PRIVACY POLICY

Introduction
This Privacy Policy explains how Steffes Group, Inc. (“Steffes Group,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information in connection with our websites, including steffesgroup.com and users.steffesgroup.com (together, the “Website”), and the online auction and equipment marketplace services we provide through the Website. It also explains the cookies and similar technologies we use and the choices you have. 
 
We provide the disclosures and rights described in the “Your Choices and Opt-Outs” and “Your U.S. Privacy Rights” sections to all visitors as our baseline. Depending on where you live, you may have additional rights, which are described in “Your U.S. Privacy Rights” and “Notice for Canadian Residents.”
 
Please read this Policy together with any notice provided to you at the time we collect your information.

Summary
In short:
  • We collect the information you give us (such as your name, contact details, and account and bidding activity) and information collected automatically through cookies and analytics.
  • We use automatically collected information to operate our auctions, verify identity, process transactions, communicate with you, improve the Website, and market our services.
  • We do not sell your personal information for money. We do share certain online identifiers and activity with advertising and analytics partners for cross-context behavioral (interest-based) advertising, and you can opt out of that sharing.
  • You can control cookies through our Cookie Preferences panel, opt out of marketing, and exercise privacy rights by contacting us at privacy@steffesgroup.com.
 
Personal Information We Collect
The categories below use the descriptions set out in California privacy law so you have a clear picture of what we collect. We collect these categories from you directly (through account registration, bidding, contact and tax-exemption forms, and communications), automatically through your use of the Website (through cookies, analytics, and other technologies), and from service providers, advertising and analytics networks, and other sources that help us operate and market our services.

Identifiers

Examples

Real name, postal address, email address, phone number, account username, unique online identifiers, Google Analytics identifier, internal user ID, and IP address.

Shared for cross-context behavioral advertising?

YesReal name, postal address, email address, phone number, account username, unique online identifiers, Google Analytics identifier, internal user ID, and IP address.

Commercial Information

Examples

Records of items, products, and services bought, sold, considered, or bid on, and auction participation history.

Shared for cross-context behavioral advertising?

No

Internet or Network Activity

Examples

Browsing and search activity on the Website, auction and item pages viewed, bid interactions, and overall engagement with the Website.

Shared for cross-context behavioral advertising?

YesShared for interest-based advertising. We do not sell this information.

Geolocation Data

Examples

Approximate location derived by converting (geocoding) an address you provide when creating an account or listing items for sale.

Shared for cross-context behavioral advertising?

No

Professional Information

Examples

Business or industry and equipment interests you provide.

Shared for cross-context behavioral advertising?

No

Sensitive Personal Information

Examples

Driver’s license, Social Security number, or tax identification number.

Shared for cross-context behavioral advertising?

No

Inferences

Examples

Interest and buyer/seller profiles we build from the information above (for example, equipment interests and likelihood to buy or sell).

Shared for cross-context behavioral advertising?

No


We do not knowingly collect biometric information, information about racial or ethnic origin, religious beliefs, health, or the contents of your communications. 
 
Payment card and bank account numbers are collected and processed directly by our third-party payment processors (see “How We Share and Disclose Information”); Steffes Group does not directly collect or store full payment account numbers.

Sensitive Personal Information
On occasion, we collect a driver’s license, Social Security number, or tax identification number. We collect this information only when it is disclosed to us directly by a customer seeking to make a tax-exempt purchase, and we use it solely to verify and document eligibility for that tax exemption and to comply with our legal and tax obligations. This information is stored within our customer records, is not sold or shared, and may be disclosed to taxing authorities, auditors, or regulators only when legally required.
 
How We Use Your Information
We may use personal information for the following business and commercial purposes:
  • To create and manage your account and verify your identity.
  • To operate our auctions, including processing registrations, bids, purchases, and sales, and preserving the integrity of the bidding process.
  • To process and fulfill transactions and payments through our third-party payment processors.
  • To validate eligibility for tax-exempt transactions and meet our tax and legal obligations.
  • To respond to your inquiries, requests, and communications submitted through our forms.
  • To send marketing and promotional communications about our auctions and services, subject to your choices.
  • To personalize your experience and understand how visitors use the Website so we can improve it.
  • To conduct analytics and interest-based advertising.
  • To assign office territory and conduct local market analysis.
  • To detect, prevent, and address fraud, security incidents, and misuse, and to maintain the security and integrity of the Website.
  • To maintain business records and to establish, exercise, or defend legal claims, and otherwise to comply with applicable law.
 
We may also use de-identified or aggregated information, which does not identify you, to understand trends, overall activity, platform usage, and to develop and improve our internal predictive and analytical models within our own controlled environments. We do not authorize the submission of customer personal information to public, third-party generative AI tools.
 
