Privacy Policy

The controller responsible for the processing of personal data on the FARMSTOCK platform is:

SIA "Hunter" Registration number: 40203656593 VAT payer number: LV40203656593 Registered address: "Meirēnu Stūrīši", Vecpiebalgas pag., Cēsu nov., LV‑4122, Latvia Email: info@farmstock.eu Data protection matters: privacy@farmstock.eu

All processing activities described in this Policy are carried out by SIA "Hunter" or its authorised processors.

We process the following categories of personal data:

2.1. Account data - first name, last name, email address, telephone number, and, for legal persons, company name and registration number. Purpose: creation and management of the account, and verification of the right to represent a legal person. Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.2. Identity verification data (KYC) - to obtain bidding or selling rights, the user must complete identity verification using a qualified electronic identification service. As our technology partner we use eID Easy OÜ. During verification, eID Easy OÜ processes identity document data (first name, last name, date of birth, identification number, document image) solely for the purpose of confirming identity. The original eID identification data, including the document image, is stored on eID Easy's secure servers and is irreversibly deleted from their systems within 2 hours after successful verification. After successful verification, FARMSTOCK retains the user's first name, last name and personal identity number, together with the verification status and a timestamp. We process this data in order to confirm the user's identity, to verify their authority to legally represent the company or farm on whose behalf the verification is carried out, to prevent fraud, and to fulfil other legal requirements that may arise (for example, proving identity in a dispute or complying with statutory obligations). We process the personal identity number only for the purposes set out in this clause, with appropriate safeguards and in accordance with the GDPR and the Latvian Personal Data Processing Law; we do not use it for other, incompatible purposes. Legal basis: performance of a contract, legitimate interests (platform integrity and fraud prevention) and - to the extent that we are subject to a statutory obligation (for example, in the field of anti-money laundering) - legal obligation (Article 6(1)(b), (f) and, where applicable, (c) GDPR).

2.3. Transaction data - bidding history, auction results, invoices and payment references. Purpose: performance of contractual obligations and financial record-keeping. Legal basis: performance of a contract and legal obligation (accounting and tax).

2.4. Location data - postal code, town/municipality and the coordinates of the animal collection location. Purpose: logistics planning, distance and delivery calculation, and the geographic placement of the auction. Legal basis: performance of a contract and legitimate interests.

2.5. User-uploaded content - photos and videos of animals, herd number, health and accompanying documents. Purpose: creation and performance of the auction. Legal basis: performance of a contract. This content primarily concerns the animals but may contain certain personal data (e.g. metadata or information in documents).

2.6. Technical data - IP address, browser type, device identifiers, cookies and session logs. Purpose: platform security, fraud prevention and service improvement. Legal basis: legitimate interests.

2.7. Communication data - messages sent through the platform's messaging system, and correspondence with support. Purpose: dispute resolution, support and provision of the service. Legal basis: legitimate interests.

2.8. Settlement data - bank account number (IBAN) and other payment details provided by the user. Purpose: making payouts to the user (for example, the security deposit (Escrow) payout to the seller or a refund to the buyer) and preparing and issuing invoices. Settlement data is processed on our behalf by our payment service provider (Stripe; see Sections 4 and 5). Legal basis: performance of a contract and legal obligation (accounting and tax) (Article 6(1)(b) and (c) GDPR).

Where processing is based on legitimate interests, we have weighed those interests against your rights and freedoms and rely on them only where they are not overridden by your interests.

Providing account, identity verification, transaction and settlement data is necessary in order to conclude and perform the contract (to use the platform, to bid or to sell). If you do not provide this data, we cannot provide the relevant services - for example, without identity verification it is not possible to obtain bidding or selling rights.

We do not sell your personal data to any third party.

We may share data with the following categories of recipients:

• eID Easy OÜ - identity verification service provider. Processes raw identity document data solely for verification purposes; the data is deleted from their servers within 2 hours after verification is completed.

• Supabase, Inc. - cloud database and infrastructure service provider, acting as a data processor under a Data Processing Agreement.

• Stripe, Inc. - payment, payout and security deposit (Escrow) processing partner.

