PRIVACY POLICY

The controller responsible for the processing of personal data in connection with the Ownimals platform is:

Vailble GmbH
Ludwig-Lassl-Strasse 2
6112 Wattens
Austria

Email: office@vailble.at

In this Privacy Policy, “Ownimals”, “we”, “us” or “our” refers to Vailble GmbH as operator of the Ownimals platform.

Ownimals is a digital collectibles and marketplace platform.

We process personal data only where necessary to:

• provide and operate the Ownimals platform;
• create and manage user accounts;
• process purchases and sales;
• manage digital ownership records;
• operate the secondary marketplace;
• process payments and seller payouts;
• calculate and process applicable taxes;
• prevent fraud and misuse;
• comply with legal, tax, accounting and regulatory obligations;
• protect the security and integrity of the platform.

Depending on the processing activity, the legal basis is in particular:

• Art. 6 (1) (b) GDPR – processing necessary for the performance of a contract or pre-contractual measures;
• Art. 6 (1) (c) GDPR – processing necessary for compliance with a legal obligation;
• Art. 6 (1) (f) GDPR – processing based on our legitimate interests, particularly platform security, fraud prevention, abuse prevention and the operation and improvement of our services;
• Art. 6 (1) (a) GDPR – consent, where consent is required for a particular processing activity.

When you create an Ownimals account, we may process:

• your email address;
• account ID;
• registration date;
• login information;
• authentication information;
• username;
• profile information;
• account status.

If you choose a public username, this username may be displayed publicly in connection with marketplace activities.

If you do not choose a public username, you may appear as “Anonymous Owner” where this functionality is provided.

Your email address is not displayed publicly.

The legal basis for this processing is Art. 6 (1) (b) GDPR, as the information is required to create and operate your account and provide the Ownimals services.

If you choose to register or sign in using Google, Google provides us with authentication information associated with your Google account.

Depending on the permissions granted, this may include:

• your email address;
• your name;
• your Google account identifier;
• your profile picture.

We use this information to authenticate you, create or access your Ownimals account and display permitted profile information.

The legal basis for this processing by Ownimals is Art. 6 (1) (b) GDPR.

Google processes personal data in accordance with its own privacy terms and may act as an independent controller for processing carried out within its own services.

To operate Ownimals and the marketplace, we process information relating to your activities on the platform.

This may include:

• Ownimals characters associated with your account;
• number or percentage of Collectibles associated with your account;
• ownership records;
• purchase history;
• sale history;
• transaction history;
• wallet or account ledger entries;
• marketplace listings;
• listing prices;
• purchase offers sent;
• purchase offers received;
• completed marketplace transactions;
• transaction timestamps;
• transaction status;
• payment references;
• seller payout status.

This processing is necessary to provide the Ownimals platform and marketplace and is therefore based primarily on Art. 6 (1) (b) GDPR.

Certain transaction records may additionally be processed under Art. 6 (1) (c) GDPR where retention is required by tax, accounting or other legal obligations.

Certain information relating to marketplace activity may be visible to other users and visitors.

Depending on the functionality used, this may include:

• your chosen username or “Anonymous Owner”;
• the size or quantity of your Ownimals holding;
• public listings;
• asking prices;
• completed trades;
• transaction prices;
• historical marketplace activity.

This information may be displayed on public Ownimals pages such as owner lists, character pages or marketplace pages.

Your email address, full payment details, identity verification documents and bank details are not displayed publicly.

Where possible, users can use a public username rather than their legal name.

Payments on Ownimals are processed using Stripe.

Depending on the transaction, Stripe may process information such as:

• name;
• email address;
• billing address;
• payment method information;
• card information;
• bank information;
• transaction amount;
• currency;
• IP address;
• device and browser information;
• fraud and risk signals.

Ownimals does not receive or store your full payment card number.

We generally receive only information necessary to identify and manage a transaction, such as:

• Stripe customer or payment identifier;
• transaction reference;
• amount;
• currency;
• payment status;
• tax information;
• refund or dispute status.

Processing by Ownimals is primarily based on Art. 6 (1) (b) GDPR for the performance of the transaction and Art. 6 (1) (c) GDPR where processing is necessary to comply with legal obligations.

Stripe may act as a processor or as an independent controller depending on the specific processing activity and applicable legal requirements.

Ownimals uses Stripe Connect to enable sellers to receive payouts from transactions on the secondary marketplace.

Before selling or receiving payouts, users may be required to complete a Stripe Connect onboarding and verification process.

Stripe may request and process information including:

• full legal name;
• date of birth;
• residential or business address;
• telephone number;
• email address;
• nationality;
• tax information;
• business information;
• company registration information;
• beneficial ownership information;
• identity documents;
• bank account information;
• payout account information.

The exact information required depends on the seller’s country, legal status and applicable regulatory requirements.

