Privacy Policy

This Privacy Policy explains how [Company name] ("we", "us") processes personal data when you use our online marketplace, including the customer shop and the merchant centre. It applies to customers, visitors and the people who work for merchants on our platform.

1. Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

[Company name] [Registered address] Represented by: [Managing director] Email: [support@example.com]

For all questions about data protection, and to exercise your rights, write to [privacy@example.com].

Merchants are responsible for their own processing. Our platform brings customers and independent merchants together. When you place an order, we pass the order data to the merchant you are buying from. The merchant then processes this data under its own responsibility (for example to prepare your order, hand it over, take payment, issue a receipt and handle returns). For that processing the merchant is a separate controller; you can contact it directly using the details shown on its shop page.

2. What we process, why, and on what legal basis

Purpose	Data	Legal basis (GDPR)
Creating and running your customer account	Email address, password (stored only as a one-way hash), nickname if you give one, preferred language, date of email verification, time and version of your acceptance of our Terms of Service	Art. 6(1)(b): performance of the contract of use
Orders and pickup	Items, quantities, prices, chosen merchant and pickup point, order status, pickup code, time of pickup, items actually collected, coupon used	Art. 6(1)(b)
Returns and mediation	Return request, reasons, photos you upload, messages between you, the merchant and our customer service, refund amount recorded by the merchant	Art. 6(1)(b); for our mediation also Art. 6(1)(f) (fair resolution of disputes on our platform)
Service emails	Email address, language, content of the notice (for example order confirmations, pickup codes, reminders, recall notices)	Art. 6(1)(b); recall and safety notices: Art. 6(1)(c) together with Art. 22 of Regulation (EU) 2023/988 (GPSR)
Marketing emails	Email address, language, time of your consent	Art. 6(1)(a): your consent, which you can withdraw at any time in your account settings
Security and abuse prevention	IP address, time and type of requests, failed login attempts, temporary account locks	Art. 6(1)(f): protecting our platform, our users and their accounts
Order restrictions after repeated no-shows	Number of orders not picked up within 90 days, date until which ordering is restricted	Art. 6(1)(f): protecting merchants from reserved stock that is never collected (see section 7)
Reports of illegal content or unsafe products	Your report, your name and email if you give them, our decision	Art. 6(1)(c) together with Art. 16 of Regulation (EU) 2022/2065 (Digital Services Act) and GPSR
Merchant onboarding and checks (for people acting for merchants)	Name, contact details, identity document, trade register entry, tax and payout details, self-certification	Art. 6(1)(c) together with Art. 30 Digital Services Act and Directive (EU) 2021/514 (DAC7); Art. 6(1)(b) for the merchant contract
Accounting and tax records	Orders, pickups, returns and merchant data snapshots	Art. 6(1)(c): retention duties under tax and commercial law
Operation log of our staff and merchant staff	Who did what and when, IP address	Art. 6(1)(f): traceability and security

We do not sell personal data and we do not use it for advertising profiles.

3. Who receives your data

The merchant you order from receives the data it needs to fulfil your order: your order details, the email address of your account and your nickname if you have given one. When you request a return, the merchant also receives your return request and photos.
Service providers that we use as processors under Art. 28 GDPR, bound by contract to follow our instructions: hosting and database provider [to be named], email delivery provider [to be named], file storage provider [to be named].
Authorities, where we are legally required, for example tax authorities (DAC7 reports about merchants), market surveillance authorities (product safety) and law enforcement authorities on the basis of a lawful order.

4. Transfers outside the EU/EEA

We host our platform in the EU/EEA [to be confirmed with the hosting provider].

Some merchants are established outside the EU/EEA, for example in Serbia, and serve customers at their own pickup points. If you order from such a merchant, we transmit your order data to that merchant because this is necessary for the contract you asked for (Art. 49(1)(b) GDPR). The merchant's country of establishment is shown on its shop page.

5. How long we keep data

Data	Retention period
Customer account	Until you delete your account
Orders, pickups, returns and merchant data snapshots	At least 10 years, as required for tax and accounting records. When you delete your account these records stay but are anonymised as far as the law allows
Marketing consent	Until you withdraw it, then a record of the withdrawal for as long as we need to prove it
Security data (rate limiting, failed logins)	For the short time windows needed for protection, usually minutes to hours
Verification data of merchants collected under Art. 30 Digital Services Act (identity document and similar)	6 months after the end of the contract with the merchant, then deleted
Operation log	[to be determined]
Reports of illegal content	[to be determined], at least as long as needed to handle complaints

6. Cookies and storage on your device

We do not use tracking or advertising cookies and we do not use analytics tools.

We store only what is strictly necessary for the service you request in your browser's local storage: your login tokens (so you stay signed in) and your chosen language. This storage does not require consent (Art. 5(3) of Directive 2002/58/EC). You can remove it at any time by signing out or clearing your browser data.

7. Automated decisions

If three of your orders within 90 days are not picked up before the pickup deadline, ordering is automatically restricted for 30 days. You can still sign in, and your account page shows the date when the restriction ends. If you think the restriction is wrong, contact us at [support@example.com]. A member of our staff will review your case and can lift the restriction.

We make no other decisions about you that are based solely on automated processing.

8. Your rights

Under the GDPR you have the right to:

access your personal data (Art. 15) — you can download your data and order history yourself in your account;
have incorrect data corrected (Art. 16);
have your data erased (Art. 17) — you can delete your account yourself, unless you still have open orders or returns;
restrict processing (Art. 18);
data portability (Art. 20);
object to processing based on legitimate interests (Art. 21);
withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. The authority responsible for us is: [Data protection supervisory authority].

9. Security

Passwords are stored only as one-way hashes. Identity documents and payout details of merchants are stored encrypted. Access to personal data in our back office is limited by roles, and every view of merchant identity documents is logged.

10. Changes

We will update this Privacy Policy when our processing changes. The version is shown at the bottom of this page. If a change affects you significantly, we will inform you by email.