This Privacy statement applies to all (mobile) websites, (mobile) applications and / or (platform) applications of Whoppah B.V. (hereafter also, "we" or "us"). This Privacy Statement describes how we, as a controller, collect, share, use and / or otherwise process data related to you or identifying you ("personal data"), all in accordance with the General Data Protection Regulation (“GDPR”) . This Privacy Statement does not apply to websites or services of third parties referred to on our platform.

We reserve the right to adjust this Privacy Statement to ensure compliance with applicable laws and regulations. It is therefore advisable to consult this Privacy Statement on a regular basis so that you are aware of any changes.

Whoppah B.V. De Entrée 230 1101 EE Amsterdam The Netherlands E: support@whoppah.nl

Whoppah offers a platform, accessible via a (mobile) website and application, on which (secondhand or used) products can be offered for sale or auction and whereby Whoppah also facilitates related services such as payments, assessments and / or deliveries. In most cases we receive the personal data from you, for example if you contact us, visit our platform or create a Whoppah account to be able to use our services. We explain this in more detail below.

As a user, you must create a Whoppah account. In this context we request the following personal data:

• name
• address
• e-mail address
• telephone number

Optionally it is possible to specify your date of birth, photo and / or interests and preferences. Furthermore, placed, viewed and saved advertisements and / or searches, or previous reviews may be visible within the Whoppah account.

When you visit our platform or log in to your Whoppah account, we process the IP address and data of the (mobile) device with which you visit our platform, such as device or browser type. If you have given your permission for this, we will also process the location data of your (mobile) device. The main purpose of this is to facilitate the delivery of any purchased or sold products, but also, for example, to be able to offer relevant advertisements based on location. Even when you contact us (via e-mail, chat or otherwise), we process personal data in order to process your question or complaint and / or further develop and improve the platform.

If you have a Whoppah account, we will also keep you informed of new services or functionalities within the platform and the availability of upgrades or new versions of the platform. This is done, among other things, by sending online newsletters. It is possible, at any time, to unsubscribe from such newsletters via an 'unsubscribe' link in the relevant e-mail. If you have specified certain interests and preferences in the style profile, we will also keep you informed of (potentially) interesting advertisements or products, provided you have given your permission. In this way, displayed advertisements are personalized based on your search behavior, interests, (style) preferences and the like. Based on this, we can show you targeted (potentially) interesting advertisements, whether or not within a certain location, and better meet your wishes.

In order to optimize and improve the content and use of our website, we collect insights into the surfing behavior of website visitors. We do this with the help of Google Analytics. This functionality is privacy-friendly, whereby we have concluded a processing agreement with Google, the IP address is made anonymous and no data is shared with Google. Do we share personal data with third parties?

We treat personal data made available to us as confidential and, in principle, do not share it with third parties, except in the following situations:

1. Whoppah uses third parties for its services, for example IT suppliers and deliverers ('processors'). In processor agreements, we have made agreements with such processors on the careful handling and protection of personal data.

2. Whoppah may also provide or disclose certain personal data to third parties if we are or become obliged to do so under applicable legislation or a court order.

3. When you register on our platform via your Facebook or other social media account, the relevant social media platform will gain access to the personal data linked to your Whoppah account. The privacy policy of the relevant social media platform applies to the processing of your personal data in that situation. Whoppah has no influence on that.

4. Whoppah may share personal data with third parties in order to prevent, detect, investigate or limit the consequences of fraud, security breaches or other potentially prohibited or illegal activities. Where appropriate, we will make agreements in processing agreements concerning the careful handling and security of personal data. In principle, personal data is not passed on to parties or countries outside the European Economic Area (EEA). Should the transfer of personal data to parties or countries outside the EEA be necessary, we will always comply with the legal requirements.

We have taken appropriate technical and organizational measures to optimally protect your personal data against unauthorized access and misuse.

We do not store your personal data for longer than necessary for the purposes for which the personal data were obtained. In this way, the data from your Whoppah account will in principle be saved until that account is cancelled. The data is then immediately deleted. In some cases, we must retain certain personal data for longer. This may be the case, for example, when a claim is still open, specific legal retention periods apply or (legal) disputes are pending.

You can view, check and / or change your personal data via the settings in your Whoppah account. In addition, you naturally also have the right to request that we inspect, change, supplement, delete or transfer your personal data. You can also submit a request to limit a certain data processing or object to this. To this end, a request can be made to us in writing or by e-mail via the contact details above. After receiving such a request, we will respond within the legal deadlines. If you send a request for deletion of your (personal data in your) Whoppah account to us, we will delete your personal data as quickly as possible, at the latest within 1 month after receiving the request.

If you have any questions, comments or complaints about the processing and / or protection of your personal data by us, you can contact us in writing or by e-mail via the contact details above. For the sake of completeness, we also point out that you have the right to submit a complaint to the regulator. The Dutch Data Protection Supervisor is the "Autoriteit Persoonsgegevens".

This Privacy statement, as well as all disputes arising from or in relation to this Privacy statement, are governed exclusively by Dutch law.

Amsterdam, January 2022