Stripe processes this information for payment processing, seller onboarding, identity verification, fraud prevention, regulatory compliance and payout processing.

Ownimals does not store full bank account or payment card details where these are collected directly by Stripe.

We may receive information from Stripe regarding:

• your Stripe Connected Account identifier;
• verification status;
• whether payments are enabled;
• whether payouts are enabled;
• outstanding verification requirements;
• payout status;
• transaction references.

This information is necessary to operate the secondary marketplace and seller payout system.

Stripe may be required to perform Know Your Customer (KYC), anti-money laundering (AML), sanctions, fraud prevention and other regulatory checks.

For these purposes, Stripe may process identity information, identity documents, business information, beneficial ownership information, technical information and risk signals.

Ownimals may receive confirmation of the status or result of such checks where necessary to determine whether a user may sell or receive payouts.

Ownimals generally does not receive or store copies of identity documents where verification is performed directly by Stripe, unless this is necessary for a specific legal or compliance purpose.

Processing may be based on Art. 6 (1) (b), (c) and/or (f) GDPR, depending on the specific processing activity and legal responsibility.

Ownimals may use Stripe Tax or other Stripe tax functionality to calculate taxes applicable to purchases and secondary marketplace transactions.

For this purpose, information may be processed including:

• buyer location;
• billing address;
• seller location;
• transaction amount;
• currency;
• product or service classification;
• tax status;
• applicable tax rate;
• tax amount;
• tax identifiers where required.

We process this information to correctly calculate, collect, document and, where legally required, report or remit applicable taxes.

Where Ownimals is legally responsible for collecting and remitting applicable VAT or comparable indirect taxes on a secondary marketplace transaction, the relevant tax information is processed for this purpose and the applicable tax amount is not treated as a seller payout.

The legal basis is Art. 6 (1) (b) GDPR for transaction processing and Art. 6 (1) (c) GDPR where processing is necessary to comply with tax obligations.

We process and retain information required for invoices, transaction documentation, accounting and tax compliance.

This may include:

• name and address;
• transaction date;
• invoice number;
• product or Collectible purchased or sold;
• transaction amount;
• tax amount;
• tax rate;
• payment status;
• seller information;
• buyer information where legally required;
• platform fees;
• payout amounts.

Such records are retained for the period required under applicable Austrian tax, accounting and commercial law.

The legal basis is Art. 6 (1) (c) GDPR.

For secondary marketplace transactions, Ownimals processes information required to calculate platform fees, taxes and seller payouts.

This may include:

• transaction amount;
• applicable taxes;
• Ownimals platform fee;
• payment processing costs where applicable;
• seller payout amount;
• payout status;
• Stripe Connected Account identifier.

Ownimals currently charges a 5% platform fee on successful secondary marketplace sales, subject to the applicable Terms and Conditions.

This processing is necessary to perform the marketplace contract and is therefore based on Art. 6 (1) (b) GDPR.

Where information forms part of legally required accounting or tax records, processing is additionally based on Art. 6 (1) (c) GDPR.

As the operator of an online marketplace, Ownimals may be subject to legal reporting, record-keeping or disclosure obligations.

Where required by applicable law, we may collect, retain and disclose information relating to sellers and marketplace transactions to tax authorities, regulators or other competent public authorities.

This may include:

• identity information;
• address information;
• tax identification information;
• seller status;
• transaction amounts;
• number of transactions;
• fees;
• payouts;
• account information.

Such processing and disclosure takes place only where required or permitted by applicable law.

The legal basis is Art. 6 (1) (c) GDPR.

When you use Ownimals, certain technical information may be processed automatically.

This may include:

• IP address;
• browser type;
• operating system;
• device information;
• date and time of access;
• requested pages or functions;
• login events;
• error logs;
• security events;
• session identifiers.

We use this information to provide the website, maintain account sessions, identify technical problems, protect accounts, prevent fraud and abuse and ensure platform and payment security.

Processing is based on Art. 6 (1) (b) GDPR where technically necessary to provide the service and Art. 6 (1) (f) GDPR for our legitimate interests in operating a secure and reliable platform.

We use technical service providers for the operation of Ownimals, including services for:

• website hosting;
• cloud infrastructure;
• databases;
• authentication;
• backend functions;
• security;
• transactional infrastructure.

These providers process personal data on our behalf where they act as processors.

Where required under Art. 28 GDPR, appropriate data processing agreements are concluded with such providers.

The specific providers used may change as our technical infrastructure develops.

Personal data may be disclosed to the following categories of recipients where necessary:

• Stripe and other payment service providers;
• authentication providers such as Google;
• hosting and cloud infrastructure providers;
• database providers;
• IT and security service providers;
• accounting and tax advisers;
• legal advisers;
• auditors;
• competent authorities;
• tax authorities;
• courts and regulators where legally required.

We do not sell your personal data to advertisers or data brokers.

