Privacy Policy

Last updated: June 25, 2025

Welcome to Trainbid! Please read this Privacy Policy carefully before using the website located at www.trainbid.com, the Trainbid mobile or desktop applications available on the App Store and Google Play (collectively, the “Apps”), or any Trainbid application programming interfaces (“APIs”). These components, the Website, Apps, and APIs, are collectively referred to as the “Platform.”

The Platform is owned and operated by Trainbid LLC, a limited liability company formed under the laws of the State of California, United States. Trainbid LLC operates under multiple brand names, including but not limited to “Trainbid,” “Train Bid,” “Train Bid LLC,” “Hobbybid,” and “Hobby Bid LLC.” Any reference to the “Company,” “we,” “us,” or “our” in this Privacy Policy refers to Trainbid LLC and its associated brands.

Trainbid operates a digital marketplace that connects Buyers and Sellers in the space of model trains, wargaming merchandise, collectible toys, and related products. The term “Services” in this Privacy Policy refers to all functionality, tools, and service offerings made available by the Company through the Platform.

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use the Platform and our Services, and outlines your rights in relation to your personal information under applicable privacy laws.

We process all personal data that we collect from our users in compliance with the personal data protection laws of the jurisdictions where we offer the Platform, including but not limited to the European Union General Data Protection Regulation 2016/679 (EU GDPR), UK General Data Protection Regulation (UK GDPR), Australian Privacy Principles as set out under the Privacy Act 1988 (Cth), New Zealand Privacy Act, 2020, and the U.S. Privacy Laws.

If you do not agree with any provision of this Privacy Policy, please do not access the Platform.

Scope

This Privacy Policy only applies to individuals who use the Service or subscribe to our mailing list.

Definitions

When used in this Privacy Policy, the following words shall have the meaning as defined below:

Data Controller

Trainbid LLC is the Data Controller of all personal data collected through the Platform. You can request information regarding our privacy practices or exercise your rights outlined in Section 9 of this Privacy Policy by sending your request in writing to:

[INSERT BUSINESS ADDRESS]

Alternatively, you can send us an email at: [INSERT EMAIL ADDRESS]

What personal data do we collect from you?

The information we collect from you includes but is not limited to your:

• Full name;
• Date of birth
• Phone number;
• Email address;
• Home address;
• Billing address;
• Shipping address;
• Photos and videos you upload (including any profile photos, Listing photos/videos, and other similar information);
• Content of any messages you send or receive through the Platform;
• Content of all communication you have with the Company;
• Transaction information (such as the date of Transaction, Total Sale Price, Shipping details, etc.);
• Tax Resale License (if applicable);
• Bank Account Information;
• Public and Private Review you submit or receive;
• Information that you provide us when you participate in our surveys or promotions;
• Your log data, including your browser type, time and pages you visit, your IP address, etc.;
• Device data including the mode and make of your device, operating system, and unique device identifiers;
• Location data;
• Information is collected through the use of cookies and other tracking technologies.

How do we collect and use your information?

You voluntarily provide us with some personal data when you use the Platform, and there is some personal data that we can collect automatically from your use. Whether we receive your personal data directly from you or automatically, we will only process it if we have a legal basis, such as your consent, the performance of a contract, or legitimate interest that does not override your rights.

You may decline to provide any personal data when requested by the Company. However, you understand that your refusal to provide any personal data required for the provision of our Platform features and functionality may result in us being unable to deliver the Service to you.

Voluntarily submitted Information

• 1. When you sign-up for a user account (‘registration data’)

When you sign-up for a user account on the Platform, you provide us with some personal data, including your full name and email address. If you register for a paid subscription plan, you will also be required to provide your payment card details to our payment processor. We use this personal data to:

• • Create your user account on the Platform;
    • Enable you to securely sign in to your user account and make use of the Platform features and functionality;
    • Bill you for your selected plan;
    • Send account-related notices to you within the Platform and via email linked to your account; and
    • Contact you as and when needed.

Legal basis

Depending on the Service used by our user, we rely on the following legal basis to process our users’ data:

• Art 6, 1(b) of the EU GDPR, the controller may process data if necessary for the performance of a contract to which the data subject is a party;
• Art 6, 1(f) of the EU GDPR, the controller may process data if the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party which does not override the data subject’s rights.

Retention Period

We will delete this data within 60 days from the termination date of your user account. Please note that we may be allowed to keep your registration data for longer on other lawful grounds.

