This Privacy Policy describes how Gatsby's Auction (ABN 36 829 082 232) — operating under the registered business name 'Gatsby's Auction' ("we", "us", "our") — collects, uses, stores, and discloses personal information. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For users in the European Union, United Kingdom or European Economic Area we additionally treat ourselves as a "controller" under the EU/UK General Data Protection Regulation (GDPR) and afford you the rights described in section 11. By creating an account, using our digital platforms, registering to bid, or lodging items for auction, you consent to our collection and use of your personal information as described in this policy.

We collect the personal information you provide to us when you: • Create an account: First name, surname, email address, password (stored as a salted hash by Firebase Authentication), and your date of birth (used to verify you are 15 or older — see "Why we ask for date of birth" in section 12). • Complete your profile: Phone number and residential or postal address. • Register to bid: Identification details, payment method information (PayID, bank transfer details, or stored Stripe payment method). • Lodge items for consignment: Details about the items, photographs, and your bank account details for settlement (encrypted at rest using AES-256-GCM). • Submit a help or support request: Your message and contact details. • Sign in with Google: Basic profile information provided by Google (name, email address, profile photo). We may also collect the following information automatically: • Bidding activity and auction participation history. • Items added to your watchlist and items you have viewed. • Login timestamps and session information. • Browser type, device information, and IP address (for security and fraud prevention).

We use your personal information to: • Create and manage your account and verify your identity (including the 15+ age check at registration, and an 18+ check before any age-restricted lot can be bid on). • Process bids and facilitate auction transactions, including off-session card charges via Stripe for winning bids. • Communicate with you regarding your bids, purchases, consignments, and account. • Send your tax invoice, dispatch notes, and settlement remittances. • Calculate and apply loyalty tier benefits. • Respond to your support and enquiry requests. • Send marketing and promotional communications about upcoming auctions and new arrivals — only where you have opted in. You can opt out at any time via the unsubscribe link in any marketing email or from your profile. • Notify consignors of their consignment status and approval decisions. • Comply with our legal obligations, including under the Auction Sales Act 1973 (WA), the Australian Consumer Law, and taxation law (which generally requires 7 years of financial-record retention). • Detect, investigate, and prevent fraudulent or illegal activity. For users in the EU/UK, our lawful bases under GDPR Article 6 are: contract (account, bidding, settlement), legal obligation (tax, auction-act records), consent (marketing email, optional cookies — see section 10), and legitimate interests (fraud prevention, service improvement, secure operation of the platform).

4.1 Where you have opted in, we may send you "update emails" — email communications about upcoming auctions, new lot arrivals, special events, and other news from Gatsby's. Marketing is opt-in only: new accounts are NOT subscribed by default, and you can choose to receive update emails at any time from the My Details section of your account profile. 4.2 You can unsubscribe from marketing communications at any time by clicking the "unsubscribe" link in any marketing email, by toggling marketing off in your account profile, or by contacting us at admin@gatsbysauction.com. 4.3 Even if you unsubscribe from marketing communications, we will continue to send you transactional emails relating to your account, bids, and purchases.

We do not sell, rent, or trade your personal information to third parties. We disclose personal information only to (a) the sub-processors listed in section 6 — third-party service providers who operate parts of our platform under contract; (b) regulators and law enforcement where required to do so by law, court order, or government authority; and (c) a successor in the event of a business sale or merger, subject to equivalent privacy protections. Each sub-processor is contractually bound to protect your information, to process it only on our instructions, and to maintain security standards at least equivalent to ours.

7.1 We store your personal information using Google Cloud (Firestore, Firebase Storage, Firebase Authentication), secured with industry-standard encryption in transit (TLS 1.2+) and at rest. Bookshop module data is held in a PostgreSQL database hosted by Replit, Inc. 7.2 Bank account details provided by consignors are encrypted using AES-256-GCM with a key held only on our server. Decryption is performed only when required for settlement. 7.3 Stripe stores card numbers; we never see or store the PAN. We hold only Stripe's customer/payment-method identifiers, which let us charge winning bids off-session. 7.4 Passwords are never stored by us. Authentication is managed by Firebase Authentication, which stores credentials securely using industry-standard hashing (scrypt). 7.5 Access to personal information within our systems is restricted to authorised personnel on a need-to-know basis. 7.6 While we take all reasonable steps to protect your personal information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security. 7.7 In the event of a data breach that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. For EU/UK affected individuals, we will additionally notify the relevant supervisory authority within 72 hours where GDPR requires.