Some of our service providers or their group companies may process personal data outside Austria or the European Economic Area.

Where personal data is transferred to a country for which the European Commission has issued an adequacy decision, the transfer may be based on that decision.

Where no adequacy decision exists, appropriate safeguards are used where required, including in particular the European Commission’s Standard Contractual Clauses (SCCs).

Where applicable, providers may also rely on other legally recognised transfer mechanisms.

Ownimals currently uses only cookies, local storage or comparable technologies that are technically necessary for the operation and security of the platform.

These may be used to:

• keep you signed in;
• maintain your user session;
• remember technically necessary preferences;
• remember that you have seen the cookie notice;
• secure payments;
• prevent fraud;
• enable Stripe payment functionality.

Stripe may set cookies or use comparable technologies that are necessary to securely process payments and detect fraud.

Technically necessary storage or access may be used without consent where permitted under § 165 (3) TKG 2021.

We currently do not use advertising, behavioural marketing or non-essential analytics cookies.

If we introduce non-essential analytics, advertising or tracking technologies in the future, we will obtain consent where legally required before such technologies are activated.

You can remove locally stored information through your browser settings.

Ownimals currently does not use your personal data to create advertising profiles or provide personalised third-party advertising.

We do not sell personal data to advertisers.

If this changes in the future, this Privacy Policy and, where required, our consent mechanisms will be updated before such processing begins.

We retain personal data only for as long as necessary for the respective processing purpose or as required by applicable law.

Account and marketplace information is generally stored for the duration of your account and for as long thereafter as necessary to comply with contractual, legal, tax, accounting, fraud-prevention or regulatory obligations.

Certain information may therefore need to be retained after account deletion, particularly:

• invoices;
• accounting records;
• tax records;
• payment records;
• transaction records;
• marketplace transaction history;
• records required for fraud prevention;
• records required for legal claims;
• information subject to regulatory or reporting obligations.

Information for which there is no continuing legal basis after account deletion will be deleted or anonymised within an appropriate period.

You may request or initiate deletion of your Ownimals account using the available account functions or by contacting us.

Before an account can be fully deleted, it may be necessary to resolve:

• active marketplace listings;
• pending purchases or sales;
• pending payouts;
• disputes;
• refunds;
• chargebacks;
• legal or regulatory holds.

If you confirm the permanent deletion of your account, any Ownimals Collectibles associated with your account will be automatically transferred back to Ownimals in accordance with the applicable Terms and Conditions.

The corresponding digital ownership records will be updated to reflect the transfer of the Collectibles from the deleting account back to Ownimals.

Before the permanent deletion is completed, you will be clearly informed that deleting your account results in the transfer of all remaining Collectibles associated with your account back to Ownimals.

Subject to applicable mandatory law and the applicable Terms and Conditions, no payment, refund or other compensation is provided for Collectibles transferred back to Ownimals as a consequence of a voluntarily confirmed permanent account deletion.

The transfer and corresponding update of ownership records are processed on the basis of Art. 6 (1) (b) GDPR, as they are necessary to carry out the account deletion requested by the user in accordance with the contractual rules governing Ownimals.

Deleting your account does not require Ownimals to delete information that we are legally required to retain.

In particular, transaction, payment, invoice, tax, accounting and legally required marketplace records may continue to be retained for the applicable statutory retention period.

Personal data for which there is no continuing legal basis will be deleted or anonymised after account deletion.

Where legally permissible and technically appropriate, retained transaction information may be restricted, pseudonymised or anonymised.

Subject to the applicable legal requirements, you have the right to:

• access your personal data;
• rectify inaccurate personal data;
• request erasure of personal data;
• request restriction of processing;
• receive certain personal data in a structured, commonly used and machine-readable format (data portability);
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

The right to erasure does not require the deletion of information that we are legally required or otherwise legally entitled to retain.

To exercise your rights, contact: office@vailble.at

We may need to verify your identity before fulfilling a request.

You have the right to lodge a complaint with a competent data protection supervisory authority.

For Vailble GmbH in Austria, the competent supervisory authority is:

Austrian Data Protection Authority
(Österreichische Datenschutzbehörde)

You may also have the right to contact the supervisory authority in the EU/EEA country of your habitual residence, place of work or place of the alleged infringement.

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Payment card and bank information used for Stripe payments and payouts is generally handled directly by Stripe rather than stored in full by Ownimals.

No internet-based system can guarantee absolute security.

We may update this Privacy Policy where necessary, for example due to:

• changes to Ownimals;
• new marketplace functions;
• new service providers;
• changes to payment or tax functionality;
• changes in applicable law;
• regulatory requirements.

The current version will be made available on the Ownimals website.

For questions regarding privacy or the processing of your personal data, contact:

Vailble GmbH
Ludwig-Lassl-Strasse 2
6112 Wattens
Austria

Email: office@vailble.at