Privacy Policy

By accessing or using the Dialist Services, creating an account, submitting information to us, purchasing or selling through the Dialist Marketplace, participating in the Dialist Private Exchange, requesting Concierge services, consigning a watch, using Dialist Secure Checkout, or otherwise interacting with our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, disclosure, retention, and protection of your Personal Information as described herein.

Where required by applicable law, we will obtain your express consent before collecting, using, or disclosing your Personal Information for purposes that require such consent. In other circumstances, your consent may be implied through your use of the Services or your voluntary provision of information.

You may withdraw your consent to certain processing activities at any time, subject to legal, contractual, regulatory, fraud prevention, security, authentication, recordkeeping, and operational requirements. Withdrawal of consent may limit or prevent your ability to access certain features of the Services, complete transactions, maintain an account, participate in Dialist Secure Checkout, or continue using certain Dialist products or services.

Dialist operates in Canada and the United States and works with trusted service providers that may process or store Personal Information in Canada, the United States, or other jurisdictions where they operate. As a result, your Personal Information may be transferred to, processed in, or stored outside your province, state, or country of residence and may be subject to the laws of those jurisdictions. Regardless of where your information is processed, Dialist requires its service providers to protect Personal Information through appropriate contractual, organizational, and technical safeguards consistent with applicable privacy laws.

If you do not agree with this Privacy Policy, you must not access or use the Services.

Dialist collects Personal Information and other information about you in the following ways: information you provide directly to us, information we collect automatically through your use of the Services, and information we receive from third parties. By “Personal Information,” we mean information that identifies, relates to, or could reasonably be linked with a particular individual.

Information You Provide Directly

• Identity and contact information, such as your name, email address, telephone number, mailing address, and date of birth.
• Account credentials and profile information.
• Identity verification information, including government-issued identification, business registration documents, beneficial ownership information, and tax identification numbers (such as a Social Insurance Number, Social Security Number, or Employer Identification Number, where legally required), submitted to confirm your identity or eligibility to use certain Services.
• Billing information, such as your billing address. Dialist does not directly collect or store full payment card numbers; card information you provide is transmitted directly to and processed by our payment processor.
• Watch and product information, including photographs, videos, movement photographs, serial numbers, reference numbers, ownership documentation, service history, and other information you submit in connection with a listing, sale, consignment, authentication, or service request.
• Communications you send us, including messages, inquiries, and support requests, and any information contained within them.
• Information submitted through surveys, reviews, ratings, or feedback.

Biometric Information

For certain transactions, Dialist may require you to complete an identity verification check involving a photograph of your face and a government-issued identification document, processed through our identity verification partner, Persona Identities, Inc. (“Persona”). This process generates biometric identifiers by comparing your photograph to your identification document to confirm that you are the person depicted.

This verification is initiated by you, not automatically by Dialist. Dialist may require this verification for any transaction, and in particular for transactions exceeding ten thousand dollars ($10,000), before a purchase can be completed or before a shipment is released following payment. Before the check proceeds, you are required to affirmatively agree to it through our identity verification provider’s own consent process. Where applicable law, including the General Data Protection Regulation, requires a heightened standard of explicit consent for biometric data, your affirmative agreement through this process constitutes that explicit consent. If you decline to complete the verification, Dialist may be unable to complete the applicable purchase or release the applicable shipment.

Before any biometric verification is carried out, Dialist obtains your express consent to the verification of your identity by biometric means, separately from your acceptance of this Privacy Policy and from any other consent. That consent is requested for that purpose alone, in clear and simple language, and you may refuse it. Where you refuse, Dialist will offer an alternative means of verification where one is reasonably available, or will be unable to complete the applicable transaction.

Dialist retains biometric identifiers only for as long as reasonably necessary to complete the verification for which they were collected and to satisfy applicable legal, regulatory, or audit obligations, and in no event longer than three (3) years following your last interaction with Dialist requiring such verification, whichever occurs first. Biometric identifiers are permanently destroyed using reasonable methods once retention is no longer necessary. Dialist does not sell, lease, trade, or otherwise profit from biometric identifiers, and discloses them only to the identity verification provider processing the check on Dialist’s behalf, or as required by applicable law.

Information We Collect Automatically

• Device and browser information, and approximate geographic location inferred from your IP address. Dialist does not collect precise GPS location.
• Usage, log, and interaction data collected through cookies and similar technologies, as described in the “Cookies and Similar Technologies” section below.

Information We Receive From Third Parties

• Identity verification results from Persona and from other identity verification and compliance providers. Persona processes this information as our service provider under its own privacy policy, available at https://withpersona.com/legal/privacy-policy
• Payment and transaction information from our payment processor. Dialist does not directly receive or store complete payment card numbers; our payment processor collects and stores full card details directly.
• Sanctions, anti-money laundering, and fraud screening results from compliance and screening providers.
• Shipping and delivery information from shipping carriers.
• Information other users provide about you, such as dealer ratings, reviews, or transaction-related communications.

