Privacy Policy — Gavelic

1. Introduction and Scope

Welcome to Gavelic (“Platform”, “we”, “our”, or “us”).

Gavelic is a consumer-to-consumer (“C2C”) online auction platform providing second-hand item auction services, transaction workflow management, and fraud prevention mechanisms.

This Privacy Policy explains how we collect, use, store, disclose, and protect personal data when you access or use our website, applications, and related services (“Services”).

This Privacy Policy applies to all users of Gavelic. By registering an account or using the Services, you acknowledge that you have read and understood this Privacy Policy.

Gavelic primarily operates within markets where such Services are legally permitted. We process personal data in accordance with applicable privacy and data protection laws, including the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong (“PDPO”) where applicable.

2. Information We Collect

To provide secure auction services and fraud prevention mechanisms, we may collect the following categories of information.

2.1 Account Information

When you create an account, we may collect:

full name
email address
mobile phone number
account credentials
profile information
account registration date
account status and verification records

You are responsible for ensuring that all information provided is accurate and up to date.

2.2 Payment and Identity Verification Information

For Protected Auction transactions, users may be required to complete identity verification through Stripe Connect or another third-party payment service provider designated by Gavelic.

The third-party payment provider may directly collect and process:

identity documents
verification information
payment card information
bank account information
financial information required for payment processing and compliance purposes

Gavelic does not directly store:

full payment card numbers
bank account credentials
original identity documents

Gavelic may receive and retain limited information including:

verification status
payment account identifiers
transaction references
compliance-related confirmation information
tokenized payment method identifiers created by the payment provider, retained solely to enable automatic renewal of payment authorizations during an active transaction (Gavelic never receives or stores card numbers)

Payment processing and identity verification are subject to the terms and privacy policies of the relevant third-party providers. Saved payment credentials are stored by the payment provider, not by Gavelic, and are used only for the automatic re-authorization process described in the Auction Terms & Agreement while a transaction remains active.

2.3 Auction and Transaction Information

To operate auction services and execute standardized transaction procedures, Gavelic may collect:

listing information
photographs and descriptions uploaded by sellers
bidding history
auction timestamps
transaction records
payment status
delivery status
transaction completion records

For Protected Auction transactions, Gavelic may additionally collect:

Meetup Transactions:

OTP generation records
OTP verification records
transaction confirmation status

Shipping Transactions:

tracking numbers
shipping photographs
logistics status
delivery confirmation records
system-generated transaction status records

These records are used to operate transaction procedures, prevent fraud, and handle transaction-related disputes.

2.4 Technical and Security Information

To maintain platform security and prevent abuse, Gavelic may automatically collect:

IP address
device information
browser type
operating system information
login records
access timestamps
system activity logs
security-related identifiers

This information may be used to detect:

fraudulent activities
account manipulation
multiple account abuse
suspicious bidding behaviour
unauthorized access

3. How We Use Your Information

Gavelic uses personal data for the following purposes:

3.1 Providing Platform Services

Including:

account management
auction operation
bidding processing
transaction workflow execution
payment coordination through third-party providers

3.2 Protected Auction Transaction Processing

We use transaction-related information to:

verify transaction status
execute predefined transaction procedures
process OTP confirmation
evaluate logistics status
trigger payment release procedures according to the Auction Terms & Agreement

Gavelic does not independently determine:

product authenticity
product quality
product value
ownership disputes

3.3 Fraud Prevention and Platform Security

We may analyse account activity, transaction patterns, and system logs to detect and prevent:

fraud
fake accounts
shill bidding
auction manipulation
payment abuse
money laundering risks
unauthorized system access

3.4 Communication and Notifications

We may use your information to send:

transaction notifications
security alerts
OTP messages
payment updates
shipping updates
account-related communications

3.5 Direct Marketing

Gavelic does not currently use your personal data in direct marketing.

If we intend to use your personal data (such as your name, email address, or phone number) in direct marketing — for example, to send you promotional offers, platform updates of a promotional nature, or marketing materials of selected partners — we will, as required by Part VIA of the PDPO, first inform you of the kinds of personal data to be used and the classes of goods or services to be marketed, and we will not so use your data unless you have indicated that you do not object (or, where required, have given your consent).

You may at any time, free of charge, require us to cease using your personal data in direct marketing by contacting the Data Protection Officer (Section 11) or using the unsubscribe function in any marketing communication. Transaction notifications, security alerts, OTP messages, and other service communications described in Section 3.4 are not direct marketing and will continue to be sent as necessary to operate the Services.

4. Disclosure of Personal Information

Gavelic does not sell users’ personal information.

We may disclose personal information only where necessary for legitimate business purposes, including:

4.1 Third-Party Service Providers

We may share necessary information with:

Payment Providers

Including Stripe Connect or other approved payment processors for:

payment processing
identity verification
fraud prevention
chargeback handling
compliance requirements

Publicly Available Logistics Information

During dispute handling under the Auction Terms & Agreement, Gavelic staff may manually look up the tracking status published on the relevant courier’s official public website, using the tracking number submitted by the Seller, for the purposes of shipment status verification, delivery confirmation, and transaction dispute determination. This involves submitting the tracking number to the courier’s public tracking page; Gavelic does not disclose users’ names, addresses, or contact details to the courier in this process.

