§ 1. Data Controller
The controller of your personal data is ReptiMarket — operator of the marketplace platform for breeders of reptiles, amphibians and invertebrates. Contact: /kontakt.
§ 2. Purposes and Legal Bases of Processing
We process your personal data for the following purposes:
- Providing platform services — account registration, publishing listings, breeding journal, communication with other users (basis: GDPR Art. 6(1)(b) — contract performance).
- Processing transactions and payments — plan purchases, listing packages, featured listings, animal reservations (basis: GDPR Art. 6(1)(b)).
- Fulfilling legal obligations — accounting, invoices, KSeF (Polish e-invoicing), CITES documentation (basis: GDPR Art. 6(1)(c)).
- Direct marketing of our own services — newsletter, notifications about new features (basis: GDPR Art. 6(1)(f) — legitimate interest; newsletter requires consent).
- Fraud prevention and identity verification — SMS OTP verification, breeder KYC, content moderation (basis: GDPR Art. 6(1)(f)).
§ 3. Scope of Data Processed
- Registration data: name, email, phone number.
- Breeder data: kennel name, description, location (city, region, country), logo, banner.
- Listing data: animal descriptions, photos, prices, morphs, breeding journal data.
- Transaction data: payment history, billing details, bank data (IBAN for breeders only).
- Technical data: IP address, browser info, cookies, activity logs.
§ 4. Data Sharing
We use trusted service providers supporting platform operation, in particular:
- OVH — server hosting (VPS) and database storage (France/EU),
- Stripe — card and international payment processing,
- Przelewy24 — BLIK and domestic transfer processing (PL),
- SMSPlanet — phone number verification (OTP) and SMS notifications (Poland),
- Bunny CDN / fonts.bunny.net — font and static asset delivery.
User authentication is handled internally within our platform, without external identity providers.
Data may also be disclosed to public authorities if required by law.
§ 5. Data Retention Period
- Account data — for the duration of active platform use; after account deletion, data is anonymized within 30 days (except accounting documents — 5 years per Polish Accounting Act).
- Transaction data — 5 years from the end of the fiscal year (tax requirement).
- Technical logs — 12 months.
- Cookies — per browser settings, max 12 months.
§ 6. Your Rights
- Right of access to your data.
- Right to rectification, supplementation or update of data.
- Right to erasure ("right to be forgotten") — subject to statutory obligations.
- Right to restriction of processing.
- Right to data portability (JSON/XLSX export from user panel).
- Right to object to processing for marketing purposes.
- Right to withdraw consent at any time (without affecting prior processing).
- Right to lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).
§ 7. Data Security
We apply appropriate technical and organizational measures to ensure the security of your data, including: SSL/TLS encryption (HTTPS), password hashing (bcrypt), encryption of sensitive database fields, restricted access to authorized personnel only, regular backups (daily at 2:30 AM).
§ 8. Cookies and Tracking
We use cookies to ensure proper platform operation (session, language preferences, cart) as well as for traffic analysis (anonymous statistics). You can manage cookies in your browser settings.
§ 9. Contact
For matters related to personal data processing, please contact us via the form at /kontakt.
