WEBSITE PRIVACY POLICY

Last Updated: August 10, 2026

This Website Privacy Policy explains how Global Card Auctions, LLC (“GCA,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information in connection with our website, marketplace, auctions, accounts, listings, consignments, purchases, bids, payments, examinations, buyer acceptance, shipping, storage, authentication, communications, and related services (the “Services”).

This Policy applies to website visitors, account holders, buyers, bidders, sellers, consignors, owners, agents, prospective customers, and other individuals who interact with GCA. Third-party payment processors, auction platforms, identity-verification providers, Marketplace Examination providers, carriers, insurers, storage providers, grading or authentication companies, financing or advance providers, and social-media services may process information under their own privacy policies.

1. Personal Information We Collect

• Identifiers and contact information: name, username, account number, address, email, telephone number, signature, and similar identifiers.
• Identity and eligibility information: age or date-of-birth confirmation, government identification information or images, address verification, beneficial-ownership information, and authority to act for a business, trust, estate, owner, or other person.
• Account and security information: credentials, multifactor-authentication information, security events, account preferences, and status.
• Commercial and transaction information: browsing, searches, watchlists, listings, offers, bids, purchases, consignments, invoices, Seller-selected or GCA-required payment methods, changes to payment-method selections, Seller-selected and GCA- or processor-imposed payment limits, method-specific risk acknowledgments, payments, payouts, payout eligibility, payout holds and reserves, connected-account transfers, application-fee allocations, transfer reversals, Marketplace Examination status and results, Buyer Acceptance, rejection and deemed-acceptance records and timestamps, refunds, returns, claims, chargebacks, ACH or bank-debit returns, unauthorized-debit claims, dispute and risk-allocation decisions, negative balances, dispute evidence, collection activity, shipping selections, storage requests, public sale results, and transaction history.
• Payment, financing or advance, tax, and banking information: billing address, tokenized payment data, last four digits, card-security-code and address-verification results, payment-authentication and risk signals, payment and payout method information, connected-account identifiers and status, masked bank information, bank-debit or payment authorizations, wire-payment status, transaction and settlement status, payout timing, processor reserves, refunds, reversals, chargebacks, dispute fees, negative balances, collection status, auction trust-account settlement records, resale certificates, W-9/W-8 status, tax IDs, and, where GCA offers a consignment advance or early payment, information reasonably necessary to evaluate, document, fund, service, secure, repay, or recover that advance or early payment.
• Property information: descriptions, images, videos, certification and serial numbers, grade, condition, provenance, title, reserve, declared value, custody and chain-of-custody records, examination and authentication reports, packaging and tamper-control records, and insurance information.
• Internet, device, and usage information: IP address, browser, operating system, device identifiers, cookie identifiers, referring pages, pages viewed, clicks, session and bid logs, and approximate location derived from IP.
• Communications and support information: emails, platform messages, message content and metadata, telephone-call information and recordings where used, support requests, survey responses, reviews, dispute correspondence, and other communications.
• Public content and market information: seller names or business information where legally required, listing content, images, reviews, questions, sale status, asking prices, Hammer Prices or sale prices, grade or certification information, and other information intentionally posted or preserved in a public listing or auction-results archive.
• Automated and AI-related information: prompts or inputs submitted to an enabled tool, generated descriptions or recommendations, translations, permitted technical image-processing outputs, moderation and fraud signals, confidence scores, reports of suspected prohibited image alteration, and records of human review where applicable.
• Fraud, security, and compliance information: identity and payment-verification results, 3-D Secure or other authentication status, risk indicators, suspected account links, chargeback and refund history, connected-account reserve and negative-balance records, Marketplace Examination and Buyer Acceptance records, tracking and signature evidence, processor and card-network dispute information, recovery and collection records, sanctions or watchlist results where applicable, and records concerning suspected fraud, shill bidding, counterfeit or stolen Property, unlawful activity, or violations.
• Inferences: interests, transaction preferences, fraud risk, and service-improvement insights derived from the information above.

Some identity, government-identification, account-access, tax, banking, or authentication information may be treated as sensitive personal information. GCA uses sensitive information for reasonably necessary purposes such as identity verification, account security, payment, payout, fraud prevention, shipping, legal compliance, and transaction completion unless additional notice and consent are provided.