• Other platform users (the other party to the transaction) - after a successful transaction and payment of the commission, your contact information (e.g. name, telephone number, location) is disclosed to the other party to the transaction to the extent necessary to perform the transaction (e.g. the handover and transport of the animals).

• Logistics service providers - where transport of the animals is arranged for a transaction, the information necessary for delivery (location, contacts) may be transferred to the carrier.

• Email and notification service providers - to send service-related notifications (e.g. transaction and account notifications).

• Competent authorities - where required by law, court order or a regulator's investigation.

All third-party processors are bound by contractual data protection obligations no lower than the requirements of the GDPR.

Our data is primarily stored on infrastructure located within the European Economic Area (EEA). However, some of our processors (e.g. Supabase, Inc. and Stripe, Inc.) are registered in the United States, and in certain cases data may be accessed or transferred outside the EEA.

For such transfers we ensure the safeguards required by the GDPR using one of the following mechanisms:

• the Standard Contractual Clauses (SCC) approved by the European Commission; and/or

• the EU–US Data Privacy Framework, where the processor is certified to it; and/or

• another basis provided for in Chapter V of the GDPR.

You can request further information about the specific safeguards by writing to privacy@farmstock.eu.

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR. For fraud prevention and security purposes, automated signals may be used (e.g. detection of unusual activity), but significant decisions are taken with human involvement.

We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law:

• Account data: for the duration of the account and for 5 years after closure of the account (legal obligation).

• Transaction and invoice data: 10 years (VAT and accounting law requirements).

• Settlement data (bank account details): for the duration of the business relationship; data associated with issued invoices - 10 years (accounting requirements).

• KYC and identity verification records (first name, last name, personal identity number, status and timestamp): 5 years after the end of the business relationship.

• Raw eID identification data held by eID Easy OÜ: deleted within 2 hours after verification.

• Location and auction content data: for as long as the auction/transaction is current, and thereafter in accordance with the transaction data period if associated with a concluded transaction.

• Communication data: for as long as necessary for dispute resolution and support, generally no longer than the transaction data period.

• Technical/log data: up to 12 months.

When data is no longer needed, it is securely deleted or anonymised.

We use strictly necessary cookies to maintain your authenticated session on the platform. We do not use advertising, tracking or third-party analytics cookies.

For the purposes of operating the platform and ensuring security, we may carry out aggregated, server-side statistics (e.g. visit counts) on the basis of technical data (2.6.); this does not involve third-party tracking cookies.

You can control cookies in your browser settings. Disabling strictly necessary cookies prevents you from logging in to the platform.

We obtain most data directly from you (during registration, when creating auctions and when using the platform). For the confirmation of identity and, where applicable, legal-person data, we may receive part of the information from the identity verification service (eID Easy OÜ) or from public registers.

As a data subject, you have the following rights:

• Right of access (Article 15) - to request a copy of the personal data we hold about you.

• Right to rectification (Article 16) - to request the correction of inaccurate or incomplete data.

• Right to erasure (Article 17) - to request the deletion of data where it is no longer necessary, subject to legal retention requirements.

• Right to restriction of processing (Article 18) - to request the restriction of processing in certain circumstances.

• Right to data portability (Article 20) - to receive your data in a structured, machine-readable format.

• Right to object (Article 21) - to object to processing based on legitimate interests.

If processing were ever based on your consent, you would have the right to withdraw it at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, contact us at privacy@farmstock.eu. We may ask you to confirm your identity before fulfilling the request.

You also have the right to lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv) or with the supervisory authority of your country of residence.

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include encrypted data storage, access controls and regular security reviews.

Data is primarily stored on infrastructure within the European Economic Area (EEA); for transfers outside the EEA, see Section 5.

The platform is intended for professional market participants and persons who have reached the age of 18. We do not knowingly collect or process the personal data of minors. If we become aware that we have inadvertently collected such data, we will delete it.

We may update this Privacy Policy from time to time. In the event of material changes, we will notify registered users by email and update the date indicated at the top of the page.

Continued use of the platform after the effective date of a revised policy is deemed to constitute acceptance of the changes.

If you have any questions about this Privacy Policy or wish to exercise your rights, contact us:

SIA "Hunter" / FARMSTOCK Email: privacy@farmstock.eu