Privacy Policy

This Privacy Policy (the "Policy") explains how personal data is processed by Premium Logistics SHPK, a limited liability company (shoqëri me përgjegjësi të kufizuar) registered in the Republic of Albania, trading under the brand "Premium Auto Bid" ("Premium Auto Bid", "we", "us" or "our"). It applies to our website premlogistics.com, to the Premium Auto Bid platform and to every related service through which we help customers in Albania, Kosovo, North Macedonia and Montenegro discover Copart auction vehicles, place bids on Copart in real time through the Copart API, and coordinate purchase, transport, customs and import support.

The data controller responsible for the processing described in this Policy is Premium Logistics SHPK, NUIS/NIPT M53004202C, registered with the National Business Center (Qendra Kombëtare e Biznesit, QKB) of the Republic of Albania, with registered office at Rruga "Dubai", Lagjia nr. 2, cadastral zone 2066, property no. 89/38, 4-storey building, 2nd floor, Entrance 1, Kamëz, Tirana, Albania.

Effective date: 4 June 2026. Last updated: 4 June 2026. This Policy is governed by the law of the Republic of Albania, and any dispute relating to it falls within the jurisdiction of the competent courts of Tirana, without prejudice to any mandatory data-subject right to lodge a complaint with the supervisory authority as described below.

For all data-protection matters, including the exercise of your rights and any question about this Policy, you may contact our data protection function at privacy@premlogistics.com. General contact details are set out in the "Contact" section at the end of this Policy.

Premium Auto Bid is an independent vehicle sourcing, bidding and import-support platform. It is not owned by, operated by, endorsed by, or officially affiliated with Copart, Inc. Premium Auto Bid places customer bids on Copart in real time through the Copart API, after identity verification (KYC), acceptance of the Member Terms and an approved deposit; there is no manual operator or human agent placing bids on auction-house accounts. Copart and the Copart logo are trademarks of Copart, Inc. The specific sample listings currently shown on the platform are clearly-labelled demonstration samples; they are not real Copart lots and are not biddable.

By using the platform, creating an account, submitting identity documents, submitting bids, or otherwise providing personal data to us, you confirm that you have read and understood this Policy. Where we rely on consent, your consent is requested separately and may be withdrawn at any time. This Policy does not, by itself, create contractual obligations beyond those set out in our Terms of Use and Member Terms.

We collect personal data that you provide directly, data generated through your use of the platform, and a limited amount of data obtained from third parties for verification and compliance purposes. We collect only what is necessary for the purposes described in this Policy. The categories below describe the data we may process depending on how you interact with us.

Account and contact data

• Full name, username and the password or authentication credentials associated with your account.
• Email address, telephone number and preferred language and market (Albania, Kosovo, North Macedonia or Montenegro).
• Postal or correspondence address and, where relevant for import or delivery coordination, a destination address.
• Account preferences, saved searches, watchlists and notification settings.

Identity and KYC documentation

• Government-issued identity documents (for example national ID card, passport or driving licence), including document number, issuing authority, date of issue and expiry, and the image or scan you upload.
• Date of birth, nationality and, where required by law, place of residence.
• Verification metadata, such as the outcome of identity checks, the date of verification and the assigned verification tier.
• Where higher assurance is required, supporting documents evidencing address or source of funds.

Payment, deposit and proof-of-payment data

• Deposit and balance records denominated in USD, including the standard deposit and the percentage-based deposit applicable to higher-value vehicles.
• Bank transfer details and references for inbound payments made in USD or EUR, and receipt details for cash payments made in ALL at our Tirana office.
• Proof-of-payment documents that you upload (for example bank transfer confirmations or receipts) so that an operator can independently verify the payment.
• Ledger entries, refunds, adjustments and the status of each deposit or balance.

We do not operate, and do not integrate with, any third-party card processor for this flow, because such processors are not available for this use case in Albania. We therefore do not collect or store full payment-card numbers. Inbound payments are confirmed manually by an operator on the basis of the proof you upload and our own bank statements or cash receipts.

