Parduota Privacy Notice
Master Edition — Version 1.0
Effective date: 28 July 2026 · Last updated: 28 July 2026
Contents
1. Data Controller
UAB Parduota is the Data Controller. Official company information and contact details are published on the Platform Contact page.
UAB Parduota, Vandžiogalos pl. 98 , Kaunas 47470, Republic of Lithuania
Company code: 301085558
Privacy contact: [email protected]
2. Scope
This Privacy Notice applies to all Customers using the Parduota Platform regardless of their selected role or Service Model.
3. Categories of Personal Data
Parduota processes personal data necessary to provide Platform Services, including registration, profile, transaction, payment, payout, shipping, integration, communication and technical information where applicable.
The specific data collected in each category is itemised in Annex A.1.
4. Sources of Personal Data
Personal data may be obtained directly from Customers and from connected marketplaces, payment providers, shipping providers, identity verification providers, publicly available sources where permitted by law and other authorised third parties.
5. Purposes of Processing
Personal data is processed to provide Platform Services, manage accounts, process listings and transactions, coordinate fulfilment, process payments and payouts, prevent fraud, comply with legal obligations, improve the Platform and protect legitimate interests.
6. Legal Basis for Processing
Parduota processes personal data only where there is a lawful basis under applicable data protection legislation, including contract performance, legal obligations, legitimate interests and Customer consent where required.
The basis relied upon for each purpose is set out in Annex A.2.
7. Sharing Personal Data
Parduota does not sell or rent personal data. Data is shared only where necessary to provide Platform Services, comply with legal obligations or protect legitimate interests.
The categories of recipient, and what each receives, are listed in Annex A.3.
8. International Data Transfers
Where necessary, personal data may be transferred outside the EEA with appropriate safeguards required by applicable law.
The Platform's own servers and database are located within the European Economic Area. Some of the third-party recipients listed in Annex A.3 are established outside the EEA, including in the United States. For those transfers Parduota relies on the European Commission's adequacy decisions where available, or otherwise on Standard Contractual Clauses. A copy of the safeguards applied may be requested using the contact details in §16.
9. Artificial Intelligence
AI technologies may be used to support Platform Services. Appropriate safeguards are applied where required by law.
In practice, AI features are used to generate and categorise listing text and to analyse product photographs submitted for a listing. Account, order and payment data is not submitted to AI providers. Parduota does not carry out automated decision-making producing legal effects concerning a Customer, or similarly significantly affecting them, within the meaning of GDPR Art. 22.
10. Data Retention
Personal data is retained only as long as necessary for Platform Services, legal obligations, payments, disputes, fraud prevention and other lawful purposes.
The periods applied to each category are set out in Annex A.4.
11. Security
Reasonable technical and organisational measures are implemented to protect personal data.
Passwords are stored only as bcrypt hashes and are never visible to Parduota. Traffic is encrypted with HTTPS. Access to production data is limited to staff who need it. No system is perfectly secure and absolute security cannot be guaranteed, but Customers and the supervisory authority will be notified of a personal data breach where the law requires it.
12. Customer Rights
Customers may exercise applicable privacy rights including access, correction, deletion, restriction, portability and objection, subject to applicable law.
How to exercise those rights, and the right to complain to a supervisory authority, are set out in Annex A.5.
13. Marketing Communications
Customers may opt in or opt out of marketing communications where applicable. Essential service communications may still be sent.
Essential service communications include order confirmations, dispatch notices, password resets and security notices such as a new sign-in method being linked to an account. These are sent as part of performing the contract and cannot be opted out of while an account remains open.
14. Children's Privacy
The Platform is intended for persons with legal capacity. Personal data from children is not knowingly collected where prohibited by law. If a child is believed to have provided personal data, contact Parduota using the details in §16 and it will be deleted.
15. Changes to this Privacy Notice
This Privacy Notice may be updated to reflect legal, technical or operational changes. The date at the top shows when it last changed, and Customers will be notified of material changes by email or on-site notice.
16. Contact Information
Privacy requests may be submitted using the official contact methods published on the Platform Contact page, or by writing to [email protected].
17. Cookies
The Platform uses only strictly functional cookies. They are necessary for it to work, and they do not track you across other websites:
connect.sid— keeps you signed in. HttpOnly, SameSite=Lax, expires 12 hours after it is issued.locale— remembers your chosen language for one year.
No analytics, advertising or tracking cookies are used, and no cookie consent banner is therefore required. If such cookies are introduced, this Privacy Notice will be updated and your consent requested before they are set.
