Privacy & Cookie Policy

Who we are

This Privacy & Cookie Policy explains how [SneakerSwap B.V.] ("SneakerSwap", "we") processes your personal data when you use our website, mobile app and marketplace services. We are the data controller.

Contact: [SneakerSwap B.V.], [Vestigingsadres] — Chamber of Commerce (KvK) [KvK-nummer]. Privacy questions: [privacy@sneakerswap.example]. We have not appointed a Data Protection Officer; the contact above handles privacy requests.

Scope

This policy covers our website, our mobile app and the SneakerSwap marketplace where buyers and sellers trade sneakers. It does not cover third-party websites we link to.

What data we collect

Account & identity: name, username, email, password (hashed), country, profile/bio, avatar.

Listing data: the sneakers you list, photos you upload, size, condition and price.

Transaction data: orders, amounts, payment status and payout details (handled by our payment provider).

Shipping data: delivery method and the address needed to ship an order. We never show a buyer's home address to a seller — shipping uses platform-generated labels.

Communications & support: messages, disputes and the evidence you submit.

Device & usage data: with your consent, analytics about how you use the service.

We collect data directly from you, automatically as you use the service, and — where relevant — from third parties such as our payment provider.

Why we process your data and our legal basis

To create and secure your account, and to provide the marketplace — performance of our contract with you (GDPR Art. 6(1)(b)).

To broker sales, take payment and hold funds in escrow, and to arrange shipping — performance of the contract (Art. 6(1)(b)); for payment, identity and anti-money-laundering checks our payment provider also acts under its own legal obligations (Art. 6(1)(c)).

To prevent fraud and keep the platform and our users safe — our legitimate interests (Art. 6(1)(f)). You can object (see Your rights).

To send you marketing emails — only with your consent (Art. 6(1)(a)); you can unsubscribe at any time.

To run product analytics — only with your consent for the cookies/trackers involved (see Cookies).

For the optional AI photo-recognition feature that helps fill in a listing from a photo — on the basis of your choice to use it (Art. 6(1)(a)/(f)). A human (you) always confirms the listing; we do not make automated decisions with legal effect about you.

To meet legal and tax obligations, e.g. keeping financial records — legal obligation (Art. 6(1)(c)).

AI features & automated decisions

Our photo-to-listing feature uses an AI vision provider to suggest a product match and condition from the photo you upload. It is decision support: you review and confirm. We do not make decisions producing legal or similarly significant effects about you solely by automated means. If we ever introduce automated fraud decisions that affect you, you will have the right to human review.

Who we share data with

We use carefully selected providers who process data on our behalf (processors) or, for their own regulated purposes, as independent controllers:

Hosting & database (EU region); payments & escrow; shipping & carriers; transactional email; product analytics; an AI vision provider for the photo feature. We share only what each provider needs.

We do not sell your personal data.

International transfers

We keep data in the European Economic Area (EEA) wherever possible. Where a provider processes data outside the EEA, we rely on an EU adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or on the European Commission's Standard Contractual Clauses with additional safeguards. You can request a copy of the relevant safeguards via the contact above.

How long we keep it

Order, payment, payout and VAT records: retained for the statutory period (7 years under Dutch tax law), after which they are deleted.

Account data: while your account is active and for a limited period afterwards to handle disputes and chargebacks, then deleted or anonymised.

Marketing & consent data: until you withdraw consent; we keep proof of consent.

Analytics: kept for a short period and minimised/aggregated.

A request to erase your data cannot override our legal duty to retain financial records for the statutory period.

Your rights

You have the right to access, rectify, erase, restrict and object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time without affecting prior processing.

To exercise a right, contact [privacy@sneakerswap.example] or use the in-app tools (e.g. the "Download my data" button). We respond within one month (extendable by two months for complex requests, with notice). Exercising your rights is free unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) and to a judicial remedy.

Security

We protect your data with measures including row-level access controls in our database, encryption in transit, restricted access and audit logging.

Children

SneakerSwap is intended for users aged 18 and over. We do not knowingly process personal data of minors.

Cookies & tracking

Strictly necessary cookies: needed to run the service (sign-in/session, security, language and your cookie choice). These are always active and need no consent.

Analytics cookies/trackers: used to understand how the service is used and improve it. We only place these if you accept them in our cookie banner. You can change or withdraw your choice at any time; declining is as easy as accepting, and we never block access to the site if you decline.

We do not use advertising-tracking cookies.

Changes to this policy

We may update this policy; we will change the date below and, for significant changes, notify you. Please review it periodically.