Vehicle inquiry and bid-request data

• Vehicles, lots or searches you view, save or inquire about (noting that current listings are demonstration/sample data only).
• Bids you submit, including your maximum-bid amount, the relevant lot reference and any conditions or notes you attach.
• The status of each bid, including the KYC, deposit and Member Terms checks that must be completed before a bid can be placed on Copart in real time through the Copart API.
• Records of purchases, transport, customs and import-support arrangements coordinated through us.

Communications data

• The content of, and metadata relating to, your communications with us by email, telephone, in-platform messaging, support tickets or messaging applications.
• Records of consents, requests, complaints and the responses we provide.

Device, usage and analytics data; cookies

• Technical data such as IP address, device and browser type, operating system, language settings and approximate location derived from your IP address.
• Usage data such as pages viewed, features used, the dates and times of access, and referring or exit pages.
• Data collected through cookies and similar technologies, as described in our Cookie Policy.

We do not seek to collect special categories of personal data (such as data revealing health, political opinions or religious beliefs). Please do not submit such data to us unless we specifically request it for a lawful purpose. An identity or address document may incidentally contain additional information; we use only the elements necessary for verification and compliance.

We process personal data only where we have a lawful basis to do so under Albanian Law no. 9887 dated 10.03.2008 (as amended) and, where applicable, the GDPR. The principal purposes and the legal bases on which we rely are set out below. Where more than one basis is available, we rely on the basis most appropriate to the specific processing activity.

Performance of a contract

• Creating and administering your account and providing access to the platform.
• Placing your bids on Copart in real time through the Copart API, recording deposits and balances, and coordinating purchase, transport, customs and import support.
• Communicating with you about your requests, transactions and account, and providing customer support.

Compliance with legal obligations

• Carrying out identity verification (KYC), customer due diligence and ongoing monitoring under Albanian Law no. 9917 dated 19.05.2008 'On the Prevention of Money Laundering and Financing of Terrorism' (as amended) and related guidance, having regard to FATF recommendations.
• Screening against applicable sanctions frameworks, including United Nations, European Union and United States (OFAC) measures, and applying anti-corruption controls consistent with the Albanian Criminal Code and with principles drawn from the US FCPA and the UK Bribery Act for international dealings.
• Detecting, investigating and reporting suspicious activity, including reporting to the General Directorate for the Prevention of Money Laundering (the Albanian Financial Intelligence Unit) where required.
• Meeting accounting, tax, record-keeping and other statutory obligations, and responding to lawful requests from public authorities, courts and regulators.

Legitimate interests

• Securing the platform, preventing and detecting fraud and abuse, and protecting our customers, our staff and the company.
• Operating, maintaining, debugging and improving the platform and our services, including aggregate analytics and quality assurance.
• Managing our relationship with auction-related, transport, logistics and other service partners, and establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we carry out a balancing assessment to ensure that our interests are not overridden by your interests or fundamental rights and freedoms. You may object to processing based on legitimate interests as described in the "Your Rights" section.

Consent

• Sending optional marketing or service-update communications where consent is required.
• Setting non-essential cookies and similar technologies, as described in our Cookie Policy.
• Any other processing for which we specifically ask for your consent.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent will not affect processing that we are required or permitted to carry out on another lawful basis, such as compliance with a legal obligation.

Identity verification and acceptance of the Member Terms are required before any bid can be placed. An approved deposit is also required and is separate from the final purchase payment. We collect identity documents to confirm who you are, to meet our anti-money-laundering and counter-terrorist-financing obligations, and to apply the verification tier relevant to your activity.

When you upload an identity or supporting document, we handle it as follows: we store it within access-controlled systems; we restrict access to personnel who need it for verification, compliance or dispute-handling; we use it only for the purposes for which it was collected; and we retain it for the period required to meet our legal obligations and to defend potential claims, as described in our Data Retention and Deletion Policy.

