Privacy policy

Controller

to be completed, to be completed. Contact: to be completed.

What we process and why

• Account data: work email, company name, country, password (stored only as a scrypt hash). Purpose: running your account and the marketplace. Legal basis: contract (GDPR Art. 6(1)(b)).
• Orders and payments: what you bought or sold, quantities, prices, destination country, shipping references, payment status. Purpose: fulfilling the order, invoicing, accounting. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)).
• Supplier verification: company details and the Stripe account used for payouts. Stripe carries out the identity checks required by anti-money-laundering law. Legal basis: legal obligation and contract.
• Audit ledger: who did what and when (sign-ins, orders, stock changes). Purpose: security, fraud prevention and proving what happened in a dispute. Legal basis: legitimate interest (Art. 6(1)(f)).
• Technical data: IP address, held only in the server's memory for up to an hour to limit repeated sign-in and sign-up attempts, never written to disk. Legal basis: legitimate interest in keeping the service secure.

Cookies

We use a single cookie, wl_session, which keeps you signed in for up to 7 days. It is strictly necessary, so it needs no consent. There are no analytics, advertising or third-party tracking cookies. Fonts are served from our own server.

Who receives the data

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: Server hosting and database (data stored in Helsinki, Finland, EU).
• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland: Card payments, supplier payouts and supplier identity checks (Stripe Connect).
• The other party to your order: a supplier sees the buyer's company name and destination, a buyer sees the supplier's company name and warehouse.

Data is stored in the European Union. We do not sell personal data.

How long we keep it

• Account data: while the account is open, then up to 5 years (general limitation period, Ptk. 6:22. §).
• Orders, payments, commissions and the related ledger entries: 8 years, as Hungarian accounting law requires (Act C of 2000, § 169).
• Notifications: while the account is open.

Your rights

You can ask for access to your data, correction, erasure, restriction, portability, and object to processing based on legitimate interest (GDPR Art. 15–21). Signed-in users can download their data as JSON on the account page and change their profile there. For anything else, write to the contact address above; we answer within one month.

You can complain to the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11, naih.hu, or to the authority in your own EU country.