Privacy Policy

Auxilot is an online auction platform operated by Vortex Lab Limited ("Auxilot", "we", "us"), Plot 9 Basangwa Lane, Muyenga, Kampala, UG. This Privacy Policy explains what personal data we collect when you visit, register on, bid on or sell through Auxilot, how we use and share it, and the rights you have.

Vortex Lab Limited is the data controller for the personal data described here. We are registered with the Personal Data Protection Office of Uganda and process personal data in line with the Data Protection and Privacy Act, 2019 and its Regulations, and other data protection laws that apply to you.

When you register

• Personal accounts: first, middle and last name, gender, date of birth, nationality, email address, phone number, ID type and ID number, TIN (if given), residential address, and any referral code you used.
• Business accounts: business name and type, registration (BRN / certificate of incorporation) number and date, TIN, business email, physical address and country of registration, plus the name, gender, date of birth, nationality, contact details and ID details of the contact person.
• Documents you upload to support your registration, such as copies of identity or business registration documents.
• Your password, which we use only to sign you in.

When you bid or buy

• Deposits: the lot, amount, currency, payment channel and provider, the phone number or account used to pay, payment references and the approval status.
• Bidding: your bids, proxy maximums, the lots on your watchlist, outbid status and auction results.
• Invoices and payments: invoice details, amounts paid, payment method and reference, and payment dates.

When you sell

• Details of your business and the staff who use the back office, and the lots, photos, documents and auction settings you submit.

When you contact us

• Your name, email, phone number and the content of messages you send through the contact form, by email or on WhatsApp.

Collected automatically

• Sign-in and security data: one-time code (OTP) requests, sign-in times, session tokens, IP address, device and browser details.
• Records needed to protect the Platform, such as request rates and suspected abuse.
• Data stored in your browser to keep you signed in and remember preferences such as the theme (see Cookies and Local Storage).

• To create and manage your account, confirm your identity, and send one-time codes to sign you in.
• To run auctions: record deposits and bids, apply proxy bids, decide winners, and show you your bids and results.
• To send you service messages, such as one-time codes, deposit updates, outbid alerts, ending-soon reminders, winning notices and invoices.
• To issue invoices, collect payments, return deposits and keep financial and tax records.
• To let the Seller and the Winning Bidder of a lot contact each other to complete the sale.
• To prevent fraud, bid manipulation, spam and unauthorised access, and to keep the Platform secure.
• To answer your questions and complaints, and to enforce our Terms of Service.
• To comply with the law, including tax, anti-money laundering and lawful requests from authorities.
• To send news and offers, only where you have agreed to receive them. You can opt out at any time.

We process your personal data because:

• it is needed to provide the services you signed up for and to perform our contract with you (the Terms of Service);
• we must do so to comply with the law, such as tax and anti-money laundering rules;
• it is in our legitimate interest to keep auctions fair and the Platform secure, in ways that do not override your rights; or
• you have given your consent, for example to marketing messages. You can withdraw consent at any time.

We do not sell your personal data. It is shared only as follows.

Other bidders

• Other bidders do not see your name or contact details. The lot page shows the price, bid activity and your own status to you.

Sellers

• While bidding is open, sellers see bidders only under a pseudonym (for example BD-3F9A1C), and the same bidder has a different pseudonym with each seller.
• When you win a lot, the seller of that lot receives your name, email, phone number, address and TIN (if given) so that the sale can be completed. You also receive the seller's contact details.
• Sellers may use these details only to complete that sale.

Auxilot staff

• Our staff can access personal data only as far as their role needs. Revealing the identity behind a bidder pseudonym requires a specific permission and a recorded reason, and every reveal is logged.

Service providers

• Hosting and storage providers that run the Platform and store lot images and documents.
• SMS and email providers that deliver one-time codes and notifications.
• Banks, mobile money operators and other payment providers that process deposits and invoice payments.
• Google reCAPTCHA, which we use to protect sign-in, registration and other forms from automated abuse. It collects device and usage information under Google's Privacy Policy and Terms.
• These providers may use your data only to provide their service to us.

Legal and safety

• Where the law requires it, for example to tax authorities, regulators, the police or a court.
• To protect the rights, property or safety of Auxilot, our users or the public, including to investigate fraud or a breach of our Terms.
• To a buyer or successor if our business is sold or reorganised, under the same protections described here.

Some of our service providers store or process data outside Uganda. When that happens, we take steps to make sure your data has a level of protection equal to that required by Ugandan law, as the Data Protection and Privacy Act requires.

• Account and identity data: while your account is open, and afterwards for as long as we need it to meet legal, tax or anti-money laundering obligations, or to deal with disputes.
• Deposits, bids, invoices and payments: for as long as the law requires us to keep financial and tax records.
• Security and sign-in records: for a limited period, only as long as needed to protect the Platform and investigate incidents.
• Contact messages: for as long as needed to deal with your request, and then for a limited period in case you follow up.

When we no longer need personal data, we delete it or make it anonymous.

• Essential: we store a session token and related data in your browser to keep you signed in and secure your session. The Platform does not work without them.
• Preferences: we remember choices such as light or dark theme.
• Security: Google reCAPTCHA may set its own cookies to tell people from automated tools.

You can clear or block cookies and site data in your browser settings, but you will then be signed out and some features may stop working.

• All traffic to the Platform is encrypted with HTTPS.
• Signing in requires a one-time code as well as your password.
• Access for staff and sellers is controlled by role, and sensitive actions are logged.
• Bidders are shown to sellers under pseudonyms, and secret information such as reserve prices and proxy maximums is never shown publicly.
• We limit request rates and monitor for abuse.

No system is completely secure. If you think your account or data has been put at risk, contact us immediately at info@vortexlabug.com.

Under the Data Protection and Privacy Act, 2019 you have the right to:

• be told what personal data we hold about you and get a copy of it;
• ask us to correct data that is inaccurate, out of date or incomplete;
• ask us to delete data we no longer have a lawful reason to keep;
• object to processing, including direct marketing, and withdraw consent you have given; and
• complain to the Personal Data Protection Office of Uganda if you are unhappy with how we handle your data.

To use any of these rights, contact us at info@vortexlabug.com. We may need to confirm your identity first. Some data must be kept even after a deletion request, for example records of bids, invoices and payments that the law requires us to keep.

Auxilot is only for people aged 18 and over. We do not knowingly collect data from children. If we learn that a child has registered, we will close the account and delete the data unless the law requires us to keep it.

We may update this Privacy Policy. The date of the latest version is shown at the top of this page. We will tell registered users about material changes before they take effect.

For questions or requests about this Privacy Policy or your personal data:

• Vortex Lab Limited
• Address: Plot 9 Basangwa Lane, Muyenga, Kampala, UG
• Email: info@vortexlabug.com