Cookies and Similar Technologies
Cookies are small data files stored on your device by your browser. We also use similar technologies such as pixels, tags, local storage, and software development kits (collectively, “cookies”). They help the Website function, remember your preferences, measure performance, and where you allow it, to personalize content and advertising.

We group cookies into the categories below. Essential Cookies are always active. The two optional categories are off by default and are activated only if you enable them and save your settings.

 

Essential Cookies

What it does

Required for core site operation, security, fraud prevention, reCAPTCHA, and log-in

Consent

Always active

Advertising & Targeting Cookies

What it does

Support personalized marketing and content and may involve advertising or measurement partners receiving online identifiers to provide selected services. We do not sell your personal information.

Consent

OptionalOff until you enable it in Cookie Preferences.

Personalization & Tracking Cookies

What it does

Support personalization and help us understand site behavior, including session-replay analytics (Microsoft Clarity), which runs only if you opt in.

Consent

OptionalOff until you enable it in Cookie Preferences.

 
Managing your choices. When you first visit, our consent banner presents “Only Necessary Cookies” and “Customize Settings.” In Customize Settings you can enable or disable the optional categories and save your choices with “Confirm Settings.” An always-available “Cookie Preferences” control in the site footer lets you change your choices at any time. You can also control cookies through your browser settings, although blocking Essential Cookies may affect how the Website works.

Analytics. We use Google Analytics to understand how the Website is used. Microsoft Clarity session-replay analytics runs only if you have opted in.
 
Third-party cookies. Some cookies are set by third parties that provide analytics, advertising, personalization, or security services on our behalf. When you enable an optional category, these partners may receive online identifiers such as cookies or device IDs and your IP address to provide the selected service. These optional categories are off by default and can be controlled through Cookie Preferences.

Opt-out preference signals. We honor recognized browser-based opt-out preference signals, the Global Privacy Control (GPC). Where your browser or device sends a valid signal, we treat it as a request to opt out of the sharing of personal information for that browser or device.

How We Share and Disclose Information
We disclose personal information to the following categories of recipients, for the purposes described:
 
  • Service providers and processors that perform services on our behalf, under contracts that require them to protect the information and use it only for the services they provide to us. These include our website host and cloud infrastructure provider, our payment processors, our live-auction webcast partner, and our email marketing provider.
  • Payment processors. For U.S.-based auctions, online payment details are provided to our third-party payment processor solely to process your payment, regardless of the payer’s country of residence.
  • Live auction partner. For live auctions with online participation, we share your name, email address, and bidder number with a third-party provider to assist us in offering the webcast bidding experience.
  • Advertising and analytics partners that help us measure performance and deliver interest-based advertising, as described below.
  • Legal, tax, and safety recipients — such as taxing authorities, auditors, regulators, courts, and law enforcement — when we believe disclosure is required by law, necessary to protect our rights or the safety of others, or in connection with an actual or proposed corporate transaction.
We do not “sell” your personal information for money or other valuable consideration.
We do “share” certain personal information for cross-context behavioral advertising. “Cross-context behavioral advertising” (also called interest-based advertising) means targeting ads to you based on your activity across different websites and services over time. To do this, we allow advertising and analytics partners to receive online identifiers (such as cookies and device IDs and IP addresses) and information about your activity on the Website through tracking technologies. Our current advertising and analytics partners for this purpose include Google, Meta (Facebook and Instagram), Microsoft, Sprout Social, and HubSpot. You can opt out of this sharing as described in “Your Choices and Opt-Outs.”

The personal information we share for cross-context behavioral advertising consists of identifiers and internet or network activity information. We have not sold any category of personal information.

Your Choices and Opt-Outs
  • Do Not Sell or Share My Personal Information. Although we do not sell personal information, we do share it for cross-context behavioral advertising. You can opt out of that sharing by adjusting your Cookie Preferences to turn off Advertising & Targeting Cookies, by using the “Do Not Sell or Share My Personal Information” control on our Website, or by contacting us at privacy@steffesgroup.com. We also honor recognized opt-out preference signals such as the Global Privacy Control (GPC).
  • Marketing communications. We send marketing by email and by mailed catalogs. You can opt out of marketing email at any time using the unsubscribe link in any message or by contacting us. Transactional and account messages are not marketing and may continue.
  • Cookies. Manage optional cookies at any time through the Cookie Preferences control in the site footer.
  • Account and communication preferences. You can review and update your account information, interests, and communication preferences in your Website profile or by contacting our support team.
Data Retention
We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to operate our auctions, preserve auction and bidding integrity, maintain business records, resolve disputes, and meet our tax, audit, accounting, and legal obligations. When information is no longer needed, we take steps to delete or de-identify it. We are formalizing written retention schedules; specific website analytics retention periods are set out below.

