Trademeup

Last updated: 2026-08-23 · v1.0

Privacy Policy

Effective date: 22 August 2026, version 0.1 (draft)

1. Controller

The controller within the meaning of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") for the processing of personal data on the platform trademeup.eu is:

TTA Technologies {{COMPANY_ADDRESS}} Grand Duchy of Luxembourg RCS: {{RCS_NUMBER}}, VAT: {{VAT_NUMBER}} E-mail: [email protected]

(Review point: assess whether a data protection officer is required under Art. 37 GDPR; if appointed, add contact details here.)

2. Overview of Processing Activities

We process personal data in particular in the following contexts:

2.1 User Account and Platform Use

  • Data: name, e-mail address, password (hashed), address(es), language setting, account settings, listing and order data, reviews, messages and dispute communication, log data (IP address, timestamps, device data).
  • Purposes: provision of the Platform, contract performance, intermediation of purchase contracts, security and abuse prevention.
  • Legal bases: Art. 6(1)(b) GDPR (contract); Art. 6(1)(f) GDPR (legitimate interest in security and operation).

2.2 Identity Verification (KYC) via Stripe Identity

  • Sellers must complete identity verification via Stripe Identity before their first listing (identity document, selfie/biometric comparison performed by Stripe, verification result).
  • Allocation of roles: For carrying out the verification, complying with its own legal obligations (e.g. anti-money-laundering and financial supervision law) and improving its verification technology, Stripe processes the data as an independent controller; to the extent Stripe provides us with the verification result and individual evidence data for activating the seller account, Stripe acts partly as an independent controller and partly as our processor. As a rule, we only receive the result (passed/failed) and the details required for documentation, not raw biometric data.
  • Legal bases: Art. 6(1)(b) GDPR (seller admission); Art. 6(1)(c) GDPR in conjunction with commercial and tax law obligations and DSA obligations on the traceability of traders (Art. 30 DSA, "Know Your Business Customer"); Art. 6(1)(f) GDPR (fraud prevention).
  • Details: Stripe Privacy Policy, https://stripe.com/privacy

2.3 Payment Processing via Stripe

  • Payment processing is carried out exclusively by Stripe Payments Europe, Ltd. (Ireland). Payment data (card data, bank details) are collected and stored directly by Stripe, not on our servers. We receive status information from Stripe (e.g. payment succeeded, refund, payout) and token references of stored payment methods.
  • For payment processing, its own compliance obligations and fraud prevention, Stripe is an independent controller; for individual functions performed on our behalf (e.g. storing payment methods for future purchases on our Platform), Stripe acts as a processor.
  • Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR (Stripe's payment and anti-money-laundering obligations); Art. 6(1)(f) GDPR.

2.4 Shipping and Tracking

  • To fulfil orders, we or the sellers pass on the buyer's name and delivery address to the chosen carrier (e.g. DHL, Mondial Relay, Hermes/Evri, Post Luxembourg, Colissimo, bpost).
  • For orders with Buyer Protection, we retrieve tracking data (shipment status, delivery date) from the carrier or via tracking services to manage the Buyer Protection deadlines.
  • Legal bases: Art. 6(1)(b) GDPR; Art. 6(1)(f) GDPR (proof of delivery, fraud prevention).

2.5 Tax Reporting Obligations (DAC7)

  • As a platform operator, we are obliged under Directive (EU) 2021/514 ("DAC7", implemented in Luxembourg by the law of 16 May 2023) to report data of reportable sellers annually to the Luxembourg tax administration (Administration des contributions directes), which exchanges it with the tax authorities of other member states.
  • Data: inter alia name, address, date of birth or registration number, tax identification number, VAT number, bank account/identifier of the payout account, number of transactions, consideration paid, fees withheld.
  • The reporting obligation applies in particular from 30 sales or more than EUR 2,000 in consideration per calendar year and seller. Sellers are informed about the reporting.
  • Legal basis: Art. 6(1)(c) GDPR (legal obligation).

2.6 Hosting and Infrastructure

  • Hosting: our servers are operated by Hetzner Online GmbH (Germany) (processor, data centres in Germany).
  • Cloudflare, Inc. provides content delivery, DNS and protection against attacks (processor); IP addresses and technical connection data are processed, potentially also outside the EU (safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework, where applicable).
  • Search: card search runs on Meilisearch on our own servers; no payment data is indexed.
  • Further storage services (database, object storage for images, delivery notes and invoices) run on our own infrastructure at Hetzner.
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, performant operation); data processing agreements under Art. 28 GDPR are in place.