• 1. Service Specific Data

When you use the Platform to sell or buy Items, whether in Auctions or for Buy It Now Price, depending on your selected Service, you may be requested to provide us with some additional personal information, including but not limited to:

• your social security number (SSN), employer identification number (EIN), or individual taxpayer identification number (ITIN),
• your bank account details,
• your credit card data (collected by Payment Processor),
• your phone number,
• your date of birth,
• your Transaction data (the Item you purchase, Item sale price, applicable sales tax, etc.),
• your shipping address,
• your billing address, and
• your sales tax resale certificate.

We process this data for purposes including but not limited to:

• Verifying your identity;
• Enabling you to create Listings, Auctions, and buy/sell through your account;
• Process any Transactions you enter through the Platform;
• Facilitating the payments for your Transaction;
• Remit the funds to the Seller’s account in accordance with the Terms and Conditions;
• Our internal business/accounting purposes;
• Enforce your rights and obligations under any Transaction;
• Enforce our Agreement with you;
• Issue Form 1099-K (where applicable);
• Assisting with Transaction related disputes; and
• Contact you as and when needed.

Legal basis

Depending on the Service used by our user, we rely on the following legal basis to process our users’ data:

• Art 6, 1(b) of the EU GDPR, the controller may process data if necessary for the performance of a contract to which the data subject is a party;
• Art 6, 1(f) of the EU GDPR, the controller may process data if the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party that does not override the data subject’s rights.

Retention Period

We reserve the right to retain this data for up to five years after the termination of your user account for our business accounting and compliance purposes.

• 1. Communication and Messaging Data

We collect information that you directly submit when you use our built-in messaging functionality to communicate with other users or send any support requests to the Company.

All communications made through or related to the Platform, including buyer-seller messages, customer support inquiries, dispute resolution messages, and any other communications involving Platform features, may be accessed, monitored, and retained by the Company for the following purposes:

• Detecting and preventing fraud, spam, harassment, or other unauthorized activities on the Platform;
• Investigating user disputes or complaints;
• Enforcing our Terms and Conditions and this Privacy Policy; and
• Ensuring the integrity and safety of the Platform.

We may also use automated tools, including keyword scanning technologies, to help identify messages that potentially violate our Terms and Conditions, contain fraudulent content, or pose a risk to other users or the Platform.

Only authorized personnel have access to this data, and we do not disclose the content of monitored communications unless required by law or as otherwise permitted under this Privacy Policy.

By using the Platform, you expressly consent to the monitoring, access, and retention of your communications as described in this Privacy Policy and our Terms and Conditions. To the extent permitted under applicable law, you waive any expectation of privacy in such communications and consent to their use by the Company. This includes, without limitation, any waiver required under the California Invasion of Privacy Act (CIPA), the Electronic Communications Privacy Act (ECPA), and other applicable federal or state communication privacy laws.

Legal basis
Our legal basis for processing this data is Art 6, 1(f) of the EU GDPR, which provides that the controller may process data if the processing is necessary for the purposes of legitimate interests pursued by the controller which does not override the data subject’s rights.

Retention Period
We may retain communication and messaging data accessed for monitoring or enforcement purposes for up to 180 days after the communication occurs or until the resolution of any pending dispute, whichever is later. We may retain this data for longer if required by law or in connection with a legal proceeding.

Please note: Messages stored in your user account inbox may remain accessible to you for the duration of your active account, unless you delete them or they are removed in accordance with our Terms and Conditions.

• 1. Phone Number and Messaging Consent Data

We collect your phone number when you create a user account, initiate a Transaction, subscribe to receive marketing communications, contact us through our support channels, or participate in our promotions. By submitting your phone number, you consent to its use for the purposes described below.

We use this information to:

• Verify your identity and secure your user account;
• Send transactional messages such as order confirmations and shipping updates;
• Deliver customer support responses; and
• Send marketing and promotional communications, where you have provided your prior consent.

We may use trusted third-party communication providers, such as Twilio Inc., to deliver SMS (text) messages or voice calls on our behalf. These messages may be sent using automated technology, including autodialers or prerecorded voice messages, where permitted by applicable law.

If you have opted in to receive marketing SMS communications, message frequency may vary depending on activity. Standard message and data rates may apply. You may opt out of receiving promotional text messages at any time by replying “STOP” to an SMS or by contacting us at support@trainbid.com. Please note that even after you opt out of promotional messages, you may continue to receive essential service-related communications unless your user account is deleted.

Legal basis
Our legal basis for processing this data is:

• Art 6, 1(b) of the EU GDPR which provides that the Controller may process data if necessary for the performance of a contract to which the data subject is a party; and
• Art 6, 1(f) of the EU GDPR which provides that the controller may process data if the processing is necessary for the purposes of legitimate interests pursued by the controller which does not override the data subject’s rights.