Dialist uses Personal Information and other information we collect for legitimate business, legal, security, operational, and commercial purposes, including to provide, operate, improve, secure, and expand the Services. Depending on how you interact with Dialist, we may use your information for one or more of the following purposes:

Account Management

• Create, verify, maintain, administer, and secure your Dialist account.
• Confirm your identity and eligibility to access certain Services or features.
• Manage dealer memberships, customer accounts, subscriptions, and account preferences.
• Review, approve, suspend, restrict, or terminate accounts where necessary to enforce our policies, maintain marketplace integrity, or comply with applicable laws.

Providing the Services

• Provide and operate the Dialist Marketplace, Dialist Private Exchange, Dialist Concierge, Dialist Secure Checkout, consignment services, authentication services, service centre operations, and other products and services offered by Dialist.
• Process purchases, sales, consignments, sourcing requests, service requests, subscriptions, and other transactions.
• Facilitate communications between buyers, sellers, dealers, consignors, service providers, and other authorized participants.

Authentication, Consignment, and Watch Services

• Evaluate watches submitted for sale, consignment, authentication, servicing, restoration, refinishing, or other related services.
• Collect, review, store, and use photographs, videos, movement photographs, serial numbers, reference numbers, ownership documentation, inspection notes, authentication reports, service records, and other information you voluntarily provide in connection with your watch.
• Create and maintain authentication, inspection, servicing, restoration, and transaction records.
• Communicate with you regarding inspections, quotations, repair recommendations, authentication results, service progress, warranty administration, and related matters.

Identity Verification, Security, and Fraud Prevention

• Verify identities, businesses, and authorized representatives.
• Detect, investigate, prevent, and respond to fraud, unauthorized activity, suspicious transactions, counterfeit products, chargebacks, payment disputes, policy violations, security incidents, and other activities that may threaten the integrity of the Services.
• Protect Dialist, our users, business partners, service providers, and the marketplace from fraud, abuse, and other unlawful or harmful activities.
• Comply with anti-money laundering, sanctions screening, identity verification, fraud prevention, and other legal or regulatory requirements applicable to our business.

Customer Support and Communications

• Respond to inquiries, requests, complaints, and support tickets.
• Contact you regarding your account, transactions, authentication requests, consignments, purchases, sales, service requests, subscriptions, security matters, policy updates, and other operational communications.
• Communicate with you by email, telephone, SMS, WhatsApp, in-app messaging, push notifications, or other communication channels you choose or authorize.
• Send marketing communications, promotional offers, newsletters, product announcements, event invitations, surveys, and other information that may be of interest to you, subject to your communication preferences and applicable law.

Personalization and Marketplace Experience

• Personalize your experience within the Services.
• Recommend listings, dealers, products, services, or other marketplace content that may be relevant to your interests.
• Improve search functionality, navigation, recommendations, and other marketplace features.

Analytics, Research, and Product Improvement

• Understand how users interact with the Services.
• Measure usage, performance, engagement, and effectiveness of our website, applications, marketing campaigns, and business operations.
• Conduct analytics, research, testing, quality assurance, product development, and operational improvement activities.
• Develop, evaluate, test, and implement new products, services, technologies, features, security measures, fraud detection systems, personalization tools, artificial intelligence solutions, machine learning technologies, and other improvements designed to enhance the Services.

Automated Processing and Artificial Intelligence

Dialist may use automated tools, algorithms, machine learning models, and artificial intelligence systems to assist in fraud detection, risk scoring, personalization, search and recommendation features, and other aspects of the Services. These tools may analyze information about your account, transactions, and use of the Services to identify patterns, generate risk scores, or make recommendations.

Where an automated system flags a transaction, account, or other activity for review, a member of our team reviews the matter before any decision to suspend, restrict, or terminate your account, or to cancel a transaction, is finalized. Dialist does not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement.

Marketing and Advertising

• Deliver and measure marketing campaigns and promotional activities.
• Analyze marketing performance and audience engagement.
• Provide advertising and promotional content that may be relevant to your interests, where permitted by applicable law.

Business Operations and Legal Compliance

• Maintain our business records.
• Perform accounting, auditing, financial reporting, insurance administration, tax compliance, corporate governance, risk management, and other internal business operations.
• Enforce our Terms & Conditions, policies, contracts, and other legal agreements.
• Establish, exercise, or defend legal claims.
• Comply with applicable laws, regulations, court orders, governmental requests, and lawful investigations.

We may also use your information for any other purpose that is compatible with the original purpose for which it was collected, that you authorize, or that is otherwise permitted or required by applicable law.

