Privacy Policy
This Privacy Policy explains how personal data is collected and used when you use Anew, in accordance with Regulation (EU) 2016/679 (the "GDPR") and applicable national data-protection law. We have tried to write it in plain language; where we simplify, the GDPR still governs.
1. Who we are (data controller)
The controller responsible for your personal data is [Operator legal name], [registered office], company no. [register number] ("Anew", "we", "us").
For any privacy question, or to exercise your rights, contact [privacy@shopanew.eu]. Our data protection contact / DPO (if appointed) is [name / email].
2. The data we collect
| Category | Examples |
|---|---|
| Account | Email address, password (stored hashed by our authentication provider), display name, language preference, and — if you use social login — the basic profile your provider returns. |
| Profile & reputation | City, optional bio and avatar, ratings and reviews, seller/pro status, verification status. |
| Listings & transactions | Items you list (photos, descriptions, price, condition, location), offers, orders, reserves, bundles and handover confirmations. |
| Messages | Messages you exchange with other users through the in-app chat (screened for scam / off-platform links). |
| Location | The approximate city/coordinates you attach to a listing, and — only if you allow it — your device location to sort items "near me". |
| Payments & identity | Handled by our regulated payment provider (see §4). We receive a payment reference and status; we do not store your card or your identity documents. |
| Support | Tickets and messages you send our support team. |
| Technical / usage | Limited technical data needed to run the service securely (e.g. session tokens, device type, error logs). See the Cookie & storage notice. |
3. Why we use it, and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and run your account; enable buying, selling, offers, escrow and pickup | Performance of a contract — Art. 6(1)(b) |
| Buyer protection, dispute handling, refunds, safety and anti-fraud, content moderation | Legitimate interests, and contract — Art. 6(1)(f) & (b) |
| Transactional notifications (orders, offers, messages, payouts, support) | Performance of a contract — Art. 6(1)(b) |
| Marketing emails (price drops, saved-search matches, tips) | Consent — Art. 6(1)(a); withdrawable at any time |
| Identity / trader verification, tax reporting (DAC7), accounting, legal requests | Legal obligation — Art. 6(1)(c) |
| Improving and securing the service | Legitimate interests — Art. 6(1)(f) |
4. Payments and identity verification
Payments, escrow, payouts and any identity / business verification (KYC / KYB) are carried out by a regulated third-party payment provider, [Mangopay / the appointed PSP]. When you transact, your payment and identity data are processed by that provider under its own privacy policy, as an independent controller for the regulated activity. Anew stores only a status flag (e.g. "verified") and a payment reference — never your card number or identity documents. This data-minimising design is deliberate.
5. Who we share data with
We do not sell your personal data. We share it only with:
- Other users, to the extent necessary for a transaction (e.g. a seller and buyer see each other's display name, relevant city, and messages; DSA transparency may require professional sellers' identity to be shown on their listings).
- Processors acting on our instructions, including: [Supabase] (application hosting & database, EU region), [Netlify] (front-end hosting), [Google Workspace] (sending notification emails), translation providers used for the one-tap translate feature ([DeepL / LibreTranslate / MyMemory]), and OpenStreetMap/Nominatim for turning a place name into map coordinates.
- The payment provider described in §4.
- Authorities, where we are legally required — including tax authorities under the DAC7 platform-reporting rules for qualifying sellers, and courts or regulators on a valid request.
When you use one-tap translate, the selected text (a listing description or a message) is sent to the translation provider to return a translation. Avoid putting sensitive personal data in free-text fields.
6. International transfers
We aim to keep data in the European Union / EEA. Where a provider processes data outside the EEA, we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses together with any necessary supplementary measures. You can ask us for a copy of the relevant safeguard.
7. How long we keep it
We keep personal data only as long as needed for the purposes above: account data for as long as your account is open; transaction and accounting records for the statutory retention period (typically [7/10] years under Belgian/EU tax and accounting law); support records for a reasonable period; and marketing consent until you withdraw it. When data is no longer needed it is deleted or anonymised.
8. Your rights
Under the GDPR you have the right to: access your data; correct it; erase it ("right to be forgotten"); restrict or object to processing; data portability; and to withdraw consent at any time (without affecting prior processing). To exercise any right, contact [privacy@shopanew.eu]; we respond within one month.
You also have the right to lodge a complaint with your data protection authority — for example the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), the Dutch Autoriteit Persoonsgegevens, or the CNPD in Luxembourg, depending on where you live and where we are established.
9. Marketing communications
We send marketing email only if you opt in (a ticked box at sign-up or in your notification settings). Every marketing email contains an unsubscribe link, and you can turn marketing off any time in-app. Transactional messages (about your orders, offers, payments and support) are part of the service and are not marketing.
10. Automated processing
Our "auto-fill from photo" feature uses automated image analysis to suggest a title, category and price for a listing — you always review and can change the result, so it does not produce legal effects on you. We use automated screening to flag suspected scams or prohibited content for human review. We do not carry out solely-automated decisions that produce legal or similarly significant effects on you.
11. Security
We use encryption in transit, access controls, row-level database security and the principle of least data. No system is perfectly secure, but we take appropriate technical and organisational measures and will notify you and the authority of a personal-data breach where the law requires.
12. Children
Anew is not intended for children. You must be at least [16] years old (or the digital-consent age in your country) to create an account.
13. Changes to this policy
We may update this policy. We will post the new version here with a new date and, for material changes, notify you in-app or by email.