Retention Period
We will retain your phone number for as long as your user account remains active. If you terminate your account, we will delete your phone number within 60 days unless we are required to retain it for longer on other lawful grounds.

Regional Compliance

• United States: We comply with the Telephone Consumer Protection Act (TCPA). By providing your phone number, you consent to receive communications as described above, to the extent permitted by law.

• Canada: We comply with Canada’s Anti-Spam Legislation (CASL) and only send marketing communications if you opt in.

• UK/EU: We comply with GDPR and the Privacy and Electronic Communications Regulations (PECR). Marketing SMS will only be sent with prior opt-in consent, which can be withdrawn at any time.

  1. User Content Data

When you post, upload or submit your user content on the Platform, such as Item images or videos, Listing descriptions, ratings and reviews, or other similar content, we process the information contained in your user content for the following purposes:

• make your user content available on the Platform and accessible to other users;
• detect and prevent any fraud or other similar unauthorized activities on the Platform.

Legal basis

Our legal basis for processing your user content is Art 6, 1(f) of the EU GDPR, the controller may process data if the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party that does not override the data subject’s rights.

Retention Period

We reserve the right to retain this data for up to 60 days after the termination of your user account.

• 1. Participation Data

We collect the information you directly submit to us when you subscribe to receive marketing material from us or participate in our surveys/promotions.

We use this information to:

• Send you marketing material that we think you will find interesting;
• Create new service offerings or improve our existing Service;
• Fulfill any other purpose specified at the time we collect your information.

Legal basis

Our legal basis for processing this personal data is Art 6, 1(a) of the EU GDPR, which provides that the controller may process data if the data subject has given consent for that purpose. You may withdraw your consent anytime by exercising your rights, and we will cease processing your personal data for direct marketing purposes.

Retention

We will delete this data immediately upon your request or when your user account is terminated.

Automatically Collected Information

When you access and make use of the Platform, we automatically collect some data about you, such as:

• 1. Usage Data

We automatically collect some data about you when you use our Platform, such as

• Your interaction with Company Content and User Content;
• The searches you perform on the Platform;
• The time and date of your visits and other similar data.

We use this data for purposes, including but not limited to:

• Maintaining and improving our Platform;
• To improve our Service offering and create new Services;
• To guide our marketing strategy.

Legal basis

Our legal basis for processing this personal data is Art 6 1(f) of the EU GDPR, which provides that the controller may process data if the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party which does not override the data subject’s rights.

Retention

We will delete this data within 30 days after the termination of your user account.

• 1. Technical Data

We automatically collect some technical data from you when you access our App, including but not limited to:

• Your Internet Protocol (IP) address,
• Your browser type and version.

We use this data for purposes, including but not limited to:

• To make the Platform available on your device;
• Maintaining and improving our Platform;
• To improve our Service offering and create new Services;
• Detecting and preventing fraud or other similar unauthorized activities;
• To send you system updates and alerts.

Legal basis

Our legal basis for processing this personal data is Art 6 1(f) of the EU GDPR, which provides that the controller may process data if the processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party which does not override the data subject’s rights.

Retention

We will delete this data within 30 days after the termination of your user account.

Information we collect from third parties

• 1. When you sign-up or sign in through a third-party service (“Social Data”)

When you sign-up for a user account using third party services such as Google, Apple, or Facebook, we will collect some information from the third-party service provider, such as your username, age, and other publicly available information in accordance with the authorization procedures of the third-party service provider.

We use this data to enable you to log into your user account using a third-party service.

Legal basis

Our legal basis for processing this personal data is Art 6, 1(b) of the EU GDPR, which provides that the controller may process data if necessary for the performance of a contract to which the data subject is a party.

Retention

We will delete this data immediately upon the termination of your user account.

Disclosure of your data

We respect your personal data, and we only share your personal data as described hereunder:

• 1. Sharing data between users

The Platform enables Sellers and Buyers to connect, communicate, and transact with each other which requires the Platform to make some personal information about our users accessible to other users. For example, when you buy an Item through the Platform, we make your shipping address available to the Seller to enable the Seller to ship the Item to you; or if you send messages to the other users through the Platform, your public profile and the content of your message will be made available to the intended recipient.

• 1. Third-Party Service Providers

We may share and disclose your personal data with third-party service providers that we engage during the performance of our business operations, such as web hosting, payment processing, identity verification, email distribution, communication delivery, marketing, and customer support services. Some third-party service providers we use include, for example:

• Stripe, Inc., with whom we share your identity and payment information to process payments and verify your identity where required; and
• Twilio Inc., with whom we share your phone number and message content to deliver transactional and marketing SMS or voice communications, including those sent using automated technologies where permitted by law.