Identity verification may be supported by specialist compliance, screening or verification service providers acting as our processors. Such providers are permitted to process identity data only on our documented instructions and under appropriate contractual and security safeguards. We do not sell identity documents, and we do not use them for advertising.

Completing identity verification (KYC), accepting the Member Terms and holding an approved deposit are prerequisites before any bid can be placed. Once these conditions are met, Premium Auto Bid places your bids on Copart in real time through the Copart API; there is no manual operator or human agent placing bids on auction-house accounts on your behalf.

We do not sell your personal data. We share personal data only where it is necessary for the purposes described in this Policy, where you have asked us to do so, or where we are legally required or permitted to share it. The categories of recipients are set out below.

• Service providers and processors: hosting, infrastructure, storage, communications, customer support, analytics and other vendors that process personal data on our behalf under written contracts and only on our instructions.
• Transport and logistics partners: carriers, freight forwarders, shipping lines and customs agents involved in coordinating the movement, clearance and delivery of vehicles.
• Compliance and screening tools: providers of identity verification, sanctions and watchlist screening, and fraud-prevention services that support our KYC and AML obligations.
• Banks and payment partners: financial institutions involved in confirming inbound bank transfers in USD or EUR, and in processing refunds, and personnel handling cash receipts in ALL at our Tirana office.
• Auction-related partners: Copart and other parties where and to the extent it is necessary in connection with sourcing, bidding on or purchasing a vehicle, including the submission of your bids to Copart in real time through the Copart API; such sharing will be limited to what is necessary for the relevant transaction.
• Public authorities and regulators: courts, law-enforcement bodies, tax authorities, the Albanian Financial Intelligence Unit, the supervisory authority for data protection, and other competent authorities where required by law or to protect rights, property or safety.
• Professional advisers and prospective transactions: lawyers, accountants, auditors and insurers, and, subject to appropriate safeguards, a successor entity in connection with any merger, acquisition or reorganisation.

Where a recipient acts as our processor, we put in place a contract requiring the recipient to protect personal data, to process it only on our instructions, and to apply appropriate security measures. Where a recipient acts as an independent controller (for example a bank or a public authority), that recipient processes your data under its own privacy terms and legal obligations.

Our services involve the United States vehicle-auction ecosystem, and some of our service providers may be located outside Albania, including within the European Economic Area and the United States. As a result, personal data may be transferred to, and processed in, countries that may not provide the same level of data protection as your country of residence.

Where we transfer personal data internationally, we take steps to ensure an adequate level of protection in accordance with Albanian Law no. 9887 (as amended) and, where applicable, the GDPR. Depending on the recipient and destination, these steps may include transfers to countries recognised as providing an adequate level of protection, the use of standard contractual clauses or equivalent contractual safeguards, and additional technical and organisational measures.

You may request further information about the safeguards applied to a specific transfer, including how to obtain a copy where one is available, by contacting privacy@premlogistics.com.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to provide our services, to comply with our legal, accounting and regulatory obligations (in particular anti-money-laundering record-keeping requirements), to resolve disputes, and to establish, exercise or defend legal claims.

Retention periods differ by category of data and by the obligation that applies to it. Identity and transaction records that are subject to anti-money-laundering legislation are kept for the minimum periods required by that legislation. When personal data is no longer required, we delete it or irreversibly anonymise it.

The specific criteria and periods we apply are set out in our Data Retention and Deletion Policy, which forms part of our overall data-protection framework and should be read together with this Policy.

We apply appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, the principle of least privilege, encryption in transit, logging and monitoring, and internal policies governing how staff handle personal data.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim to hold any particular security certification or attestation. Our security measures, governance and incident-handling procedures are described in our Data Security Policy, which should be read together with this Policy.

You also play an important role in keeping your data secure: please keep your credentials confidential, use a strong and unique password, and notify us promptly at privacy@premlogistics.com if you suspect any unauthorised use of your account.