We retain personal information for as long as necessary to provide our services and meet legal obligations. • Active accounts: retained for the life of your account. • Financial / auction records (invoices, settlements, sale registers): retained for 7 years after the relevant tax year, as required by Australian tax and auction-sales legislation. • Inactive accounts with no purchase or sales history: flagged for review after 3 years of no sign-in. We will email you before any deletion to give you the chance to keep the account active. • Deleted accounts: when you delete your account, we de-identify your record (replacing your name, email, phone and address with archived placeholders) where we are required to keep the underlying transaction history. Where there is no such requirement, we delete the record and you are removed from Firebase Authentication. • Soft-deleted records past their legal retention window are hard-deleted automatically by our retention scan. You can delete your account yourself at any time from the "My Details" tab in your profile, or by emailing admin@gatsbysauction.com.

9.1 You have the right to access the personal information we hold about you, and to request that inaccurate or incomplete information be corrected. 9.2 You may update your name, phone number, and address directly within your account profile at any time. 9.3 You may download a machine-readable copy of all personal information we hold about you at any time using the "Download my data" button on the My Details tab in your profile, or by emailing admin@gatsbysauction.com. 9.4 You may delete your account at any time using the "Delete my account" button on the My Details tab, or by emailing admin@gatsbysauction.com. Where we are required by law to retain certain records (e.g. tax invoices), we will de-identify your personal data instead. 9.5 We may decline access in certain circumstances permitted by the Privacy Act 1988 (Cth), including where access would pose a risk to the privacy of another individual. 9.6 We will respond to access, correction, deletion and data-portability requests within 30 days.

10.1 Our platforms use a small number of browser cookies and localStorage items to: • Maintain your sign-in session (Firebase Authentication). • Remember your preferences (dark/light mode, large-print accessibility setting). • Hold your watchlist and recently-viewed lots. • Show or hide the cookie consent banner once you have made a choice. 10.2 We do not currently use third-party advertising cookies, cross-site tracking technologies, or analytics that profile individual users. If we ever introduce them, we will ask for your consent through the cookie banner before they are loaded. 10.3 You can choose "Essential Only" in our cookie banner to decline non-essential storage; the strictly necessary items (sign-in, anti-CSRF, your consent choice itself) cannot be disabled because the site cannot function without them. You can also configure your browser to refuse cookies, but this may affect functionality.

If you are located in the EU, UK or EEA, in addition to the access, correction and deletion rights described in section 9 you have the right to: • Restrict or object to processing in certain circumstances. • Withdraw consent at any time, where consent is the lawful basis (e.g. marketing email, optional cookies). • Data portability — receive a structured, commonly-used, machine-readable copy of your data (offered as JSON via the "Download my data" button). • Lodge a complaint with your local supervisory authority. If you are not satisfied with our response, you may also complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. Where personal data is transferred outside the EU/UK we rely on the safeguards listed in section 6 (DPF certifications, SCCs, or adequacy decisions).

Auction lots may include items that are restricted to adults under Australian law — alcohol, tobacco-era collectables, certain firearms-act items, and some adult literature. Our minimum age to register an account is 15. Your date of birth is used to confirm you meet that minimum age, and to flag bidders under 18 when an age-restricted lot is being sold (so the lot is only delivered to or collected by a parent, guardian or other adult). It is not displayed to other users, never shared with third parties for marketing, and never used to profile you. It is included in your downloadable data export and is removed when you delete your account (section 9).

Our minimum sign-up age is 15. We do not knowingly collect personal information from anyone younger; account registration enforces this age gate (see section 12). Bidders aged 15–17 may register and bid on age-appropriate lots, but bids on lots restricted to adults under Australian law (alcohol, certain tobacco-era collectables, firearms-act items, etc.) require an adult parent or guardian to take delivery. If you believe we have inadvertently collected information from a child under 15, please contact us immediately at admin@gatsbysauction.com and we will delete it.

If you have a complaint about how we have handled your personal information, please contact us in the first instance at admin@gatsbysauction.com. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au, or with your local EU/UK supervisory authority if you are based in those regions.

For privacy-related enquiries, including access, correction, deletion, data-portability requests, or to exercise any GDPR right, please contact: Gatsby's Auction Email: admin@gatsbysauction.com Website: www.gatsbysauction.com