By using the Platform and submitting this information, you consent to us sharing it with such providers to the extent necessary for the provision of our Services and compliance with applicable laws.

For the avoidance of any doubt, we will only disclose your personal information that is necessary for our service providers to perform their functions on our behalf. Our service providers will only use your personal data as authorised by us. In no event will they be allowed to use it for any purpose other than those specified in this Privacy Policy.

• 1. Change of Ownership

If, in the future, we buy a business or are acquired by another business, our users’ personal data may be disclosed to the new entity as part of due diligence and transferred as part of the commercial transaction. We assure you that in the event of any such changes in ownership, your personal data will continue to be governed by this Privacy Policy, except in cases where you expressly consent otherwise.

• 1. Compliance with the laws

In some circumstances, we may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities.

• 1. To protect ourselves or our users

We may disclose your personal data to:

• • law enforcement authorities and other government bodies to comply with the law;
    • enforce our Agreement with you;
    • defend ourselves in legal actions; or,
    • protect our users or others from threats posed by your actions by sharing your data with other organizations as part of fraud protection.

Data Security

Our Platform is designed with the security of data in mind. We use a secure third-party payment processor to collect and process our users’ payment data, so none of the sensitive financial data is collected or stored in our database. We also restrict access to data within our Company on a need-to-know basis to prevent unauthorized access to any user’s personal data. All user accounts are password-protected, and we restrict the use of an account by multiple users.

Regardless of the security measures that we have put in place, you acknowledge that data transmission over the internet is never one hundred percent secure. Accordingly, we cannot offer any guarantees regarding the absolute security of your personal data.

Storage

Our Platform is maintained and operated from our head offices in the United States of America. By using the Platform, you agree to the transfer of your personal information to the United States of America where it will be processed in accordance with this Privacy Policy.

Data Subject Rights

• 1. Account Data

You have the right to access and edit your user content by accessing your account. You can view all your user content (such as your Listings, bids, sales, purchases, ratings, and reviews) under your account on the Platform. If you wish to request the deletion of any personal data, please contact us at the email address provided at the bottom of this policy, and we will respond to your request. Please note that for security reasons, we may verify your identity before deleting your account. If you fail to provide such requested information, we will not be able to delete your account.

• 1. Marketing Data

When you opt-in and subscribe to receive marketing communication from us, we may send you marketing materials via email. You have the choice to withdraw your consent from receiving direct marketing material from us at any time by simply clicking the unsubscribe link in our email. Please note that we may still send you service-related notices and policies for as long as you have an account on the Platform.

• 1. Complaints

Individuals in the European Union or European Economic Area (EEA) have the right to file a complaint against any infringement of their data rights by contacting their local data protection authority.

U.S. Privacy Laws

Use of the Platform is subject to a binding arbitration clause under the Terms and Conditions.

• 1. California Online Privacy Protection Act (CalOPPA)

Train Bid LLC does not sell your personal data to any third parties. If you reside in the State of California, you have the right to request information regarding the disclosure of your personal information by the Company to third parties for direct marketing purposes. If you wish to make a request, please contact us at the contact details provided at the bottom of this Privacy Policy. We will make our best effort to respond to you within 15 business days.

You also have the right to request information about our privacy practices, how we collected your personal data, and with whom we share your personal data. You may make specific requests to exercise the aforementioned rights by sending a support request.

CalOPPA also requires us to inform our users how we respond to Do Not Track (“DNT”) signals when the user visits our Website. Please note that we currently do not respond to DNT signals.

• 1. Children Online Privacy Protection Act (COPPA)

The Children’s Online Privacy Protection Act (COPPA) puts parents in control of the collection of personal information from children under the age of thirteen. In compliance with the COPPA Rule, we do not knowingly collect any personal information from children under the age of 13. If you are a parent of a child who has submitted any personal information on the Platform, you have the right to manage, delete, or review your child’s information by contacting us at [INSERT EMAIL ADDRESS].

• 1. CAN-SPAM Act

In compliance with the CAN-SPAM Act, we agree that:

• • 1. If a message we send you is an advertisement, we will identify it in a reasonable way. 2. We will enable you to unsubscribe from our emails using the unsubscribe link from the bottom of our email. 3. We will honor your decision to opt out of receiving emails from us. 4. We will not mislead you by using any misleading subjects or email addresses. 5. We will include our business address in our correspondence with you.