2.7 E-mail Sending

  • We send transactional and system e-mails (order confirmations, shipping and Buyer Protection notifications, dispute updates) via an e-mail service provider acting as processor (sender domain trademeup.eu). (Review point: name the specific provider and location before publication.)
  • We send marketing e-mails only with consent (Art. 6(1)(a) GDPR) or within the statutory limits of existing-customer marketing; you can unsubscribe at any time.

2.8 Cookies and Similar Technologies

  • We use technically necessary cookies (session, security, language setting) on the basis of our legitimate interest or their necessity for the service.
  • Non-essential cookies (e.g. statistics, marketing) are only set with your consent via the consent banner (Art. 6(1)(a) GDPR; consent can be withdrawn at any time). Details, including the list of providers, are contained in the consent banner. (Review point: complete the final tool list before launch.)

2.9 Reports, Sanctions and Disputes

  • To handle reports (DSA), disputes and sanctions, we process the report, the content concerned, communication and evidence.
  • Legal bases: Art. 6(1)(c) GDPR (DSA obligations); Art. 6(1)(f) GDPR (secure and lawful platform).

3. Recipients

Recipients of personal data include in particular:

  • the respective contractual partner (sellers receive the buyer's name and delivery address; buyers receive the seller details required by law, and for Pro Sellers the business details);
  • Stripe (payment processing, identity verification, Connect payouts);
  • carriers and tracking services;
  • Hetzner (hosting), Cloudflare (CDN/security), e-mail service providers;
  • authorities, where required by law (in particular the tax administration under DAC7, law enforcement and supervisory authorities);
  • advisers (lawyers, tax advisers, auditors) to the extent necessary.

4. Transfers to Third Countries

Transfers to third countries only take place where necessary for the purposes stated (e.g. Cloudflare, individual Stripe group companies, international shipment tracking). They are based on adequacy decisions (including the EU-US Data Privacy Framework) or EU standard contractual clauses with supplementary measures. Copies of the safeguards can be requested via [email protected].

5. Retention Periods

  • Account and profile data: for the duration of the user agreement; after account deletion, erasure or restriction unless retention obligations apply.
  • Accounting-relevant data (orders, invoices, commission statements): 10 years in accordance with Luxembourg commercial and tax retention obligations.
  • DAC7 reporting data: in accordance with tax requirements (retention of reporting and due diligence records, 10 years in Luxembourg).
  • KYC/verification results: for the duration of the seller admission plus statutory retention periods; DSA trader data (Art. 30) for the duration of the contractual relationship and 6 months thereafter.
  • Dispute and sanction data: until the case is closed plus the limitation periods for civil claims.
  • Log data: as a rule no longer than 90 days, unless required for longer to investigate security incidents. (Review point: consolidate the retention schedule with legal/tax counsel before publication.)

6. Obligation to Provide Data

The provision of certain data is required to use the service (account: e-mail; buying: delivery address; selling: identity verification, payout account, for Pro Sellers business evidence and the mandatory DAC7 particulars). Without this data, the respective functions cannot be used.

7. Automated Decision-Making

No decision-making based solely on automated processing with legal effect takes place on the Platform. Automated checks (e.g. fraud and counterfeit detection, auto-release of the Buyer Protection payout after the deadline) are reviewed by humans where they have significant effects; Stripe's identity verification may contain automated elements (see the Stripe Privacy Policy).

8. Your Rights

Under the GDPR you have in particular the right to:

  • access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20);
  • object (Art. 21) to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation, and at any time to direct marketing;
  • withdraw consent with effect for the future (Art. 7(3)).

To exercise your rights, an e-mail to [email protected] is sufficient.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority, in particular with the authority competent for us:

Commission nationale pour la protection des données (CNPD) 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg www.cnpd.lu

9. Online Dispute Resolution and Consumer Information

The European Commission provides a platform for online dispute resolution (ODR): https://ec.europa.eu/consumers/odr. (Review point: the ODR platform is being discontinued in 2025/2026; adapt this notice.) Our e-mail address is stated above.

10. Changes

We will update this Privacy Policy where processing activities or legal bases change. The version published on the Platform applies; previous versions are archived.