Dialist treats your Personal Information as confidential and does not disclose it except as described in this Privacy Policy, where necessary to provide the Services, where you authorize or direct us to do so, or where disclosure is otherwise permitted or required by applicable law. Dialist does not sell or share your Personal Information for monetary or other valuable consideration except as described in this Privacy Policy.

Service Providers

We may disclose Personal Information to trusted third-party vendors, contractors, consultants, business partners, and service providers that assist us in operating, maintaining, securing, improving, supporting, or delivering the Services. These service providers may perform functions including, but not limited to:

• Payment processing, banking, financial, and card network services;
• Identity verification, compliance, anti-fraud, and security services;
• Cloud hosting, data storage, and information technology services;
• Website analytics, diagnostics, and performance monitoring;
• Customer support and communication services;
• Marketing and promotional services;
• Shipping, logistics, customs, and delivery services;
• Insurance and claims administration;
• Authentication, inspection, servicing, repair, restoration, and warranty services; and
• Other operational, technical, or professional services necessary to support the Services.

These service providers are authorized to access Personal Information only to the extent reasonably necessary to perform services on Dialist’s behalf or as otherwise permitted or required by applicable law.

Marketplace Transactions

Where reasonably necessary to facilitate purchases, sales, consignments, sourcing requests, authentication services, servicing, repairs, restorations, warranties, dispute resolution, or other marketplace activities, we may disclose relevant Personal Information to the parties involved in the transaction.

Dealer profiles are intended to be publicly accessible within the Services and may contain information voluntarily provided by the dealer, including business name, representative name, profile photograph, contact information, business location, business hours, and other information the dealer elects to publish.

Where a dealer profile includes the name, photograph, or other personal information of an individual representative, that information is submitted by the dealer, and the dealer is responsible for obtaining that individual’s consent before submitting it. If you are an individual whose name, photograph, or other personal information appears on a dealer profile and you did not consent to its publication, or you wish to have it removed, you may contact Dialist using the information provided at the end of this Privacy Policy.

Buyer information is not disclosed to dealers unless reasonably necessary to facilitate or complete a transaction, fulfill a requested service, comply with applicable law, investigate fraud, resolve disputes, enforce our agreements, or otherwise operate the Services.

Authentication, Service, Shipping, and Insurance

To facilitate authentication, inspections, servicing, restorations, consignments, shipping, insurance, and other related services, we may disclose Personal Information and watch-related information, including photographs, videos, movement photographs, serial numbers, reference numbers, ownership documentation, inspection notes, authentication reports, shipping information, service history, and other relevant records to Dialist-authorized service providers, authentication providers, repair facilities, manufacturers, shipping carriers, customs authorities, insurers, insurance adjusters, and other parties where reasonably necessary to complete or support the requested services.

Legal, Regulatory, and Security Requirements

We may disclose Personal Information where we reasonably believe such disclosure is necessary or appropriate to:

• Comply with applicable laws, regulations, court orders, subpoenas, or other lawful governmental requests;
• Cooperate with law enforcement agencies, regulatory authorities, tax authorities, customs authorities, or other governmental agencies;
• Protect the rights, property, safety, security, or legal interests of Dialist, our users, our service providers, or third parties;
• Detect, investigate, prevent, or respond to fraud, identity theft, money laundering, counterfeit goods, payment disputes, chargebacks, security incidents, policy violations, or other unlawful or harmful activities;
• Establish, exercise, or defend legal claims; or
• Enforce our Terms & Conditions, policies, agreements, or other legal rights.

Professional Advisors

We may disclose Personal Information to our lawyers, accountants, auditors, insurers, financial advisors, consultants, and other professional advisors where reasonably necessary to obtain professional services, manage our business, comply with legal or regulatory obligations, facilitate financing or corporate transactions, or protect our legal rights.

Corporate Transactions

If Dialist participates in, contemplates, or undergoes a merger, acquisition, investment, financing, corporate restructuring, asset sale, bankruptcy, receivership, or other business transaction, Personal Information may be disclosed to prospective or actual purchasers, investors, lenders, successor entities, or their professional advisors, subject to appropriate confidentiality obligations and applicable law.

Aggregated and De-Identified Information

We may use, publish, disclose, or otherwise share aggregated or de-identified information that does not reasonably identify an individual for business, operational, analytical, statistical, research, product development, security, or other lawful purposes. Dialist maintains and uses such information in de-identified form, takes reasonable measures to prevent it from being associated with any individual, does not attempt to re-identify it, and requires any recipient of it to do the same by contract. Where Dialist states that information has been anonymized, that information is processed so that it no longer permits any person to be identified, directly or indirectly.

Other Permitted Disclosures

We may also disclose your Personal Information where you have provided your consent, where you direct us to do so, where such disclosure is otherwise permitted or required by applicable law, or where reasonably necessary to provide, protect, improve, develop, secure, or support the Services.

