Privacy Policy

1. Introduction & Data Controller

ReVaulted ("we", "us", "our") is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act (ZZLD). This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our Platform. The data controller is ReVaulted, registered in the EU. For data protection inquiries, contact our Data Protection Officer at privacy@revaulted.com.

2. Legal Basis for Processing

We process your personal data under the following legal bases as defined in GDPR Article 6:

• Contractual necessity (Art. 6(1)(b)): Processing required to perform our services — account creation, transaction processing, escrow, shipping, payouts.
• Legal obligation (Art. 6(1)(c)): Tax reporting (DAC7), anti-money laundering (AML), financial record-keeping, law enforcement cooperation.
• Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, analytics, service improvement, customer support.
• Consent (Art. 6(1)(a)): Marketing communications, optional cookies, newsletter subscriptions. You may withdraw consent at any time.

3. Information We Collect

3.1 Information you provide directly:

• Account data: email address, display name, password (hashed), profile photo
• Identity data (sellers): full legal name, date of birth, address, tax identification number (TIN) — required for DAC7 compliance
• Transaction data: purchase history, listing details, shipping addresses, courier preferences
• Communication data: messages between buyers and sellers, support tickets, dispute evidence
• Financial data: bank account details for payouts (processed via Stripe, not stored directly by us)

3.2 Information collected automatically:

• Device data: IP address, browser type and version, operating system, device identifiers
• Usage data: pages visited, features used, search queries, click patterns, session duration
• Location data: approximate location derived from IP address (not GPS)
• Cookies and similar technologies: session management, authentication tokens, analytics

4. How We Use Your Information

• Process transactions: facilitate purchases, escrow, shipping label generation, payouts
• Provide customer support and dispute resolution
• Send transactional notifications: order confirmations, shipping updates, escrow releases, return status
• Comply with legal obligations: DAC7 tax reporting, AML compliance, financial record-keeping
• Prevent fraud: detect suspicious activity, verify identities, block prohibited items
• Improve the Platform: analytics, A/B testing, performance optimization
• Marketing (with consent only): promotions, newsletters, personalized recommendations

5. Data Sharing & Third Parties

We share personal data only when necessary and with appropriate safeguards:

• Payment processor (Stripe): payment details, transaction amounts, customer identity for fraud prevention
• Shipping couriers (Econt, Speedy, DHL, etc.): sender/recipient names and addresses, package weight, customs data
• Tax authorities: seller identification and transaction data as required by DAC7 and national tax law
• Law enforcement: when legally required by court order, subpoena, or mandatory disclosure obligation
• Between Buyers and Sellers: display name, country, and shipping address (for the specific transaction only)

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes.

6. Data Retention

• Account data: retained while your account is active and for 30 days after deletion request
• Transaction records: retained for 7 years as required by Bulgarian tax law and EU financial regulations
• DAC7 reporting data: retained for 5 years from the reporting period
• Messages: retained for 2 years after the last message, then anonymized
• Analytics data: aggregated and anonymized after 26 months
• Dispute records: retained for 3 years after resolution

7. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"), subject to legal retention obligations
• Right to restrict processing (Art. 18): limit how we use your data
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest or direct marketing
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time without affecting prior processing
• Right to lodge a complaint: file a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or your local supervisory authority

To exercise any of these rights, email privacy@revaulted.com. We will respond within 30 days as required by GDPR. Identity verification may be required.

8. Cookies & Tracking Technologies

Essential cookies (always active): authentication, session management, security tokens, CSRF protection. These are necessary for the Platform to function.

Analytics cookies (with consent): help us understand usage patterns, popular features, and performance. Data is aggregated and anonymized.

Marketing cookies (with consent): used for personalized recommendations and remarketing. Not currently implemented.

You can manage cookie preferences through your browser settings. Disabling essential cookies will prevent you from using the Platform. For more details, see our cookie banner when you first visit the site.

9. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA) by our service providers (e.g., Stripe for payments, cloud infrastructure). When this occurs, we ensure appropriate safeguards are in place including: (a) Standard Contractual Clauses (SCCs) approved by the European Commission; (b) adequacy decisions where applicable; (c) binding corporate rules of the data processor. Our primary data infrastructure is hosted within the EU.

10. Data Security

We implement technical and organizational measures to protect your data including: encryption in transit (TLS 1.2+) and at rest; secure authentication with hashed passwords; role-based access controls; regular security audits; incident response procedures; data minimization principles. Payment card data is never stored on our servers — all payment processing is handled by Stripe (PCI DSS Level 1 certified). Despite these measures, no system is completely secure. We will notify affected users and the relevant supervisory authority within 72 hours of a confirmed data breach as required by GDPR Article 33.

11. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will delete it promptly. If you believe a child has provided us with personal data, contact privacy@revaulted.com.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email notification and/or a prominent notice on the Platform at least 30 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision. Continued use of the Platform after changes constitutes acceptance.

13. Contact & Data Protection Officer

Data Protection Officer
Email: privacy@revaulted.com

Supervisory Authority
Commission for Personal Data Protection (CPDP)
2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria
Website: www.cpdp.bg