2. Sources of Information

• You directly, including registration, listing, consignment, bidding, purchase, payment, payout, examination, acceptance, rejection, shipping, support, claim, and privacy forms;
• Your authorized representative, employer, business, owner, agent, co-owner, or another transaction participant;
• The Website, cookies, pixels, logs, and similar technologies;
• Payment processors, acquiring and issuing banks, card issuers and networks, connected-account and payout providers, financing or advance providers, identity-verification and fraud-prevention services, dispute and chargeback systems, collection professionals, and tax services;
• Auction and marketplace platforms, Marketplace Examination providers, shipping carriers, insurers, storage providers, grading and authentication services, and service contractors;
• Artificial-intelligence, machine-learning, translation, image-processing, moderation, recommendation, analytics, and customer-support providers used to operate or improve the Services;
• Publicly available auction results, pricing sources, certification databases, social-media or business information, and other lawful sources;
• Public records, sanctions lists, professional directories, certification databases, and other lawful sources; and
• Other users involved in a transaction, communication, claim, or dispute.

3. How We Use Information

• Provide, administer, personalize, and improve the Services;
• Create and secure accounts, verify identity and authority, approve sellers and bidders, establish limits, and prevent fraud or misuse;
• Create listings, administer auctions, process offers and bids, display and enforce applicable payment methods and limits, complete purchases, process payments and payouts, coordinate Marketplace Examination and Buyer Acceptance, determine payout eligibility, administer payment-provider holds and reserves, route auction settlements to the designated auction trust account, reconcile and remit Consignor proceeds, process refunds or reversals, calculate taxes, recover deficiencies, and maintain transaction, payment, trust-account, and settlement records;
• Evaluate, offer, document, fund, administer, service, secure, reconcile, collect, or recover a consignment advance or early payment when GCA separately offers that service, including communicating with the Consignor and any approved financing, banking, payment, or professional-service provider;
• Generate or assist with search, descriptions, translations, permitted technical image processing that does not materially alter the depicted Property, recommendations, customer support, fraud detection, moderation, valuation guidance, and other automated or AI-supported functions, subject to applicable law, the Website Terms, and human review where appropriate;
• Publish and maintain listing pages, auction catalogs, sold-item archives, prices realized, grade or certification information, and aggregated or deidentified market statistics while ordinarily keeping bidder and Buyer identities nonpublic;
• Receive, inventory, photograph, examine, authenticate, grade, store, ship, insure, deliver, forward, or return Property when GCA provides or coordinates an accepted auction, Marketplace Examination, authentication, storage, shipping, or fulfillment service; ordinary fixed-price Marketplace Property generally remains with the Seller until shipment to GCA or a GCA-designated examination or authentication provider;
• Communicate confirmations, invoices, auction and listing updates, shipping notices, policy changes, support responses, and legally required notices;
• Monitor, record, scan, analyze, preserve, and review customer-service calls and platform communications after any notice or consent required by law, for support, quality, security, fraud prevention, dispute resolution, policy enforcement, and legal compliance;
• Facilitate communications concerning Marketplace claims and returns without acting as the Marketplace Seller or ordinarily adjudicating the private dispute; administer Auction claims, returns, examination and authenticity questions, Buyer Acceptance and rejection issues, chargebacks, payment disputes, connected-account reserves and negative balances, risk allocation, title issues, application-fee or transfer reversals, authorized account or bank debits, recovery of Property or funds, collection activity, and enforcement matters;
• Comply with auction, tax, marketplace, consumer-protection, authenticity-certificate, warranty, disclosure, sanctions, anti-fraud, subpoena, court-order, and other legal obligations, including preparing or providing state-specific or transaction-specific certificates, warranties, notices, or disclosures where required;
• Comply with stolen-property inquiries, secondhand-dealer or pawnbroker requirements, mandatory holding periods, law-enforcement reporting duties, sanctions requirements, subpoenas, court orders, legal process, insurer or payment-processor requirements, and other regulatory obligations;
• Meet INFORM Consumers Act collection, verification, annual certification, disclosure, suspension, security, and reporting duties where applicable;
• Protect GCA, users, Property, providers, and the public; enforce agreements; and establish, exercise, or defend legal claims; and
• Conduct analytics, improve design and operations, and market Services subject to applicable choices and law.

