data?

The data controller responsible for processing your data for your use of our services is:

• Dome Auctions B.V. (hereafter: Dome Auctions)
• Rokin 92–96
• 1012 KZ Amsterdam
• The Netherlands
• E-mail: privacy@dome-auctions.com

When this privacy policy refers to 'Dome Auctions', 'we', 'us' or 'our', Dome Auctions refers to the data controller who decides on the purposes and means of processing your data.

All data collected through Dome Auctions' platforms or domains, such as www.dome-auctions.com (hereinafter collectively in singular: platform), fall within the scope of this pri-vacy policy.

3 When does this privacy policy apply?

This privacy policy applies to you if you:

• a. Register for an account or use our online auction platform
• b. Place bids, buy or sell items, or complete other transactions
• c. Subscribe to our newsletter, marketing communications or platform updates
• d. Contact Dome Auctions with a question, complaint or support request
• e. Use our playtform or digital services
• f. Interact with our platform via cookies, device fingerprinting or similar tracking technologies
• g. Exchange communications with Dome Auctions relating to your account or transactions
• h. Contact Dome Auctions in any other way in the context of using our platform or services

4 What data do we process from you?

When you use our platform or services, we process the necessary data from you.

• i. When creating an account or placing bids, you must provide the following details: full name, e-mail address, phone number, and password. Additional data such as shipping address or tax details may also be required depending on the transaction
• j. If you ask questions to one of our employees or otherwise contact us about, for example, a transaction or dispute, we process the data you provide, such as your name and contact details. This data is only used to answer your questions and requests

We receive your data directly from you when you register or contact us. We also process automatically generated information from you. You can think of IP address, device or user ID, system and browser type, date and time stamps, referring website address and content and pages you have visited on our platform. We use cookies and similar techniques for this purpose. See below under section 5.

By themselves, not all the data we process from you is 'personal data', but when combined with other information, it may be considered as such.

5 Does Dome Auctions use cookies?

Yes, we use cookies and similar technologies on our platform (hereinafter collectively referred to as cookies). Through cookies, Dome Auctions automatically obtains data when you visit our platform. You can read our Cookie Statement on the platform for more information.

6 For what purposes and legal bases do we process your data?

Dome Auctions processes your data only for specified, explicit and legitimate purposes and on the basis of the bases described below:

Platform usage

We need your data to enable you to create an account, place bids, complete transactions, and receive or sell goods via the platform. This includes communication about auctions, bid confirmations, shipping, and any disputes. The legal basis for processing data for these purposes is ‘performance of the contract’.

Payment processing and compliance

We process payment data to complete financial transactions. We also process data to comply with legal obligations (e.g., tax and anti-fraud regulations). The legal basis for this processing is ‘compliance with legal obligations’.

Fraud prevention and misuse detection

We process user data, login data, IP addresses, and behavioural patterns to detect and prevent fraud or abuse of our services. The legal basis for processing data for this purpose is ‘legitimate interest’.

Marketing and communication

If you consent, we may use your data to send you newsletters or promotional messages based on our legitimate interest in promoting the platform. You may withdraw this consent at any time.

Platform analysis

We analyse the use of our platform in order to improve it. The legal basis for processing data for this purpose is legitimate interest.

Other purposes

When appropriate or required, and for specific purposes about which we will inform you in advance, we will ask for your consent.

> For further explanation of the bases, please refer to section 14.

7 With whom will your data be shared?

Dome Auctions will not share your data except in the following situations:

• k. With Dome Auctions affiliated companies, operational groups, subsidiaries, branches and/or third parties if this is necessary for the purposes described above. Insofar as third parties are themselves responsible, they are obliged to comply with privacy laws and regulations themselves. In such cases, their privacy statements or policies apply. If applicable, Dome Auctions will require third parties to carry out processing operations in accordance with Dome Auctions' data protection policy and guidelines
• l. With data processors, i.e. parties who process your data on behalf of Dome Auctions. You can think of IT service providers for storage of your data in the context of your account or transaction. These third parties may only use your data for specific purposes and in accordance with Dome Auctions' instructions. Dome Auctions only engages data processors who guarantee that appropriate technical and organisational measures are in place and the rights of data subjects are protected
• m. With our employees if and to the extent necessary for the performance of their duties in the context of the services provided. In such a case, access will be granted to the extent necessary for their work and only if the employee is bound by a duty of confidentiality
• n. If and to the extent required by law, a court order or other legal process, for example with regulators, judicial authorities or other competent public authorities to establish and/or exercise Dome Auctions' rights
• o. In connection with a business transaction, such as a demerger, merger, consolidation or sale of assets or in case of bankruptcy

