AuctionACCESS Biometric Data Policy

Effective as of August 12, 2026:

This Biometric Data Policy describes how AuctionACCESS, LLC (“AuctionACCESS,” “we,” “us,” or “our”) processes biometric data, biometric information, or biometric identifiers (“Biometric Data”) collected from users of the AuctionACCESS dealer credentialing system or our other services (collectively, the “Services”).

For information about how we process other categories of personal information, please see our Privacy Policy.

Collection and use of Biometric Data. To help us verify your identity and prevent fraud, we collect a selfie photo and a photo of your government-issued ID, and we share that information with our third-party vendors for biometric analysis. Specifically, they extract information about your facial geometry from these photos and use this information to compare your selfie to the photo on your ID. This facial geometry data and data derived from it constitutes Biometric Data under applicable privacy laws.

These third-party vendors give us the results of their analysis, which may include facial geometry data. We use the results returned by our third-party vendors to verify your identity, to prevent fraud, and for other purposes described in our Privacy Policy.

Disclosing Biometric Data. We use third parties that process your Biometric Data to help us provide the Services. In some cases, we use service providers who handle your Biometric Data in a manner consistent with this policy. In other cases, you may be asked to submit Biometric Data to one of our vendors, Incode. If you agree to biometric verification through Incode, Incode will handle your Biometric Data according to their own Privacy Policy and Biometric Data Policy and Notice, which are available at https://www.incode.com/privacy-policy and https://www.incode.com/biometric-data-policy-and-notice, respectively. If Incode collects your Biometric Data, Incode is the controller of your Biometric Data and responsible for its processing.

Retention schedule for destruction of Biometric Data. We delete and instruct our third-party vendors to delete your Biometric Data when the earlier of the following conditions are satisfied:

• The initial purpose for collecting or obtaining your Biometric Data has been satisfied; or
• By the deletion deadline under applicable legal requirements. For example, if you are an Illinois resident, within three years from your last interaction with us.

Changes. We reserve the right to modify this Biometric Data Policy at any time. If we make material changes to this Biometric Data Policy, we will notify you by updating the date of and posting the updated policy on the Services or other appropriate means. Any modifications to this Biometric Data Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Services after the effective date of any modified Biometric Data Policy indicates your acknowledgment that the modified Biometric Data Policy applies to your interactions with the Services and our business.