4. How We Disclose Information

We may disclose personal information to:

• Payment processors, including Stripe Connect or a successor connected-account provider; acquiring and issuing banks; card issuers and networks; connected-account, payout, financing or advance providers; GCA’s auction merchant processor and auction trust-account bank; tax services; identity-verification and fraud-prevention providers; Marketplace Examination, grading, and authentication providers; collection agencies, collection counsel, and other professional advisors;
• Auction software providers, marketplace technology providers, cloud hosting, analytics, communications, customer-support, artificial-intelligence, machine-learning, translation, image-processing, moderation, security, and professional-service providers;
• Sellers, Buyers, Consignors, owners, agents, examiners, and transaction participants as reasonably necessary to complete or resolve a transaction, coordinate examination and Buyer Acceptance, administer a return or chargeback, evaluate connected-account and transaction responsibility, recover Property or funds, allocate responsibility, or enforce the parties’ agreements;
• Carriers, insurers, storage providers, grading and authentication services, appraisers, photographers, catalogers, and property-handling contractors;
• Regulators, law enforcement, courts, tax authorities, auction boards, and other persons when required or reasonably necessary for law, safety, fraud prevention, or legal claims;
• A buyer, investor, lender, successor, affiliate, or advisor in connection with a merger, financing, restructuring, sale, or other corporate transaction; and
• Other persons with your direction or consent.

Information intentionally made public through a listing, seller profile, review, public question, catalog, or auction-results archive may be viewed, copied, indexed, or redistributed by others. GCA may continue to display archival item descriptions, images, grades, certification numbers, asking prices, Hammer Prices or sale prices, sale dates, and transaction status after a sale closes, subject to applicable law and the Website Terms.

GCA may create aggregated or deidentified information and use or disclose it for analytics, market information, research, fraud prevention, service improvement, and other lawful purposes. Where required by law, GCA will maintain deidentified information in deidentified form and will not attempt to reidentify it except to test or validate deidentification or as otherwise permitted by law.

GCA may disclose seller identity and contact information in listings, order confirmations, or transaction histories when required by the INFORM Consumers Act or other law. GCA may provide a reporting mechanism for suspicious activity involving covered sellers.

Where applicable law requires a certificate, warranty, invoice disclosure, or other transaction-specific notice, GCA may include or disclose the Property, transaction, authentication, provenance, seller or consignor, and other information reasonably required by that law.

GCA may disclose identity, ownership, transaction, certification, serial-number, provenance, and Property information to law enforcement, regulators, auction boards, secondhand-dealer or pawnbroker authorities, tax authorities, insurers, financial institutions, payment processors, carriers, and other persons when reasonably necessary to comply with reporting, holding-period, stolen-property, sanctions, legal-process, fraud-prevention, insurance, or other legal and regulatory obligations.

5. Sale, Sharing, Targeted Advertising, and Marketing

GCA does not sell personal information for money. Depending on the cookies, pixels, analytics, or advertising technologies actually used, certain disclosures may be considered a “sale,” “sharing,” or processing for targeted advertising under some privacy laws. GCA will identify material analytics and advertising technologies in its cookie banner, Cookie Settings, or another notice made available on the Website. Where applicable, GCA will provide required notices and methods to opt out of sale, sharing, or targeted advertising.

Where required by applicable law, GCA will recognize a supported legally valid universal opt-out preference signal, such as Global Privacy Control, as a request to opt out of sale, sharing, or targeted advertising for the browser or device sending the signal. Other “Do Not Track” signals may not be recognized because there is no uniform industry standard. Account-level choices may require a separate request or login-based setting.

You may unsubscribe from promotional email using the link in the message. Transactional, security, account, auction, payment, shipping, claim, and legal communications are not promotional and may continue while necessary.

6. Cookies and Similar Technologies

GCA may use essential cookies for login, security, shopping, bidding, fraud prevention, and preferences; analytics technologies to understand use and improve the Services; session-replay or interaction tools if enabled and disclosed; and advertising technologies if enabled. Browser settings may block cookies, but some Services may not work. Where required by applicable law, non-essential cookies and similar technologies will not be activated until the user provides any required consent. Users may withdraw or change those choices through the Website’s Cookie Settings or other consent-management tool, when available.

7. Payment, Identity, and Sensitive Data

Full payment-card data is ordinarily collected and tokenized by Stripe or another approved payment processor rather than stored by GCA. Linked-bank and connected-account credentials are ordinarily collected by the applicable payment, payout, or connected-account provider; GCA may receive masked account references, onboarding and verification status, application-fee information, transaction status, payout or reserve status, transfer and reversal status, negative-balance status, and debit or collection results.