Dialist and our authorized service providers may use cookies, pixels, web beacons, tags, scripts, software development kits (SDKs), application programming interfaces (APIs), local storage, device identifiers, and other similar technologies (“Tracking Technologies”) to collect information about how you access and use the Services.

These Tracking Technologies help us operate, secure, maintain, improve, and personalize the Services, understand user activity, measure performance, support marketing efforts, prevent fraud, and develop new products, services, and features.

Categories of Cookies We Use

Cookies and similar technologies used through the Services generally fall into the following categories:

• Strictly Necessary: required for the Services to function, such as maintaining your login session and enabling secure transactions. These cannot be disabled without affecting core functionality.
• Functional: remember your preferences and settings to improve your experience, including the watches you have recently viewed on this device (kept for 30 days and used to suggest others; never shared). Managed under Personalization in Your Privacy Choices.
• Analytics and Performance: help us understand how the Services are used and measure performance.
• Advertising: used to deliver and measure the effectiveness of advertising and promotional content that may be relevant to your interests.

Except for Strictly Necessary cookies, which are required for the Services to operate and do not require consent, Dialist requests your consent before setting Functional, Analytics and Performance, or Advertising cookies. When you first visit our website, a cookie banner allows you to accept all non-essential cookies, reject all non-essential cookies, or choose which categories to allow. Non-essential cookies are not placed on your device unless and until you provide that consent.

Information Collected

Depending on how you access or use the Services, Tracking Technologies may collect information such as:

• Browser type and version;
• Device type, operating system, and device identifiers;
• IP address and approximate geographic location;
• Language preferences and time zone;
• Pages visited, features accessed, search activity, navigation patterns, and interactions with the Services;
• Referral sources and websites visited before accessing the Services;
• Session duration, clickstream data, and usage statistics;
• Crash reports, diagnostics, performance information, and technical logs;
• Advertising, campaign, and conversion data; and
• Other technical information relating to your interaction with the Services.

How We Use Tracking Technologies

We may use Tracking Technologies for purposes including, but not limited to:

• Authenticating users and maintaining secure login sessions;
• Remembering user preferences and settings;
• Operating and improving the functionality, reliability, and performance of the Services;
• Measuring website and application usage;
• Detecting, preventing, investigating, and responding to fraud, unauthorized activity, security incidents, and abuse;
• Understanding user behavior and improving user experience;
• Measuring the effectiveness of advertising and marketing campaigns;
• Delivering advertising or promotional content that may be relevant to your interests, where permitted by applicable law;
• Conducting analytics, research, testing, quality assurance, and product development; and
• Developing, evaluating, testing, and implementing new technologies, automation tools, artificial intelligence systems, machine learning models, personalization features, security measures, and other enhancements designed to improve the Services.

Third-Party Technologies

Certain Tracking Technologies may be provided by trusted third-party service providers acting on Dialist’s behalf, including providers of analytics, website performance monitoring, advertising, communications, fraud prevention, and security services. These providers may collect information through the Services in accordance with their own privacy practices and applicable law.

Managing Tracking Technologies

You may change your cookie preferences at any time by returning to our cookie preference tool, typically accessible through a link in the footer of our website, or through your browser or device settings. Please note that disabling certain Tracking Technologies may affect the availability, functionality, performance, or security of some features of the Services.

Dialist uses Tracking Technologies as described in this Privacy Policy and in accordance with the consent choices you make through our cookie banner or preference tool, subject to any additional choices or rights available to you under applicable law.

Dialist is committed to providing individuals with meaningful control over their Personal Information, subject to applicable law and our legitimate business, legal, contractual, regulatory, security, fraud prevention, authentication, and operational obligations.

Access to Your Personal Information

Subject to applicable law, you may request access to the Personal Information we maintain about you and request information regarding how your Personal Information has been collected, used, disclosed, or retained.

Correction of Personal Information

If you believe any Personal Information we maintain about you is inaccurate, incomplete, or outdated, you may request that it be corrected or updated. We may request supporting documentation where reasonably necessary to verify the requested correction.

Data Portability

Subject to applicable law, you may request a copy of certain Personal Information you have provided to us in a structured, commonly used, and machine-readable format, and request that we transmit that information to another organization, except where doing so raises serious practical difficulties.

Deletion of Personal Information

You may request that we delete your Personal Information where permitted by applicable law.

Please note that deletion is not absolute. Dialist may retain Personal Information where necessary or appropriate to:

• comply with applicable laws, regulations, legal processes, or governmental requests;
• satisfy anti-money laundering, fraud prevention, identity verification, taxation, accounting, audit, insurance, or recordkeeping obligations;
• maintain authentication reports, transaction records, service records, warranty records, consignment agreements, purchase and sale records, payment records, shipping records, dispute records, or other business records;
• investigate or resolve fraud, disputes, chargebacks, counterfeit products, security incidents, policy violations, or legal claims;
• enforce our agreements, policies, or legal rights; or
• protect the security, integrity, and operation of the Services.

