Protecting your personal data and respecting your privacy are priorities for the Merino Freaks resale platform (the “Platform”). This Privacy Policy explains how personal data is processed when you use the Platform, for what purposes, on what legal bases, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”).
1) Data Controller
The controller of your personal data in connection with the Platform is The Fashion People sp. z o.o. (the “Controller”, “Technology Partner”, “we”, “us” or “our”), which operates the Platform and provides the resale-as-a-service infrastructure on behalf of Merino Freaks.
The Controller collects personal data, among other ways, through a C2C (consumer-to-consumer) resale platform used to facilitate transactions between users.
The Controller applies appropriate technical and organisational measures to protect personal data, including protection against unauthorised access, loss, or damage.
Contact regarding data protection
If you have questions about this Privacy Policy or how your data is processed, please contact us through the Platform’s “Contact us” page.
2) Where your data comes from
The processed data is obtained directly from you, in connection with using the Platform and carrying out transactions between Platform users.
3) What data we process
Depending on how you use the Platform, we may process in particular:
- first and last name,
- email address,
- phone number,
- home/business address,
- delivery address,
- bank account number,
- tax identification number or national identification number, where applicable.
4) Purposes and legal bases of processing
We process personal data for the following purposes and on the following legal bases:
- To conclude and perform sales agreements between users of the Platform.
Legal basis: Article 6(1)(b) GDPR (performance of a contract). - To provide electronic services (operation of the Platform, user account, communication related to transactions, etc.).
Legal basis: Article 6(1)(b) GDPR. - To comply with legal obligations of the Controller, including accounting and tax obligations, issuing and recording invoices, archiving contracts and settlement documents, and other obligations required by law.
Legal basis: Article 6(1)(c) GDPR (legal obligation). - To pursue or defend legal claims, handle complaints, and conduct direct marketing of the Controller’s goods and services (including presenting offers).
Legal basis: Article 6(1)(f) GDPR (legitimate interests). - Based on your consent, where you have given it (e.g., to receive marketing communications/newsletters by electronic means, or other purposes indicated in the consent content).
Legal basis: Article 6(1)(a) GDPR (consent).
5) Recipients of personal data
Your personal data may be disclosed to:
- the Controller’s contractors and subcontractors,
- the Controller’s employees and collaborators,
- providers of advisory, consulting, audit, accounting, tax, IT and legal services,
- postal and courier operators,
- electronic payment and payment card service providers (to the extent necessary to process payments),
- IT system and hosting/service providers,
- telecommunications service providers,
- public authorities and entities entitled to receive data under applicable law.
6) Whether providing data is mandatory
Providing personal data is not mandatory, however it may be necessary to:
- conclude and perform a contract with the Controller (including placing and fulfilling orders/transactions),
- take steps at your request before entering into a contract,
- handle matters after a contract is concluded (e.g., complaint handling),
- prepare required accounting/transaction documents.
If you do not provide the data required for these purposes, it may not be possible to conclude or perform the relevant agreement or process your request.
7) Your rights
You have the right to:
- access your personal data,
- rectify (correct) your personal data,
- erase your personal data,
- restrict processing,
- object to processing,
- data portability (where applicable).
To exercise your rights, contact us through the Platform’s “Contact us” page.
Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.
Withdrawal of consent
If processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, contact us through the Platform’s “Contact us” page.
8) Transfers outside the EEA
When using tools supporting ongoing operations (e.g., services provided by Google (Alphabet Inc.) or Facebook/Meta (Meta Inc.)), your personal data may be transferred outside the European Economic Area (EEA), in particular to the United States or another country where the relevant service provider maintains processing infrastructure.
Where such transfers occur, we use appropriate safeguards required by the GDPR (e.g., relevant contractual arrangements/terms ensuring GDPR-level protections).
9) Right to object (legitimate interests)
Where personal data is processed based on legitimate interests (Article 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation.
If you submit an objection, we will no longer process the data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for the establishment, exercise, or defence of legal claims.
10) Retention period
We process personal data:
- for the duration of the agreement concluded with the Controller, and
- after the agreement ends, for the period necessary to fulfil legal obligations incumbent on the Controller (e.g., accounting/tax and archiving obligations) and to handle or defend potential claims.