For fixed-price Marketplace Sales, each Seller may be required to establish a Stripe Connect connected account or comparable approved account. Subject to GCA and processor availability and controls, a Seller may select the GCA-approved payment methods the Seller is willing to accept for a listing and may establish a listing-specific maximum for an enabled method. GCA and its providers may receive and use those selections, changes, Seller-selected maximums, GCA- or processor-imposed limits, method-eligibility results, and risk acknowledgments to configure checkout, process the Buyer’s chosen available method, apply transaction-specific limits, prevent off-platform payment diversion, administer returns and disputes, and enforce the Website Terms. The processor may collect the Seller’s identity, beneficial-ownership, tax, bank, and transaction information; process the Buyer’s payment as a direct charge or other approved method on or for the Seller’s account; deduct processor fees; allocate GCA’s application fee; and pay the remaining balance to the Seller under the processor’s terms. GCA ordinarily does not receive or hold the Seller’s gross marketplace sale proceeds, although GCA may receive records and limited information needed to administer payment-method selections, fees, taxes, fraud controls, refunds, disputes, chargebacks, ACH returns, transfer reversals, negative balances, and enforcement.

For auction and consignment transactions, GCA may use a separate merchant account or processor configuration whose ordinary payout destination is GCA’s designated Florida auction trust or escrow bank account. The processor is not the statutory trust or escrow account. GCA and its providers may process buyer payment information, auction and Lot identifiers, gross receipts, Buyer’s Premium, taxes, shipping, processor deductions, trust deposits, refunds, chargebacks, reserves, authorized expenses, and Consignor settlement information. Consignors are paid by GCA through the auction trust-account settlement process rather than directly through a marketplace connected account.

Tax IDs, bank credentials, government-identification documents, and other sensitive information should be collected through secure, access-controlled systems and displayed only in masked or limited form where practical. GCA does not use artificial intelligence, generative fill, or other automated enhancement tools to materially alter or create a synthetic depiction of Property offered for sale. Limited technical adjustments, such as cropping, rotation, resizing, exposure correction, or neutral background or watermark placement, may be used only when they do not change, conceal, or misrepresent the Property. GCA will not knowingly submit complete payment-card numbers, complete bank credentials, tax identification numbers, government-identification images, account passwords, or original Property photographs containing sensitive information to a public or general-purpose AI service for model training. Vendors that process personal information for an automated or AI-supported function must be authorized for the function and subject to appropriate contractual, security, and use restrictions.

Information collected solely to comply with the INFORM Consumers Act will be used only for that purpose unless another use is required by law. GCA will maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the data.

8. Data Retention

GCA retains information for as long as reasonably necessary for the purposes described, including account administration, transaction completion, payment and payout administration, Marketplace Examination and chain-of-custody records, Buyer Acceptance records, tax and financial records, fraud prevention, reserves and payment disputes, auction trust-account deposits and reconciliations, Consignor settlements, consignment-advance or early-payment evaluation and administration, repayment or recovery activity, claims, insurance, legal obligations, and enforcement. Auction agreements, electronic consignment records, trust-account ledgers, reconciliations, and other required auction records will be retained for at least the period required by Florida law. Other financial, transaction, advance, dispute, authorization, collection, and compliance records may be retained for seven years or longer when needed for legal holds, disputes, recovery efforts, or applicable statutes of limitation.

Public listing and auction-result records may remain available as part of GCA’s historical catalog and market-data archive even after an account closes, unless removal is required by law or GCA determines removal is appropriate. Account deletion does not require deletion of transaction, fraud, tax, regulatory, legal-hold, or archival records that GCA may lawfully retain.

9. Security and Incident Response

GCA uses reasonable safeguards that may include encryption in transit, access controls, multifactor authentication, logging, secure payment tokenization, vendor review, backups, and incident-response procedures. No system is completely secure. Users should use unique passwords, protect devices and codes, and promptly report suspected unauthorized use.

10. Your Choices and Privacy Rights

Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, or a portable copy of your personal information; to obtain information about how GCA processes or discloses it; to opt out of certain targeted advertising, sale, or sharing; to limit certain uses of sensitive personal information; to object to or restrict certain processing; to withdraw consent where processing is based on consent; or to appeal a privacy-request decision. These rights are subject to identity verification, legal exceptions, and limitations permitted by applicable law. Authorized agents may be required to provide proof of authority.

Privacy requests and appeals may be submitted using the contact information in Section 14. An appeal should identify the original request and explain why you believe the decision should be reconsidered. GCA may request information reasonably necessary to verify identity, authority, account ownership, or the scope of the request. GCA will respond within the period required by applicable law and will not discriminate against you for exercising applicable privacy rights.