Lei Geral de Proteção de Dados Notice for Brazil Residents

This provision integrates with and supplements the information contained in this Privacy Policy and applies to all users who reside in Brazil. In the event of any conflict between this provision and any other provisions of this Privacy Policy, this provision shall prevail for users who are residents in Brazil. For the purposes of this provision, any use of the term “personal information” shall have the meaning as defined in the Lei Geral de Proteção de Dados (“LGPD”).

What personal information do we process?

To find out what personal information we collect from you, please read Section 4 of this Privacy Policy.

What is our purpose for processing your personal information?

To find out the purpose for which we process your personal information, please read Section 5 of this Privacy Policy.

Legal basis for processing your personal information

We will only process your personal information if we have a legal basis. Our legal basis for processing your personal information includes:

• Performance of our contract with you;
• Your consent to our processing of your personal information;
• Our legitimate interests in processing your personal information to the extent that our interest does not override your fundamental rights;
• Compliance with our legal obligations;
• Fulfillment of any legal, regulatory, or contractual public policies;
• For anonymous research and analysis purposes;
• To protect the physical safety and any person;
• To exercise our rights in any judicial, administrative, or arbitration proceedings.

Your Privacy Rights

LGPD gives you the right to:

• Receive confirmation whether your personal information is being processed (‘processing confirmation’);
• Access your personal information that is processed;
• Rectify any outdated, inaccurate, or incomplete personal information;
• Request removal, anonymization, or blocking of any personal information that is not processed in accordance with LGPD;
• Request and receive information on whether you can withdraw or grant your consent and the consequences thereof;
• Withdraw your consent;
• Receive information about with whom your personal information is shared;
• Receive all your personal information that the Company has on you in a portable and machine-readable manner;
• Request deletion of your personal information that was being processed on the legal basis of your consent, except in cases where one of the exceptions listed in Art 16 LGPD applies;
• Lodge a complaint with the National Data Protection Authority or other consumer protection entities for your personal information;
• Object to the processing of your personal information if such processing is not in compliance with the law;
• Request information regarding what criteria and procedures are used for making an automated decision; and
• Request a review of any decisions made solely on the basis of automated processing of your personal information where your interests are affected.

How to exercise your privacy rights?

You can exercise your privacy rights by submitting your request to the Company at the contact information provided at the end of this Privacy Policy.

We make our best effort to respond to all requests promptly. Where we are unable to comply with your request, we will clearly communicate our legal or factual reasons for the same. If you exercise your right to request personal information processing confirmation or access to your personal information, please indicate whether you would like an electronic or printed copy of such information.

When you request us to respond to your request immediately, we will provide you with a summary version of your requested information. However, where you request a complete disclosure, we will respond to your request within 14 days from the time of your request and provide you with all the details, including the origin of your personal information, the purpose of processing, and the criteria used for processing while safeguarding our business secrets.

Where you request us to rectify, delete or anonymize your personal information or you make personal information blocking request, we will immediately pass on your request to the parties with whom we have shared your personal information to enable such other parties to honor your request except in cases where it is either impossible or would involve disproportionate effort on our part.

Transfer of personal information

LGPD allows us to transfer our users’ data outside of Brazil in the following circumstances:

• In accordance with legal means provided by international law and where such transfer is required for international legal cooperation between public intelligence, investigation, and prosecution bodies;
• Where such transfer is required to protect you or another person from any threat to life or physical harm;
• Any transfer resulting from commitments made under international cooperation agreements;
• Any transfer authorized by the National Data Protection Authority;
• Where a transfer is required for executing any public policy;
• Where a transfer is required for compliance with a legal, regulatory or contractual obligation;
• Where a transfer is required to exercise our rights in any judicial, administrative, or arbitration proceedings.

Third-Party Links

The Platform may contain links to third-party websites that are not owned or operated by us. Should you decide to click on any such third-party links, you will be directed to such a third party’s website. These third-party websites are governed by their own Terms and Conditions and Privacy Policy. We encourage our users to review the third-party Terms and Privacy Policy before using such services. The presence of any third-party links on our Platform does not constitute an endorsement or recommendation of such a third party, and we cannot be held responsible for such a third party’s actions.

Amendments

From time to time, we may amend this Privacy Policy to reflect our new privacy practices and commitment to compliance with applicable privacy laws and regulations. We will post the updated Privacy Policy on this page and notify you of such updates by changing the last updated date on the top or by sending an email. You should review this Privacy Policy regularly to ensure that you are familiar with any changes. You understand and accept that your continued use of the Platform after the update's effective date will be deemed your tacit acceptance of any updated privacy practices.

Contact us

If you have any questions, comments, or inquiries regarding this Privacy Policy, please contact us at:

Email: support@trainbid.com