8 Where does Dome Auctions store your data?

The nature of our business means that in some cases your data will be transferred to recipients in countries outside the European Economic Area (EEA). The main rule is that this is only permitted if a country provides an adequate level of protection. If there is no adequate level of protection in a country outside the EEA, we will provide appropriate safeguards so that the data is protected to the fullest extent possible. An example of this is the use of model contracts approved by the European Commission.

Regarding data exchange with the United States, we will seek to do business with companies certified under the EU-US Data Privacy Framework. This is an agreement that governs the protection of EU citizens' data processed in the United States. The European Commission has approved this agreement. US companies can submit their certification to the US Chamber of Commerce. If the certification is approved, we are allowed to exchange data with the relevant company in the United States. If this is not possible, we fall back on entering into the model contracts mentioned above.

If there are also no appropriate safeguards in a country outside the EEA, we will only transfer data if there is a legal exception. Examples include explicit consent or if the processing is necessary for the performance of the contract.

9 How long does Dome Auctions keep your data?

We will not retain your data for longer than necessary for the purpose for which we process your data. After the retention period, we will delete or anonymise your data, unless we need to keep certain data for another purpose. We will only do this if we have a legal basis to keep your data (longer). We will also ensure that the data is only accessible for that other purpose.

Some examples:

• p. You are a registered user of the platform: account data will be retained for up to 7 years after your last activity, in line with tax and civil law obligations
• q. You contact customer service without having an account: communication records will be retained for 2 years after your last message

10 How will your data be secured?

Dome Auctions has taken appropriate technical and organisational measures to protect your data against accidental or unlawful processing, including measures under which:

• r. Your data is protected against unauthorised access
• s. Your data will remain confidential
• t. Maintain the integrity and availability of your data
• u. Relevant personnel are trained in information security requirements

For instance, we secure our systems and applications according to the applicable information security standards, such as Control Objectives for Information and related Technology and the Standard of Good Practice for Information Security (ISF). We also conduct an annual penetration test based on the top 10 risks of the Open Web Application Security Project. This top 10 comprises the most common and critical security risks for web applications.

Should we become aware of a data breach, we will report the data breach in accordance with applicable laws and regulations.

11 What rights can you exercise in relation to your data?

Based on applicable laws and regulations in the EEA, you have rights that you can exercise in relation to your data. Sometimes we are not obliged to (fully) comply with your request because certain rights are conditional, we need to balance your rights against our rights and obligations to process your data and/or to protect rights and freedoms of others. Some of the rights you have in relation to your data are explained below.

Right of information

You have the right to obtain a copy of the data we process about you and information about how we use it. Your data will usually be provided to you digitally. We may require you to identify yourself before we provide the required information.

Right of rectification

We aim to ensure that the data we hold on you is accurate and complete. However, if you believe that this is not the case, you have the right to ask us to amend incomplete or incorrect data.

Right of deletion (right to be forgotten)

You can ask us to delete your data, for example if the data we have collected is no longer needed for its original purpose, if your data is no longer current or if you withdraw your consent. However, this must be balanced against other factors. For example, we do not have to comply with your request due to certain legal obligations.

Right to restriction of processing

You have the right to ask us not to process your data (temporarily), for example if you suspect that the data we hold is incorrect or if you think it is no longer necessary to process your data.

Right to data portability

You have the right to request us to transfer your data to any third party you specify. This right can only be exercised when you have provided the data to us yourself, and when we process that data automatically on the basis of your consent, or to fulfil our obligations under a contract with you.

Right of objection

You have the right to object to processing based on legitimate interest. We will no longer process your data if you submit an objection relating to your specific situation, unless we have a compelling legitimate interest to continue processing anyway.

Rights in relation to automated decision-making

You have the right not to be subject to automated decision-making, including profiling, that produces legal effects or similar significant consequences for you. At present, we are not subject to automated decision-making. However, should you be subject to automated decision-making in the future and disagree with the outcome, you can contact us and request that the decision be reconsidered.

