Privacy Policy

Version 1.0. Effective date: not yet in force. Last drafted 3 August 2026.

This policy explains how Worldwatch ("we") processes personal data when you use our platform, visit our websites, or interact with a dealer who sells through us. We are a business-to-business marketplace for luxury watches: our users are professional dealers, and this policy is written first for the people behind those businesses, owners, representatives and staff, as well as for buyers whose data reaches us through orders, and visitors to our websites.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Dutch law.

1.Who is responsible for your data

The controller for the processing described in this policy is:

Worldwatch.market B.V.
Damsterdiep 10, 9711 SK Groningen, the Netherlands
Chamber of Commerce (KvK): 98632329
VAT: NL868577091B01
Email: privacy@worldwatch.so

We have not appointed a Data Protection Officer. For all privacy matters, contact the email address above.

For certain processing, Worldwatch and the dealer you interact with act as joint controllers. Section 5 explains what that means and how responsibilities are divided.

2.Whose data we process

• Dealer representatives and staff, the people who register, operate and use a dealer account on our platform.
• Buyers and counterparties, people whose details appear in orders, offers and transactions processed through the platform. The Marketplace itself is open to professional dealers only; buyer personal data typically reaches us when a dealer's sales on connected channels (for example eBay) are synchronized into the platform. Should the Marketplace open to other user groups in the future, this policy will be updated first.
• Prospective users, people who contact us, request a demo, or sign up for updates.
• Website visitors, anyone browsing our public websites.
• Ultimate beneficial owners and representatives verified during onboarding and compliance checks.

3.What we collect and where it comes from

Directly from you:

• Account and profile data: name, business email, phone number, role, and authentication data (managed by our login provider, Clerk).
• Business onboarding data: company details, Chamber of Commerce extracts, VAT numbers, and, where identity verification is required, identity document data processed through Stripe Identity.
• Communications: support requests, messages sent through the platform, and correspondence with our team.

From your organization: a colleague may add you as a user, in which case we receive your name, email and role from your employer.

Generated by your use of the platform: listings, orders, offers, transaction records, activity logs, and technical data (IP address, device and browser information, error diagnostics).

From third parties:

• Connected sales channels (such as eBay): order and buyer details for transactions on those channels, synced into the platform on the dealer's behalf.
• Public registers (such as the Dutch Chamber of Commerce) and our verification providers, for onboarding and compliance checks.
• Payment providers: confirmation and status data for payments. We never receive full card numbers.

4.Why we process your data and on what legal basis

Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You may object at any time (Section 10).

5.Joint controllership with dealers

For transaction data, meaning orders, buyer details, and communications between a dealer and their counterparties processed through the platform, Worldwatch and the dealer are joint controllers under Art. 26 GDPR. The essence of our arrangement:

• Worldwatch is responsible for the platform's processing infrastructure, its security, the engagement of processors listed in Section 6, honoring data-subject rights for platform-level processing, and the retention rules described in Section 7.
• The dealer is responsible for the accuracy of the data they enter, the lawfulness of their own downstream use of transaction data (for example their own customer administration and marketing), and their own sale terms toward their counterparties.
• Contact point: you can exercise your rights for all platform processing through Worldwatch at the address in Section 1, regardless of this division. We will coordinate with the relevant dealer where needed.

6.Who receives your data

We use carefully selected service providers (processors) to run the platform. All processing is governed by data processing agreements.

Independent recipients (separate controllers): connected sales channels such as eBay process buyer and order data under their own privacy policies. Payment providers also act as independent controllers for parts of their regulated activities. Competent authorities may receive data where we are legally required to provide it.

Where data leaves the European Economic Area, we rely on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses, with additional safeguards where appropriate.

7.How long we keep your data

Our systems are built for verifiable erasure: personal data is encrypted with per-person keys, and when a retention period ends or an erasure request is honored, the key is destroyed, rendering the data permanently unreadable, including in backups. Where the law requires us to keep records (such as the 7-year tax retention), erasure takes effect when that period expires.

8.Automated decision-making, profiling, and AI

• Trust and risk indicators. We maintain internal trust and risk indicators for accounts, derived from platform history, to prioritize reviews and protect the marketplace. Enforcement decisions with legal or similarly significant effects (such as suspension or removal) are taken with human review, never by automated means alone. Where automated tools contributed to a moderation decision, we disclose this in the statement of reasons you receive.
• Fraud detection. Automated rules may flag suspicious activity for human investigation.
• AI-assisted features. Parts of the platform use AI models (Google Gemini and Vertex AI) to assist dealers, for example generating listing and advertisement texts, assisting with listing creation, and suggesting prices based on market data. These features operate on listing and market data rather than on personal data, and we do not send contact details such as phone numbers to them. Under Google Cloud's service terms, the data we send is not used to train Google's models.
• Ranking. How listings are ranked in marketplace search is described on our Ranking Disclosure.

You have the right to obtain human intervention regarding any automated decision, to express your point of view, and to contest the decision.

9.How we protect your data

Data is hosted in the European Union (Netherlands region). We apply encryption in transit and at rest, per-person encryption keys enabling verifiable erasure, access controls and audit logging, EU data residency for monitoring tooling, and vulnerability management across our infrastructure. No system is perfectly secure. If a breach occurs that risks your rights, we will notify the Dutch Data Protection Authority and, where required, you, in accordance with Arts. 33 and 34 GDPR.

10.Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, and to receive personal data you provided in a portable format. These rights apply to personal data of natural persons. They do not extend to business data such as inventory, pricing, or the sales records of a dealer account.

To exercise a right, email privacy@worldwatch.so. We verify your identity, respond within one month (extendable by two months for complex requests, in which case we inform you), and never charge for a first request unless it is manifestly unfounded or excessive.

Limits you should know about honestly:

• Order and transaction data subject to the 7-year tax retention cannot be erased before that period expires. Erasure is scheduled and takes effect when the retention ends.
• Requests are currently handled by our team rather than through self-service tooling. The one-month statutory deadline always applies.

You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority of your EU member state.

11.Cookies

Our websites set only cookies that are strictly necessary for authentication and security, plus preference cookies that remember your language choice and whether you dismissed the language banner. We set no advertising cookies, and our page analytics and performance measurement are cookieless and do not identify individual visitors. Every cookie and browser storage key, its lifetime and your choices are listed in the Cookie Policy.

12.Changes to this policy

We may update this policy as the platform and the law evolve. Material changes are announced to account holders in advance through the platform or by email. The current version is always available at worldwatch.so/legal/privacy, with its effective date at the top.

13.Contact

Worldwatch.market B.V., privacy@worldwatch.so, Damsterdiep 10, 9711 SK Groningen, the Netherlands.