Privacy Policy

1. Data controller

The controller of your personal data is [Company legal name], [NIF], [registered address], Portugal. Contact for privacy matters: [privacy email]. [Data Protection Officer, if appointed: name/contact.]

2. Data we process

  • Account data: email address, display name, phone number, sign-in method (email, Google or Facebook).
  • Verification data: payment-card registration is performed by Stripe; we store only a Stripe customer reference, never card numbers. Seller identity verification (KYC) is performed by Stripe Connect.
  • DAC7 / tax data (sellers): legal name, address, tax identification number, date of birth, and per-seller earnings — collected because EU law requires it (Section 4).
  • Transaction data: bids, orders, amounts, ratings, and dispute records. Bid and auction-event records are kept as an append-only audit trail because they are the legal record of binding transactions.
  • Messages between buyers and sellers (filtered automatically to prevent pre-sale contact exchange).
  • Technical data: session cookies (essential only), IP addresses and logs for security and abuse prevention, and — only if enabled — error-monitoring identifiers.

3. Purposes and legal bases (GDPR Art. 6)

  • Operating the marketplace, auctions, payments and payouts — performance of a contract (Art. 6(1)(b)).
  • DAC7 tax reporting and accounting records — legal obligation (Art. 6(1)(c)).
  • Fraud prevention, anti-evasion filtering, strikes and platform security — legitimate interest (Art. 6(1)(f)).
  • Optional marketing communications — consent (Art. 6(1)(a)), withdrawable at any time.

4. DAC7 reporting

As an EU platform operator we report seller activity annually to the Portuguese tax authority (Autoridade Tributária e Aduaneira) under Council Directive (EU) 2021/514 ("DAC7"), as transposed into Portuguese law. The report includes your identification data, tax number, and the consideration you received through the Platform. The Portuguese authority exchanges this information with other EU member states' tax authorities. You are informed each year of the data reported about you.

5. Who receives your data

  • Stripe (payments, KYC, payouts) — acts as an independent controller for payment services and KYC.
  • Supabase (database, authentication, file storage) and Vercel (hosting) — processors under data processing agreements.
  • Tax authorities (DAC7, Section 4) and law enforcement where legally required.
  • Other users: your public profile shows display name, verification level, ratings and completed-sale counts. Contact details are exchanged between buyer and seller only after a win.

Where providers process data outside the EU/EEA, transfers rely on adequacy decisions or Standard Contractual Clauses.

6. Retention

Account data is kept while your account is active. Transaction, invoice and tax-relevant records (including the append-only bid and audit logs) are retained for the periods required by Portuguese tax and commercial law — up to 10 years. Messages are retained while the related transaction record exists. [Retention periods to be confirmed by lawyer/accountant.]

7. Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time. Note that erasure is limited where we must keep records by law (e.g. DAC7, accounting): in that case we anonymise what we can and retain the legally required minimum.

To exercise your rights, contact [privacy email]. You also have the right to lodge a complaint with the Portuguese supervisory authority, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or with your local EU supervisory authority.

8. Cookies

We use only strictly necessary cookies (authentication and session security). No advertising or analytics cookies are set at launch. If this changes, this policy and a consent mechanism will be updated first.