Where deletion cannot be completed for legal or operational reasons, we will retain the information only for as long as reasonably necessary or as otherwise required by applicable law.

Data Retention

The length of time Dialist retains Personal Information depends on the purpose for which it was collected and applicable legal requirements. Where Dialist is able to commit to a specific retention period, it does so below; in all other cases, Dialist retains Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, or as otherwise required by applicable law.

• Transaction, payment, and financial records: approximately six (6) to seven (7) years following completion of the applicable transaction, reflecting Canadian and United States tax record-keeping requirements, or longer where required to comply with tax, accounting, or other applicable legal obligations.
• Identity verification, compliance, and fraud screening records: retained for as long as reasonably necessary to comply with applicable anti-money laundering, sanctions, fraud prevention, and other legal or regulatory obligations.
• Marketing data: where you have not engaged with our marketing communications or have opted out, Dialist will suppress or delete your marketing contact information after approximately two (2) years of inactivity.
• All other Personal Information: retained for as long as reasonably necessary to provide the Services, enforce our agreements, resolve disputes, and comply with applicable law, as described elsewhere in this Privacy Policy.

Withdrawal of Consent

Where our processing of your Personal Information is based upon your consent, you may withdraw that consent at any time, subject to applicable law and our legal, contractual, regulatory, security, fraud prevention, authentication, and operational obligations.

Please note that withdrawing consent may limit or prevent your ability to access certain features of the Services, maintain an account, complete transactions, receive certain services, or continue using some or all of the Services.

Marketing Communications

Dialist sends commercial electronic messages only where you have given express consent, or where consent is implied under applicable law — including, in Canada under An Act to promote the efficiency and adaptability of the Canadian economy (CASL), where you have an existing business relationship with Dialist arising from a purchase, consignment, or contract within the preceding twenty-four (24) months, or an inquiry within the preceding six (6) months. Express consent is obtained separately from your acceptance of this Privacy Policy or the Terms & Conditions and is never a condition of using the Services. Every commercial electronic message identifies Dialist, provides contact information valid for at least sixty (60) days, and includes an unsubscribe mechanism that takes effect within ten (10) business days. You may withdraw consent at any time using that mechanism or by contacting us directly.

Even if you opt out of marketing communications, Dialist may continue to send important non-promotional communications relating to your account, transactions, purchases, consignments, authentication requests, service updates, payment activity, subscriptions, security matters, legal notices, policy updates, and other administrative or operational matters.

Identity Verification

To protect the privacy and security of our users, Dialist may require you to verify your identity before responding to requests relating to your Personal Information. We may decline requests where we are unable to reasonably verify your identity or authority to make the request.

Limitations on Privacy Requests

Dialist may decline, limit, or defer requests relating to Personal Information where permitted or required by applicable law, including where responding to the request would:

• adversely affect the rights or privacy of another individual;
• interfere with fraud prevention, security, authentication, or legal investigations;
• compromise the security or integrity of the Services;
• reveal confidential business information, trade secrets, or information protected by legal privilege;
• conflict with our legal or regulatory obligations;
• be technically impracticable or involve disproportionate effort where permitted by applicable law; or
• otherwise be prohibited or restricted by applicable law.

Appealing a Decision

If Dialist declines, limits, or defers your request, we will explain the reason for our decision. You may appeal that decision by contacting Dialist using the information provided at the end of this Privacy Policy and requesting that your request be reviewed. Dialist will conduct this review promptly and, where required by applicable law, within the timeframe prescribed by that law. If you remain dissatisfied following our review, you may have the right to contact the applicable privacy regulator described in this Privacy Policy.

How to Exercise Your Rights

To exercise your privacy rights or submit a privacy-related request, you may contact Dialist using the contact information provided at the end of this Privacy Policy.

We may request additional information or documentation necessary to verify your identity, confirm your authority to make the request, or clarify the scope of your request before responding. We will respond to requests within thirty (30) days, or within forty-five (45) days for requests from California residents (which may be extended by an additional forty-five (45) days where reasonably necessary and permitted by applicable law), or within such other timeframe as required by applicable law.

Do Not Track Signals

At this time, the Services do not respond to browser-based “Do Not Track” signals or similar browser mechanisms because there is currently no universally accepted industry standard governing their operation or interpretation.

Residents of certain U.S. states may have additional privacy rights under applicable state privacy laws. Where such laws apply to Dialist’s collection, use, disclosure, or processing of Personal Information, Dialist will honor those rights in accordance with applicable law.

Depending on your state of residence and applicable law, these rights may include the ability to request access to your Personal Information, request correction of inaccurate information, request deletion, obtain a portable copy, withdraw consent, and appeal a denied request. They also include the right to opt out of (a) targeted advertising, (b) the sale of Personal Information, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Dialist recognises and honours universal opt-out mechanisms, including the Global Privacy Control, as valid opt-out requests in every state whose law provides for them. Where applicable law requires opt-in consent before processing sensitive personal information, Dialist obtains that consent before processing.