Annex A. Processing details (GDPR Art. 13)
This Annex is not part of the Master Edition text. It sets out the specific categories, recipients, retention periods and legal bases that the Master Edition states in the abstract but which applicable data protection law requires to be disclosed. The detail below reflects what the Platform actually does.
A.1 What is collected
Information you give us
- Account: email address, password (stored only as a bcrypt hash — we never see or store your actual password), full name, phone number, preferred language.
- Sign-in with Google: if you use the Google button, we receive your Google account identifier, email address, whether Google has verified that address, your display name and your profile picture URL. We do not receive your Google password and we request no access to any other Google service. See A.6.
- Orders and delivery: billing and shipping addresses, recipient name and phone number, order contents and history.
- Business and tax details where you sell: company name, VAT number, tax status, and any documents you submit with a seller application.
- Content you upload: listing photographs, descriptions, messages, feedback and bug reports, including any screenshots attached to them.
Information collected automatically
- Server log data: IP address, browser user agent, pages requested, timestamps and error details, kept for security and troubleshooting.
- A session cookie (
connect.sid) that keeps you signed in, and alocalecookie that remembers your language choice. See §17. - If you enable browser notifications, a push subscription endpoint issued by your browser vendor.
Payment card details are never received or stored by us. They are entered directly on the hosted checkout page of our payment provider. We receive only the outcome of the payment and limited metadata such as the last four digits, card brand and the provider's transaction reference.
A.2 Purposes and legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account; processing orders; providing seller tools | Performance of a contract (Art. 6(1)(b)) |
| Transactional email — order confirmations, dispatch notices, password resets, security notices such as a new sign-in method being linked | Performance of a contract (Art. 6(1)(b)) |
| Accounting, invoicing, VAT and statutory record-keeping | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention, abuse detection, platform security, and defending legal claims | Legitimate interests (Art. 6(1)(f)) |
| Marketing email and newsletters | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Browser push notifications | Consent (Art. 6(1)(a)) — withdrawable in your browser |
A.3 Who data is shared with
Personal data is shared only where necessary for the purposes above, with the following categories of recipient acting as processors or independent controllers:
| Recipient | What they receive, and why |
|---|---|
| Stripe, PayPal | Payment and billing details you enter on their checkout, to take payment |
| Sellers on the Platform | Your name, delivery address and phone number, so they can fulfil your order |
| Carriers and the shipping integration | Recipient name, address and phone, to produce labels and track parcels |
| eBay | Listing content where a seller publishes to eBay; buyer delivery details for orders placed on eBay |
| Cloudflare | Images you upload, for storage and delivery |
| Sign-in, where you choose it; text submitted for translation | |
| Email delivery provider | Your email address and message contents, to deliver transactional email |
| Telegram | Operational alerts to our private staff channel, which can include a customer's name, email, phone and delivery address for a new order |
| AI providers (OpenAI, Google Gemini) | Listing text and product photographs submitted for automated description and categorisation. Not used for account or order data |
| Hosting and infrastructure | Data is stored and processed on our servers at OVH, on a dedicated server located in Frankfurt, Germany — within the EEA |
Data may also be disclosed where required by law, to a competent authority, or to protect Parduota's rights, and to a successor entity in the event of a merger or sale of the business.
A.4 How long data is kept
- Account data: for as long as your account is open, and then [RETENTION PERIOD AFTER CLOSURE].
- Orders, invoices and accounting records: 10 years, as required by Lithuanian accounting and tax law.
- Server and security logs: [LOG RETENTION PERIOD].
- Marketing consent records: until you withdraw consent, plus a record of the withdrawal.
A.5 Exercising your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected;
- have your data erased, where we have no overriding obligation to keep it;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, without affecting processing already carried out.
To exercise any of these, write to [email protected]. We will respond within one month. You also have the right to lodge a complaint with the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or with the authority where you live.
A.6 Signing in with Google
Choosing "Continue with Google" sends you to Google to authenticate. We never see your Google password. Google returns your account identifier, name, profile picture and email address, along with a flag stating whether Google has verified that address.
Account linking. If the email address Google returns already belongs to an account here, and Google confirms the address is verified, we link the Google identity to that existing account rather than creating a second one, and we email you to say so. If the address is not verified by Google, we refuse to link and ask you to sign in with your password first. Your account's own email address is never changed by this process.
We store the Google account identifier so that you can be recognised on your next visit, plus a cached copy of the name, email and picture. We do not store Google refresh tokens and we do not access any Google service on your behalf after sign-in. Google's own handling of the sign-in is covered by the Google Privacy Policy.
This document is currently available in English only. Lithuanian, Polish and German translations are pending; in the event of any discrepancy, the English version prevails until an official translation is published. See also our Terms and Conditions.