Privacy Policy | GarazSale

1. Data Controller

GarageSale ("we", "us", "our") operates this marketplace platform. As the data controller under the General Data Protection Regulation (GDPR), we are responsible for the processing of your personal data. If you have questions about this policy or your rights, contact us at privacy@garagesale.eu.

2. Data We Collect

We collect and process the following categories of personal data:

Identity data: Full name, email address, profile photo (optional).
Account data: Username, password (hashed), account preferences, language and currency settings.
Transaction data: Listings created, bids placed, purchases, donation history, escrow records.
Location data: Approximate geographic coordinates saved in your profile for proximity-based features (with your explicit consent).
Payment data: Processed via Stripe Inc. We do not store card details on our servers. Stripe acts as a separate data controller for payment processing.
Communication data: In-platform messages, dispute submissions, campaign applications.
Technical data: IP address, browser type, device information, access logs (retained for security purposes).

3. Legal Basis for Processing

We process your data under the following legal bases (Article 6 GDPR):

Contractual necessity (Art. 6(1)(b)): Processing required to provide you with the platform services, including listings, bidding, payments, and escrow.
Legal obligation (Art. 6(1)(c)): Compliance with EU financial regulations, anti-money laundering laws, and identity verification requirements.
Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, dispute resolution, and service improvement.
Consent (Art. 6(1)(a)): Location-based filtering, marketing communications (where applicable), and non-essential cookies. You may withdraw consent at any time.

4. How We Use Your Data

To create and manage your account and listings.
To facilitate transactions, escrow services, and charity donations.
To send transactional notifications (bid updates, messages, dispute alerts).
To verify identity for campaign requests and compliance purposes.
To calculate and display trust/reputation scores.
To improve platform safety via fraud detection and dispute analysis.
To comply with applicable EU law and respond to lawful requests from authorities.

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only with:

Stripe Inc.: For secure payment processing. Governed by Stripe's own Privacy Policy.
OpenAI: Listing descriptions and dispute analysis may use AI assistance. No personal identity data is included in AI prompts.
Other users: Your public profile information (username, trust score, public listings) is visible to other platform users.
Legal authorities: When required by EU law or a valid court order.

6. Data Retention

We retain your personal data for as long as your account is active or as required to provide services. Transaction records are retained for 7 years in compliance with EU accounting regulations. You may request deletion of your account data at any time, subject to retention obligations under applicable law.

7. Your Rights Under GDPR

As an EU/EEA resident, you have the following rights:

Right of access (Art. 15): Request a copy of the data we hold about you.
Right to rectification (Art. 16): Correct inaccurate or incomplete data.
Right to erasure (Art. 17): Request deletion of your data ("right to be forgotten"), subject to legal retention obligations.
Right to restriction (Art. 18): Limit how we process your data in certain circumstances.
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to object (Art. 21): Object to processing based on legitimate interests.
Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise your rights, email privacy@garagesale.eu. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority (e.g., your EU Member State's DPA).

8. Cookies & Tracking

We use strictly necessary cookies to operate the platform (session management, security). We do not use advertising or tracking cookies without your explicit consent. You can manage cookie preferences through your browser settings at any time.

9. International Transfers

Your data is primarily processed within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g., to Stripe or OpenAI servers in the US), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

10. Children's Privacy

Our platform is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a child under 16, we will delete it promptly.

11. Changes to This Policy

We may update this policy periodically. Material changes will be notified to you via email or an in-platform notice at least 30 days before taking effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

12. Contact

For any privacy-related queries, please contact our Data Protection Officer at privacy@garagesale.eu or write to: GarageSale DPO, [Company Address], European Union.