GCA may deny or limit a request where permitted by law, including when information is needed to complete or document a transaction; administer payments, reserves, refunds, returns, payouts, or a separately offered consignment advance or early payment; contest or resolve chargebacks; comply with auction, tax, sanctions, accounting, recordkeeping, certificate, warranty, disclosure, or other legal obligations; protect security; prevent fraud; recover Property or funds; collect amounts due; maintain public auction-result archives; or establish, exercise, or defend legal claims.

Individuals in the European Economic Area (“EEA”) or United Kingdom may also have the right to lodge a complaint with the data-protection supervisory authority in the country where they live or work or where they believe a violation occurred. To the extent GCA uses solely automated decision-making that produces legal or similarly significant effects, GCA will provide any notice, explanation, human-review opportunity, or other rights required by applicable law.

11. Children

The Services are intended for adults and are not directed to children under thirteen (13). GCA does not knowingly collect personal information from children under thirteen. Auction, buying, and selling accounts require users to be at least eighteen.

12. International Users

GCA is based in the United States and operates the Services from the United States. If you access or use the Services from outside the United States, your personal information may be collected, transferred to, stored in, accessed from, and processed in the United States and other countries where GCA or its service providers operate. Privacy and data-protection laws in those jurisdictions may differ from the laws of your country of residence.

GCA may use providers located in the United States and other countries, including payment processors, financial institutions, financing or advance providers, identity-verification and fraud-prevention providers, auction and marketplace technology providers, cloud-hosting and communications providers, analytics and customer-support providers, carriers, insurers, storage providers, and grading or authentication companies.

Where applicable law requires safeguards for an international transfer, GCA will use a legally recognized transfer mechanism appropriate to the transfer, which may include an adequacy decision, approved standard contractual clauses, the United Kingdom International Data Transfer Agreement or Addendum, or another mechanism permitted by applicable law. Information about an applicable transfer safeguard may be requested through the contact information in Section 14, subject to lawful redactions and confidentiality restrictions.

Additional Notice for EEA and United Kingdom Individuals

Controller. For personal data subject to the EU General Data Protection Regulation or United Kingdom data-protection law, Global Card Auctions, LLC is the controller unless a separate notice states otherwise.

Lawful bases. GCA processes personal data as necessary to perform a contract or take requested pre-contract steps, including creating accounts, administering listings, auctions, bids, purchases, consignments, payments, examinations, acceptance, shipping, storage, returns, support, and any separately offered consignment advance or early payment; to comply with legal obligations, including tax, accounting, sanctions, fraud-prevention, auction, marketplace, certificate, warranty, disclosure, law-enforcement, and recordkeeping requirements; for legitimate interests such as securing the Services, preventing fraud and misuse, operating and improving the business, communicating with users, maintaining transaction and auction-result records, resolving disputes, and establishing or defending legal claims, where those interests are not overridden by applicable rights; and with consent where required, such as for certain optional marketing or non-essential cookies. Where processing is based on consent, consent may be withdrawn at any time without affecting processing that occurred before withdrawal.

Rights. Subject to applicable conditions and exceptions, EEA and United Kingdom individuals may request access, correction, erasure, restriction, objection, or portability; withdraw consent; and lodge a complaint with a competent supervisory authority. Additional information about submitting requests appears in Sections 10 and 14.

Representatives. If GCA is required to designate a representative in the EEA or United Kingdom, GCA will publish the representative’s name and contact information in this Policy or another clear notice before the requirement applies. The designation of a representative does not affect the right to contact GCA directly.

Cross-border transactions. Customers, buyers, bidders, sellers, consignors, and other users are responsible for ensuring that their use of the Services and any transaction, export, import, customs declaration, tax, duty, shipment, or receipt of Property is lawful in the relevant jurisdictions. GCA may restrict or decline access, transactions, payments, payouts, or shipments involving countries, persons, entities, or Property subject to legal, sanctions, carrier, processor, insurance, or operational restrictions.

13. Changes to This Policy

GCA may update this Policy to reflect legal, operational, vendor, or technology changes. The “Last Updated” date will be revised, and material changes will be communicated as required. The version in effect when information is collected governs unless law requires otherwise.

14. Contact

For purposes of applicable privacy law, Global Card Auctions, LLC is the business or controller responsible for the personal information described in this Policy, unless another notice states otherwise.

Privacy requests, questions, complaints, and appeals may be submitted as follows: