Privacy Policy

1. What we collect

• Account data: email, username, password (hashed), name, bio, photo, location, country, phone number and its verification status, language and currency preferences.
• Verification and business data: ID-verification status, business name, registration number, VAT ID and registered address for business sellers.
• Listings, bids and messages: photos, descriptions, offers, bids, chats and support conversations.
• Orders and payouts: shipping addresses, order history, card brand and last four digits, payout method labels and last four characters (full details go to our payment partner).
• Device and usage data: IP address, browser, login history, pages viewed, search terms, cookies described in the Cookie Policy.

2. Why we use it and the legal basis

• Contract (Art. 6(1)(b)): running your account, listings, orders, payouts, Buyer Protection, disputes.
• Legal obligation (Art. 6(1)(c)): tax and accounting records, DAC7 reporting, DSA obligations, responding to authorities.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, security, enforcing our Terms, improving the product, and personalising the brand suggestions under the search box from your searches, favourites, cart and recently viewed items (remove any search with its ×).
• Consent (Art. 6(1)(a)): marketing emails, optional cookies, SMS 2FA. You can withdraw consent at any time in Settings.

3. Who sees your data

Other members see your username, photo, bio, location, verification badges, seller type, listings and reviews; business sellers' identity details are public. A seller sees a buyer's name and shipping address for an order. We share data with processors who help us operate (payment provider, hosting, email and SMS delivery, shipping carriers) under data-processing agreements, with authorities when legally required, and in a merger. We never sell personal data.

4. Retention

Account data: while your account is active and up to 30 days after deletion. Order, payout and tax records: 10 years (Czech accounting and DAC7 obligations), anonymised where possible. Messages: 12 months after the last activity. Login history: 12 months. Recent searches: the last 50 per account, deleted with the account. Support conversations: 24 months.

5. Your rights

Access and portability (download your data in Settings → Privacy & data), rectification (edit your profile), erasure (request in Settings or by email), restriction and objection, and the right not to be subject to solely automated decisions with legal effect — enforcement decisions are reviewed by a person and can be appealed. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz) or your local authority.

6. International transfers

Data is stored in the EU. Where a processor is outside the EEA (for example a US-based email or SMS provider) we rely on the EU Standard Contractual Clauses or an adequacy decision.

7. Security

Passwords are hashed with scrypt, connections are encrypted with TLS, staff access is role-based and every administrative action is logged. If a breach affects you we notify you and the supervisory authority as the GDPR requires.

8. Children

eddy is not for anyone under 18. We delete accounts we learn belong to minors.

9. Contact

Data controller: eddy s.r.o., Šmahova 1244/112, 627 00 Brno-Slatina, Czechia. Privacy contact: privacy@eddy.market.