If Dialist denies a privacy request, you may appeal by contacting Dialist using the information provided at the end of this Privacy Policy. Dialist will respond to an appeal within sixty (60) days. If your appeal is denied, you may contact the Attorney General of your state to submit a complaint.

To exercise any rights available under applicable U.S. state privacy laws, you or your authorized representative may contact Dialist using the contact information provided at the end of this Privacy Policy.

Before responding to a request, Dialist may require reasonable verification of your identity and, where applicable, verification of an authorized representative’s authority to act on your behalf.

Where permitted or required by applicable law, Dialist may decline, limit, or defer a request for the reasons described in this Privacy Policy or as otherwise permitted by applicable law.

If applicable law requires Dialist to provide additional rights, notices, disclosures, or appeal procedures beyond those described in this Privacy Policy, Dialist will comply with those requirements.

California Right to Opt Out of Sale or Sharing

Dialist does not sell or share your Personal Information for monetary or other valuable consideration except as described in this Privacy Policy. To the extent that Dialist’s use of advertising or analytics technologies may constitute a “sale” or “sharing” of Personal Information under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, you have the right to opt out of that sale or sharing.

You may exercise this right at any time by contacting Dialist using the information provided at the end of this Privacy Policy, or by enabling a Global Privacy Control or other opt-out preference signal in your browser. Dialist honours opt-out preference signals as valid opt-out requests.

Dialist will not discriminate against you for exercising any privacy right. Dialist will not deny you goods or services, charge you a different price, impose a penalty, or provide you with a different level or quality of goods or services because you exercised a right under applicable privacy legislation.

California Right to Limit Use of Sensitive Personal Information

Dialist collects limited categories of Sensitive Personal Information as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including government-issued identification numbers, tax identification numbers, account log-in credentials, biometric information collected through identity verification, and the contents of messages exchanged through the Services where Dialist is not the intended recipient. Dialist uses this Sensitive Personal Information only to verify your identity, comply with anti-money laundering and other legal or regulatory obligations, prevent fraud, and provide the Services you request, and does not use or disclose it to derive characteristics about you, for advertising or marketing purposes, or for any purpose other than those permitted without additional consent under applicable law.

Dialist does not use Sensitive Personal Information to develop, train, or improve products, services, artificial intelligence models, or machine learning technologies, and does not use it for any purpose beyond those permitted without additional consent under applicable law. Because Dialist limits its use of Sensitive Personal Information to these purposes, applicable law does not require Dialist to offer a separate mechanism to further limit that use. You may nonetheless contact Dialist using the information provided at the end of this Privacy Policy to make a request regarding Sensitive Personal Information.

Dialist protects personal information in accordance with applicable Canadian privacy laws and has designated its Chief Executive Officer, Yousuf Waleed, as Privacy Officer to oversee compliance with this Privacy Policy, whose contact information appears in Section 16.

If you have any questions, concerns, or complaints regarding how Dialist collects, uses, discloses, stores, or otherwise processes your Personal Information, you are encouraged to contact us using the contact information provided at the end of this Privacy Policy. We will make reasonable efforts to investigate and respond to your inquiry and, where appropriate, work with you to resolve your concerns.

Subject to applicable Canadian privacy laws, you may have the right to request access to your Personal Information, request correction of inaccurate or incomplete Personal Information, request deletion of Personal Information where applicable, request restrictions on certain processing activities, or exercise other rights provided under applicable law. Dialist will respond to such requests within thirty (30) days, or within such other timeframe as required by applicable law.

If you are not satisfied with our response, you may have the right to file a complaint with the Office of the Privacy Commissioner of Canada or any applicable provincial or territorial privacy regulator.

Nothing in this Privacy Policy limits or restricts any rights you may have under applicable Canadian privacy legislation.

Quebec Residents

Dialist’s processing of Personal Information relating to residents of Quebec is also subject to Quebec’s Act respecting the protection of personal information in the private sector.

Where a decision is based exclusively on automated processing, Dialist will inform you of that fact at the time of or before the decision. On request, Dialist will inform you of the Personal Information used to render the decision, the principal reasons and factors that led to it, your right to have that Personal Information corrected, and your right to have a member of Dialist’s personnel review the decision.

Subject to applicable law, you may request that Dialist cease disseminating your Personal Information, or de-index any hyperlink attached to your name that provides access to your Personal Information, where the dissemination contravenes the law or a court order.

If you are not satisfied with our response, you may have the right to file a complaint with the Commission d’accès à l’information du Québec.

Residents of Nevada may have certain privacy rights under applicable Nevada law. Where such laws apply to Dialist’s collection, use, disclosure, or processing of Personal Information, Dialist will honor those rights in accordance with applicable law.