For Google Analytics (GA4): user-level and event-level data is retained for 14 months; age, gender, and interest (demographic) data is deleted after 2 months; and aggregated reporting data that does not identify you is retained on an ongoing basis.

Your U.S. Privacy Rights
As our baseline for all visitors, and subject to verification and legal exceptions, you may ask us to:
  • Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclose it.
  • Delete personal information we have collected from you, except where we are permitted or required to retain it — for example, to complete a transaction, preserve auction and bidding integrity, maintain required business or tax records, detect and prevent fraud and security incidents, or exercise or defend legal claims.
  • Correct inaccurate personal information we maintain about you.
  • Opt out of the sharing of your personal information for cross-context behavioral advertising (we do not sell personal information).

Depending on your state of residence, you may also have the right to obtain a portable copy of your personal information and to opt out of targeted advertising, the sale of personal data, and certain profiling that produces legal or similarly significant effects, as well as the right to appeal a denial of your request. We will not discriminate or retaliate against you for exercising your rights.
 
How to exercise your rights. Because we operate online and interact with you primarily through the Website, you may submit requests by email to privacy@steffesgroup.com. An authorized agent may submit a request on your behalf with proof of authorization. We will take reasonable steps to verify your identity before responding, and we may ask you for information needed to confirm your identity. We will respond within the time required by applicable law — generally within 45 days, with the ability to extend once by an additional 45 days when reasonably necessary, and we will tell you if we need more time. If we deny your request and your state provides an appeal right, our response will explain how to appeal.

Notice for Canadian Residents
If you are in Canada, the following applies in addition to the rest of this Policy. 
 
Purposes and consent. We identify the purposes for which we collect personal information at or before the time of collection and use it only for purposes a reasonable person would consider appropriate. We rely on your consent to collect, use, and disclose your personal information. Consent may be express or, where appropriate for non-sensitive information and obvious purposes, implied. 
 
We obtain express consent where required — for example, for sensitive information or uses you would not reasonably expect, including sharing identifiers with advertising partners for interest-based advertising, which you enable through your cookie choices. You may withdraw your consent at any time, subject to legal or contractual limits, by contacting us; withdrawing consent may affect our ability to provide certain services.
 
Cross-border storage and access. We store and process personal information on cloud infrastructure located in the United States. As a result, your personal information may be processed outside your province and outside Canada, and it may be accessible to courts, law enforcement, regulators, and national security authorities in the United States under the laws of that jurisdiction. We remain accountable for personal information we transfer to service providers and require them by contract to provide a comparable level of protection. You can obtain more information about our policies and practices regarding the use of service providers, using the details in “Contact Us.”
 
Your rights. You may request access to the personal information we hold about you and request correction of inaccuracies. Residents of certain provinces may also have the right to request a copy of their data and to request that we stop disseminating personal information or de-index links where dissemination causes harm or contravenes the law.
 
Marketing email. We send commercial electronic messages only with consent. Every marketing message identifies us, provides our contact information, and includes an unsubscribe mechanism that takes effect promptly. You can withdraw your consent to marketing messages at any time.
 
Concerns and complaints. If you have a concern about how we handle your personal information, please contact us first using the details below. You also have the right to complain to the Office of the Privacy Commissioner of Canada or to your provincial privacy regulator.

International Data Transfers
We are based in the United States and store personal information on U.S.-based cloud infrastructure. If you access the Website or provide information from Canada, Mexico, Europe, or another jurisdiction outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your location. We take steps to protect personal information consistent with this Policy and applicable law.

How We Protect Your Information
We take precautions to protect your information both in transit and at rest. Sensitive information you submit through the Website is encrypted in transit; you can look for a closed-lock icon or “https” at the beginning of the web address. We also protect information offline: only employees who need it to do their jobs (for example, billing or customer service) are granted access to personal information, and the systems on which we store personal information are kept in a secure environment. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Children’s Privacy
The Website is intended for adults. We do not knowingly collect or accept personal information from anyone under 18 years of age. If you believe a minor has provided us personal information, please contact us and we will take appropriate steps to delete it.

Links to Other Sites
The Website may contain links to other websites. We do not control, and are not responsible for, the content or privacy practices of those websites. We encourage you to review the privacy statements of any site you visit that collects personal information.

Changes to This Policy
We may update this Policy from time to time, and all updates will be posted on this page. Each version is dated at the top of this Policy. We review this Policy at least once a year and whenever we add a technology, vendor, or purpose. For material changes affecting cookies or data sharing, and where required by law, we will request your renewed consent.

Contact Us
If you have questions about this Policy or your privacy choices, or if you believe we are not abiding by this Policy, please contact us:
Steffes Group, Inc.
Email: privacy@steffesgroup.com