Subject to the conditions and exceptions provided by applicable law, you have the following rights in relation to your personal data:

• Access: to obtain confirmation of whether we process your personal data and, if so, to obtain a copy of that data and related information.
• Rectification: to have inaccurate personal data corrected and incomplete data completed.
• Erasure: to have your personal data deleted where there is no overriding legal basis for us to keep it.
• Restriction: to ask us to limit our processing of your personal data in certain circumstances.
• Objection: to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Portability: to receive personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Withdrawal of consent: to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact privacy@premlogistics.com. We may need to verify your identity before acting on a request, in particular where the request concerns identity or financial data. We will respond within the time limits required by applicable law. Some rights are not absolute; where we cannot fully comply, for example because we must retain certain records under anti-money-laundering law, we will explain the reason.

You have the right to lodge a complaint with the supervisory authority, the Information and Data Protection Commissioner of Albania (IDP), if you believe that our processing of your personal data does not comply with applicable law. We would, however, appreciate the opportunity to address your concerns first, so we encourage you to contact us at privacy@premlogistics.com before doing so.

We use cookies and similar technologies to operate the platform, to remember your preferences, to keep the platform secure and, where you consent, to measure usage and improve our services. Essential cookies are necessary for the platform to function; non-essential cookies are used only with your consent.

Detailed information about the cookies we use, their purposes and durations, and how you can manage or withdraw your cookie choices, is set out in our Cookie Policy, which should be read together with this Policy.

The platform is intended for use by adults and is not directed at children. We do not knowingly create accounts for, provide services to, or collect personal data from, individuals under the age of 18. Identity verification and the acceptance of the Member Terms require that you are of legal age and have full legal capacity.

If we become aware that we have inadvertently collected personal data from a person under 18 without an appropriate legal basis, we will take reasonable steps to delete that data. If you believe that a minor has provided us with personal data, please contact privacy@premlogistics.com.

Premium Auto Bid facilitates access to vehicles sold by third-party auction sources. Some of the personal data we process is connected to vehicle inquiries, bid requests and import coordination. For the avoidance of doubt, and to set accurate expectations, the following applies to the information shown on the platform.

Vehicles are sold as-is by third-party auction sources. Premium Auto Bid does not guarantee the condition, title, mileage, damage, history, availability or auction outcome of any vehicle, nor any shipping or customs timeline; no outcome is guaranteed. The specific sample listings currently displayed are clearly-labelled demonstration samples, do not represent real Copart lots, and are not biddable.

This section concerns the accuracy and status of vehicle-related information and does not limit your data-protection rights. Commercial terms relating to vehicles, deposits, bidding and import support are governed by our Terms of Use and Member Terms.

We may update this Policy from time to time to reflect changes in our services, in our data-processing practices, or in applicable law. When we make material changes, we will update the "Last updated" date and, where appropriate, provide additional notice through the platform or by contacting you.

We encourage you to review this Policy periodically. Your continued use of the platform after an updated Policy takes effect indicates that you have read the updated Policy. Where a change requires your consent under applicable law, we will obtain that consent before the change applies to you.

If you have any questions, requests or complaints regarding this Policy or our processing of your personal data, please contact us. For data-protection matters, including the exercise of your rights, please use the privacy address below.

• Data controller: Premium Logistics SHPK (trading as Premium Auto Bid), NUIS/NIPT M53004202C.
• Registered office: Rruga "Dubai", Lagjia nr. 2, cadastral zone 2066, property no. 89/38, 4-storey building, 2nd floor, Entrance 1, Kamëz, Tirana, Albania.
• Data protection / DPO: privacy@premlogistics.com.
• Compliance: compliance@premlogistics.com.
• Legal: legal@premlogistics.com.
• General enquiries: info@premlogistics.com; customer support: support@premlogistics.com.
• Website: premlogistics.com.

Supervisory authority: the Information and Data Protection Commissioner of Albania (IDP), with whom you have the right to lodge a complaint about our processing of your personal data.