Right to withdraw consent

We may ask for your consent to process your data in specific cases. When we do so, you have the right to withdraw your consent at any time. Dome Auctions will stop processing as soon as possible after withdrawing your consent. However, this does not affect the lawfulness of the processing during the period before the withdrawal of your consent.

12 Children’s Privacy

We do not knowingly collect data from children under the age of 18 without parental or guardian consent. However, it is not always possible for us to determine the age of a platform visitor. If you believe that we have collected data from a minor without consent, please contact us immediately so we can investigate and take appropriate action.

13 What if I have other questions or complaints?

If you have any (other) questions or complaints about this privacy policy or Dome Auctions' use of your data, please contact us. We will deal with your question or complaint as soon as possible and inform you of the results of our investigation. If you feel that we have not dealt with a complaint to your satisfaction, you may contact the data protection supervisory authority in your jurisdiction. In the Netherlands, this is the Personal Data Authority.

14 Changes

We may amend this privacy policy from time to time as new developments warrant. The most up-to-date privacy policy can be found on our platform. We advise you to consult the privacy policy regularly so that you are aware of any changes.

15 Glossary

The following are explanations of some terms used in this statement without an initial capital letter (unless otherwise stated). The singular form, plural form and conjugations of each term may be used interchangeably in the statement.

Anonymise

This is an irreversible process to ensure that data is no longer traceable to data subjects. 'Data subjects' are natural persons (individuals) whose data are processed.

Cookies

Cookies are small text files that a server sends to a browser when you visit our platform. For example, cookies remember the data you enter for your next visit, so that the content of the services can be tailored to you and there is no need to re-enter data. In addition to cookies, Dome Auctions may use 'similar techniques', such as JavaScripts, tracking pixels and web beacons. These are techniques enable a system to collect, store and then send information. In this policy, cookies and similar techniques are collectively referred to as 'cookies'.

Data breach

A data breach is a security breach that results in accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to processed data. This can happen through hacking or loss of documents, for example. A data breach can range from the accidental disclosure of your name and contact information to the unwanted exposure of more sensitive data, such as financial information.

Data

'Personal data' is any information directly or indirectly traceable to you as an individual. Examples include name, address, place of residence, e-mail address, a passport photo, telephone number, cookie IDs, tracking, commercial and financial data. Your curriculum vitae also contains personal data. In this policy, personal data is referred to as 'data.'

Legal basis

In order to lawfully process data about you, Dome Auctions needs a legal basis. This is the basis provided by law for processing your data. The bases most relevant to us are discussed below:

• a. Performance of the agreement. Data processing is necessary to take measures at your request before the conclusion of a contract or for the performance of any contract between you and Dome Auctions, such as an employment contract. The foregoing refers to the relationship you enter into with Dome Auctions in the context of an application procedure or the fact that we store your data so that we can keep you informed of interesting vacancies.
• b. Complying with legal obligations. Data processing is necessary to comply with legal obligations incumbent on Dome Auctions. These include obligations towards the tax authorities.
• c. Legitimate interest. Data processing is necessary for the legitimate interests of Dome Auctions or a third party, unless your interests, fundamental rights and freedoms outweigh our interests. To invoke this basis, we will first determine whether there are legitimate interests. You can think of processing that falls within our normal business operations or the day-to-day management of Dome Auctions. Then we will ask ourselves whether we can achieve the same result with less data or by a less intrusive way. Dome Auctions will also carry out a balancing test. This means that we weigh your interests and rights against ours. If we come to the conclusion that our interests outweigh yours, we will invoke this basis.
• d. Consent. In specific cases, we will ask for your consent. Consent is any free, specific, informed and unambiguous expression of will by which you accept data processing by means of a statement or unambiguous active action.

Data controller

Organisation that determines purpose and means for processing data. For example, Dome Auctions is a data controller for processing data for marketing purposes. Applicable legislation also refers to 'data controller'.

Processing

(A set of) operations involving (a set of) data, whether or not automated. Examples include collecting, recording, organising, storing, modifying, retrieving, viewing, sharing, consulting, using, providing and deleting data.

Data processor

Organisation that processes data on behalf of the data controller.

Deletion

Erasing data so that the data cannot be retrieved either directly or indirectly.

© 2025 Dome Auctions B.V.