1. Welcome to our website!
This Privacy Policy explains how Gavel collects, uses, stores, and shares personal data when you use our auction marketplace.
By using Gavel, you agree to the data practices described in this policy. If you do not agree, you should discontinue use of the Platform.
2. Information We Collect
- Account data such as email, username, avatar, phone, and address
- Auction activity such as bids, watch history, timestamps, and outcomes
- Token and payment records including references, status, and transaction logs
- Technical and security data such as IP-related logs, browser metadata, and usage events
- Seller verification data: business name and type, phone, address, Ghana Card number, and images of your Ghana Card
- Delivery details where you request delivery: recipient name, phone number, address, and delivery instructions
3. Seller Identity Verification (Ghana Card)
To sell on Gavel you must verify your identity. We collect your Ghana Card number and images of your Ghana Card to confirm who you are, prevent fraud, and meet our obligations when handling payments on behalf of sellers.
Ghana Card images are stored in private storage that is not publicly accessible. They are viewed only by authorised Gavel administrators reviewing your application, through links that expire after a few minutes. We do not use this data for marketing and do not sell it.
4. How We Use Information
- Operate auctions, reserve checks, and winner fallback payment windows
- Process token purchases and auction payments through payment providers
- Detect and prevent fraud, abuse, and platform manipulation
- Provide support, service updates, and account security actions
- Improve reliability, performance, and user experience
5. Legal Bases and Compliance
We process personal data where needed to provide the service, comply with legal obligations, prevent fraud, and protect users and the Platform.
7. International Data Transfers
Some of our service providers store or process data outside Ghana. Our main database is hosted in the European Union (Ireland), and some providers operate in the United States. Where data leaves Ghana, we rely on providers that apply recognised security safeguards, and we transfer only what is needed to run the service.
8. Data Retention
We retain account, bid, token, payment, and support records for operational, legal, security, and dispute-handling purposes. Retention periods may vary by data type and applicable law, and we are not liable for data retained beyond your request if retention is required by law, security obligations, fraud prevention, or legitimate business purposes.
Some data may be retained indefinitely where necessary to investigate past fraud, resolve disputes, comply with legal obligations, or maintain audit trails for security purposes. You acknowledge that deletion requests may not result in immediate removal of all copies.
9. Data Security and Limitations
We use reasonable technical and organizational safeguards to protect personal data, including encryption, access controls, and regular monitoring. However, no system is completely secure. We do not guarantee absolute protection against data breaches, unauthorized access, or cyber attacks, even with industry-standard safeguards in place.
Users are responsible for protecting their own account credentials, passwords, and devices. You acknowledge that any compromise of these items may result in unauthorized access to your account and the Platform. Gavel is not liable for unauthorized access or transactions resulting from your failure to protect your credentials.
In the event of a confirmed data breach affecting personal data, we will notify affected users and cooperate with law enforcement as required by law. However, Gavel is not liable for losses, damages, or consequences resulting from data breaches, including identity theft, fraud, or financial losses caused by unauthorized access to your data, even where we have notified you of the breach.
10. Disclaimer of Liability for Data Practices
To the maximum extent permitted by law, Gavel is not liable for unauthorized disclosure of personal data, data breaches, cyber attacks, or third-party compromise of data, even if such occur due to negligence or security failures. Users assume all risk related to the collection, processing, and retention of personal data on our systems.
Gavel makes no warranty that data practices comply with any particular standard or law beyond what is explicitly required in this policy or by applicable law. You agree that data security is a shared responsibility and that you must take additional steps (such as using strong passwords, enabling two-factor authentication, and monitoring your account) to protect your personal information.
11. Your Rights
Under the Data Protection Act, 2012 (Act 843), you may request access to, correction of, or deletion of your personal data, and you may object to certain processing. Some records may still be retained where required for legal, fraud-prevention, or security reasons.
If you are not satisfied with how we handle your data, you may complain to the Data Protection Commission of Ghana.
12. Children’s Privacy
Gavel is not intended for users under 18 years old. We do not knowingly collect personal data from children. If we learn that such data was submitted, we will take steps to remove it where required.
13. International Transfers
Your information may be processed in jurisdictions where our service providers operate. We take reasonable steps to ensure appropriate safeguards for transferred data.
14. Changes to this Policy
We may update this Privacy Policy from time to time. Continued use of Gavel after updates means you accept the revised policy.
15. Contact
For privacy questions or requests, contact support@gavelgh.com.