Communication Providers

For:

SMS
email
authentication services

4.2 Transaction Counterparties

When a transaction requires completion, Gavelic may disclose limited information necessary for fulfilment, including: display name; registered contact details (such as phone number or email address) where both parties have completed the applicable matching or auction process; and transaction-related information. Gavelic does not request, collect, or store delivery addresses. Where a Shipping transaction requires a delivery address, the Buyer provides it directly to the Seller using the exchanged contact details, and such exchange occurs outside the Platform’s systems.

4.3 Legal and Regulatory Disclosure

Gavelic may disclose information where reasonably necessary:

to comply with applicable laws
to respond to lawful requests from authorities
to investigate fraud
to protect users, the Platform, or public safety
to handle payment disputes or chargebacks

5. User Responsibilities Regarding Other Users’ Data

When users receive another user’s personal information through Gavelic, they agree:

to use such information only for completing the relevant transaction
not to use such information for marketing or unrelated purposes
to protect such information from unauthorized access
to comply with applicable privacy laws

Users are responsible for misuse of information obtained from other users.

6. Data Retention and Security

Gavelic implements reasonable technical and organizational measures to protect personal information.

These measures may include:

encrypted data transmission
access controls
security monitoring
system logging

Gavelic retains personal information only for as long as reasonably necessary for:

providing Services
fulfilling contractual obligations
preventing fraud
handling chargebacks
complying with legal obligations
resolving disputes

Certain transaction, payment, identity verification, and security records may be retained after account termination where required by law or necessary for legitimate business purposes.

6A. Cross-Border Transfer of Personal Data

Gavelic engages service providers located outside Hong Kong. In particular, payment processing and identity verification are provided by Stripe, whose processing infrastructure is located in the United States and other jurisdictions, and communication, hosting, and security services may likewise involve processing outside Hong Kong.

Accordingly, your personal data may be transferred to, and stored or processed in, jurisdictions outside Hong Kong whose data protection laws may differ from the PDPO. Where we transfer personal data outside Hong Kong, we take reasonable steps to ensure that it is protected to a standard comparable to that under the PDPO, including through contractual obligations imposed on the receiving service providers, and we transfer only the data necessary for the relevant purpose.

By using the Services, you acknowledge that such transfers are necessary for the provision of the Services described in this Privacy Policy.

7. Your Data Rights

Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:

request access to your personal data held by Gavelic (a “data access request”)
request correction of personal data that is inaccurate (a “data correction request”)
ascertain Gavelic’s policies and practices in relation to personal data and the kinds of personal data held

In addition, subject to applicable law, you may request deletion of your account or personal data, and withdraw any consent previously given (which will not affect processing carried out before withdrawal).

Data access requests and data correction requests should be addressed to the Data Protection Officer using the contact details in Section 11. We will respond to a data access request within forty (40) days as required by the PDPO. We may charge a fee for complying with a data access request, limited to what is permitted under the PDPO (a fee that is not excessive and reflects the cost of compliance). Requests may be refused only on grounds permitted by the PDPO (for example, where compliance is prohibited by law or would disclose another individual’s personal data without their consent), and where a request is refused, we will inform you of the reason.

Certain records (including transaction, payment, identity verification, and security records) may be retained notwithstanding a deletion request, where retention is required by law or necessary for the purposes described in Section 6.

8. Account Closure

You may request closure of your account.

Closing your account does not automatically require Gavelic to delete all information where retention is necessary for:

legal compliance
fraud prevention
payment dispute handling
transaction record keeping

9. Cookies and Similar Technologies

Gavelic may use cookies and similar technologies to:

maintain login sessions
improve user experience
analyse platform performance
enhance security

Users may manage cookie preferences through their browser settings.

10. Changes to This Privacy Policy

Gavelic may update this Privacy Policy from time to time. Where changes are material, Gavelic will notify users through website announcements, application notifications, email, or other reasonable electronic methods before the changes take effect.

Continued use of the Platform after non-material changes take effect constitutes acceptance of the updated Privacy Policy. However, where a change involves using your personal data for a new purpose not directly related to the purposes described in this Privacy Policy at the time of collection, we will not use your data for that new purpose unless we have obtained your express consent as required by the PDPO.

11. Contact Information

If you have questions regarding this Privacy Policy, or wish to make a data access request, data correction request, or exercise any other privacy right, please contact:

Company: JM Squared Ltd
Platform: Gavelic
Attention: Data Protection Officer
Email: [email protected]

If you are not satisfied with our handling of your personal data, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

12. Language

This Privacy Policy may be translated into different languages.

If there is any inconsistency between the English version and any translated version, the English version shall prevail.

Gavelic Privacy Policy