Nevada residents who wish to exercise any rights available under applicable Nevada law, or who have questions regarding Dialist’s privacy practices, may contact Dialist using the contact information provided at the end of this Privacy Policy.

Dialist will respond to requests from Nevada residents within thirty (30) days, or within such other timeframe and in the manner required by applicable law.

Dialist does not direct or market the Services specifically to individuals located in the European Economic Area (“EEA”) or the United Kingdom, and does not establish pricing, currency, or language options specific to those regions. Dialist does not, however, block or restrict access to the Services from the EEA or United Kingdom. Where the General Data Protection Regulation, the UK GDPR, or other applicable EEA or UK data protection law applies to Dialist’s processing of your Personal Information, Dialist complies with the applicable requirements of that law, including, where required, appointing a representative in the EEA or United Kingdom.

If you are located in the EEA or United Kingdom, you may have the right to access, rectify, erase, or restrict the processing of your Personal Information, the right to data portability, the right to object to certain processing, and the right to withdraw consent where processing is based on consent, in each case to the extent provided under applicable EEA or UK data protection law.

Where Dialist transfers Personal Information originating in the EEA or United Kingdom to Canada or the United States, Dialist relies on appropriate safeguards, such as standard contractual clauses or another lawful transfer mechanism, where required by applicable law.

If you are located in the EEA or United Kingdom and believe Dialist has not adequately addressed your concerns regarding the processing of your Personal Information, you may have the right to lodge a complaint with your local data protection supervisory authority.

The Services are intended solely for individuals who are at least eighteen (18) years of age. Dialist does not knowingly collect Personal Information from, market to, or permit the creation of accounts by individuals under the age of eighteen (18).

By accessing or using the Services, you represent and warrant that you are at least eighteen (18) years of age and have the legal capacity to enter into binding agreements under applicable law.

If Dialist becomes aware that an individual under the age of eighteen (18) has created an account, submitted Personal Information, or otherwise used the Services in violation of this Privacy Policy or our Terms & Conditions, Dialist reserves the right to suspend or terminate the account and take any other actions it considers appropriate, including removing or restricting access to the individual’s Personal Information where permitted or required by applicable law.

If a parent, legal guardian, or other individual believes that a person under the age of eighteen (18) has provided Personal Information to Dialist, they may contact us using the contact information provided at the end of this Privacy Policy. Upon receiving such notice, Dialist will investigate the matter and take appropriate action consistent with applicable law.

Where the Services offer privacy settings, those settings are configured by default to the highest level of confidentiality, without any action required from you. This does not apply to information you choose to publish yourself, such as a dealer storefront or a public review.

Dialist maintains administrative, technical, organizational, and physical safeguards designed to protect Personal Information against unauthorized access, collection, use, disclosure, alteration, loss, misuse, or destruction. These safeguards are designed having regard to the sensitivity of the information we collect, the nature of our business, applicable legal requirements, and evolving industry standards.

Our security measures may include, where appropriate:

• Industry-standard encryption, such as Transport Layer Security (TLS), for Personal Information transmitted through the Services;
• Appropriate authentication and access controls designed to restrict access to Personal Information on a need-to-know basis;
• Security monitoring, logging, auditing, and other measures intended to detect, investigate, and respond to unauthorized access, suspicious activity, security incidents, or other threats;
• Technical, administrative, and operational procedures designed to maintain the confidentiality, integrity, availability, and resilience of the Services and the Personal Information we maintain; and
• Ongoing evaluation and enhancement of our security practices, technologies, and procedures to address evolving risks and improve the protection of Personal Information.

Dialist also requires service providers that process Personal Information on our behalf to maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of the services they provide and the Personal Information they process.

While Dialist employs commercially reasonable safeguards to protect Personal Information, no method of transmitting information over the Internet, storing electronic data, or maintaining information security systems can be guaranteed to be completely secure. Accordingly, Dialist cannot guarantee the absolute security of any information transmitted to, through, or stored by the Services.

Users are responsible for maintaining the confidentiality of their account credentials, protecting the devices used to access the Services, and promptly notifying Dialist of any suspected unauthorized access to their account or any other security concern.

If Dialist becomes aware of a security incident affecting Personal Information, we will investigate the incident, take appropriate measures to mitigate its effects, and provide notifications to affected individuals, regulators, or other parties where required by applicable law.

The Services may contain links to, integrate with, or otherwise provide access to third-party websites, applications, platforms, products, services, content, software, or other resources that are owned or operated by independent third parties (“Third-Party Services”). These Third-Party Services operate independently from Dialist and are governed by their own terms, conditions, and privacy practices.

Third-Party Services may include, without limitation, payment processing services, identity verification services, shipping and logistics providers, authentication or repair providers, mapping services, social media platforms, embedded content, analytics providers, communications providers, manufacturer resources, dealer websites, and other technologies or services that support or complement the Services.

Your interactions with any Third-Party Service are governed solely by the applicable terms, conditions, and privacy policies of that third party. Dialist encourages you to review the privacy policies and terms of use of any Third-Party Service before providing Personal Information or otherwise interacting with that service.

Unless expressly stated otherwise, the inclusion of, integration with, or linking to a Third-Party Service does not constitute Dialist’s endorsement, sponsorship, approval, recommendation, or representation regarding that Third-Party Service, its products, services, content, security, or privacy practices.

To the fullest extent permitted by applicable law, Dialist is not responsible for the availability, accuracy, content, security, privacy practices, products, services, or actions of any Third-Party Service, nor for any loss or damage arising from your access to or use of such Third-Party Services.

Dialist may add, remove, modify, or replace Third-Party Services and integrations from time to time as the Services evolve, without prior notice, subject to applicable law.

Dialist may update or modify this Privacy Policy from time to time to reflect changes in our business, the Services, applicable laws, technologies, industry practices, or other legal, regulatory, operational, or security requirements.

When we make changes to this Privacy Policy, we will update the “Last Updated” date at the beginning of this Privacy Policy. Where required by applicable law or where we determine that a change is material, we will provide at least thirty (30) days’ advance notice by email describing the specific change, and by posting a notice on our website, before the change becomes effective for existing users. Such notice is deemed given on the date sent, regardless of whether you actually receive, open, or review it. You are responsible for maintaining a current, monitored email address on your Account, and Dialist’s transmission of notice to the address on file constitutes adequate notice under this Section.

Certain changes may become effective immediately where necessary to comply with applicable law, address security or fraud prevention concerns, protect the integrity of the Services, or respond to other legitimate operational requirements, where permitted by applicable law.

We encourage you to review this Privacy Policy periodically so that you remain informed about how Dialist collects, uses, discloses, protects, and otherwise processes your Personal Information.

Your continued access to or use of the Services after the effective date of any revised Privacy Policy constitutes your acknowledgment of the updated Privacy Policy. If you do not agree with the revised Privacy Policy, you should discontinue your use of the Services.

This Privacy Policy forms an integral part of, and is incorporated by reference into, the Dialist Terms & Conditions. Except where this Privacy Policy expressly provides otherwise with respect to the processing of Personal Information, the Dialist Terms & Conditions continue to apply to your use of the Services.

If you are an individual consumer resident in Canada, nothing in this Privacy Policy or in the Dialist Terms & Conditions requires you to submit any dispute to arbitration or to waive any right to participate in a class action. For greater certainty under section 11.1 of the Consumer Protection Act (Quebec), CQLR c. P-40.1, no arbitration or class-action-waiver provision forms part of Dialist’s agreement with such a consumer.

Nothing in this Privacy Policy or in the Dialist Terms & Conditions limits, waives, or otherwise affects any right or remedy available to you under applicable privacy or data protection legislation, including the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. No limitation of liability, disclaimer, or shortened limitation period applies to any claim arising under that legislation.

This Privacy Policy is published in English and in French. Where this Privacy Policy has been translated into French for users in the Province of Quebec, the French version governs and prevails for those users. For all other users, the English version governs and prevails.

If you have any questions, concerns, complaints, or requests regarding this Privacy Policy or Dialist’s collection, use, disclosure, retention, or protection of your Personal Information, or if you wish to exercise any privacy rights available to you under applicable law, please contact us using the information below.

Dialist has designated Yousuf Waleed, Chief Executive Officer, as its Privacy Officer, responsible for overseeing compliance with this Privacy Policy and applicable privacy laws and will ensure that privacy-related inquiries are handled in accordance with applicable legal requirements.

If you reside in Canada, the organization responsible for your Personal Information is Dialist Marketplace Inc., an Ontario corporation. If you reside in the United States or anywhere else, it is Dialist Marketplace Inc., a Florida corporation. The two corporations are separate but affiliated, each d/b/a Dialist, and may share Personal Information with each other as described in Section 4

Email: privacy@dialist.com

Telephone: +1 (437) 228-5367

Mailing addresses: Canada — Dialist Marketplace Inc. (Ontario) 50 Burnhamthorpe Road West Mississauga, Ontario L5B 3C2 Canada United States and all other regions — Dialist Marketplace Inc. (Florida) 852 NJ-3 Ste 216 Clifton, NJ 07012 United States

To help us process your request efficiently, please provide sufficient information to identify yourself and describe the nature of your request. Dialist may request additional information or documentation where reasonably necessary to verify your identity, confirm your authority to make the request, or clarify the scope of your request before responding.

We will investigate and respond to privacy-related inquiries and requests within thirty (30) days, or within forty-five (45) days for requests from California residents, or within such other timeframe as required by applicable law.