Privacy Policy

1. Controller and contact

This Privacy Policy explains how personal data is processed when you use the EX & GO platform at exgo.io, its subdomains and mobile applications (the “Platform”). It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”).

The controller is OmniNest s. r. o., IČO 57138443, Pekná cesta 2459/19, 831 52 Bratislava - mestská časť Rača, Slovenská republika; Obchodný register Mestského súdu Bratislava III, oddiel Sro, vložka 190627/B; e-mail admin@exgo.io (the “Operator”, “we”). For all questions about personal data and to exercise your rights, write to admin@exgo.io. We have not appointed a data protection officer because we are not required to; the address above reaches the persons responsible for data protection.

Users who publish listings decide themselves what they write about their items and in their messages. The Operator is nevertheless a controller of personal data published in listings and processes it in accordance with this Policy: Users must not publish personal data of other people (Posting Rules, section 5), and we remove listings that unlawfully disclose such data as soon as we learn of them. When you obtain another User's data through the Platform (for example, the address of a Buyer), you become a separate controller of that data and must use it only to complete the transaction.

2. What data we process

Account data: name, email, profile photo and identifier received from your sign-in provider (Google, Apple, Facebook) or provided by you; phone number and the confirmation that you control it; password hash, two-factor authentication settings; language, city and display preferences.

Content: listings (texts, photos, videos, price, location), messages in the chat, reviews, reports and appeals, live-show broadcasts and chat posts, storefront data, support conversations and their attachments.

Business seller data: trade name, address, registration number, contact details and the self-certification required by Article 30 DSA; for payouts — bank details (IBAN).

Transaction data: orders and payments for Paid Services, Safe Deal details (amount, delivery details of the Buyer such as name, phone and Nova Poshta branch, shipment tracking), invoices, refunds and chargebacks. We do not receive full card numbers — they are entered on the payment provider's page.

Technical and usage data: IP address, device and browser type, operating system, app version, push-notification tokens, sign-in times, search queries, pages and listings viewed, clicks on contact buttons and advertising, referral and partner codes, security and abuse signals (for example, rate-limit counters and risk scores). The country is determined from the IP address with a local database (no third party is involved) and kept on your account so that prices and notifications are shown in your local currency.

Data from third parties: public business contact details from company pages on other marketplaces (see section 14), listing data imported at your request from OLX, Allegro, Prom and similar services, and confirmations from Telegram, WhatsApp or Viber when you use them to verify your phone number.

3. Purposes and legal bases

To provide the Platform under the contract with you (Article 6(1)(b) GDPR): creating and running your account, publishing and displaying listings, the chat, notifications about your listings and conversations, Paid Services, Safe Deal, live shows, storefronts, imports and integrations you switch on, customer support.

To comply with legal obligations (Article 6(1)(c) GDPR): handling notices about illegal Content, statements of reasons, complaints and the transparency obligations under Regulation (EU) 2022/2065 (DSA); accounting and tax records for payments; responding to lawful orders of authorities.

On the basis of our legitimate interests (Article 6(1)(f) GDPR), which we have weighed against your interests: verifying business sellers so that Buyers know whom they deal with; keeping the Platform and its Users safe — detecting fraud, spam, prohibited goods, fake accounts and misuse; securing accounts; preventing and defending legal claims; measuring the reach of advertising placements bought by advertisers in aggregated form; improving the Platform using aggregated statistics; the business outreach described in section 14. You may object to processing based on legitimate interests at any time (section 11).

With your consent (Article 6(1)(a) GDPR): analytics cookies and the Google tag (section 10), push notifications in the browser and app, notifications via Telegram, WhatsApp or Viber, newsletters. Consent can be withdrawn at any time without affecting the lawfulness of earlier processing.

Providing account data and the data needed for a transaction is necessary to use the related features; without it we cannot provide them. Everything else is voluntary.

4. Automated moderation and decisions

To protect Users, every listing, message, photo and video is checked by automated systems. A rule-based engine looks for signs of fraud, spam, prohibited goods and adult content. Photos and frames of videos are analysed by image-recognition models. Links in texts are checked against a database of unsafe websites.

As a result, a listing may be held for review by a moderator or refused, a message may be held back from the recipient, and a photo may send a listing back to review. Repeated upheld infringements can lead to a temporary restriction under our misuse policy (Terms of Service, section 14). Listings with no risk signals may be published automatically.

Such decisions are necessary to perform the contract and to comply with our obligations under the DSA. Every decision is explained to you, and you can contest it in your account; the appeal is reviewed by a person (Article 22(3) GDPR, Article 20 DSA). We do not use automated processing to build marketing profiles, and we never select advertising or listings based on a profile of the viewer.

5. What is visible to other Users

Your listings, photos, videos, price, city, the name or nickname on your profile, the date you joined, reviews about you and your storefront are public and can be indexed by search engines. Your phone number is shown only if you choose to show it in the listing; if you agree to it in your settings, other Users are asked to pay a fee to the Operator to see the number you chose to show, which protects you from mass collection of numbers by bots. You can hide your number at any time in the listing. If you are a business seller, the trader details required by law are shown with your listings.

Live shows are public broadcasts: anyone watching can see and hear what you show and say. Broadcasts are not recorded by the Platform. Your messages in the chat are visible only to you and the other participant, and to moderators when a message is reported or held back for safety reasons.

6. Recipients and processors

We share personal data only to the extent necessary, with processors who act on our instructions under data-processing agreements, and with independent controllers where needed for the service you use.

Hosting and infrastructure: Hetzner Online GmbH (Germany) — servers, database, our own mail and live-video servers; Cloudflare, Inc. — storage and delivery of photos and videos (R2) and, where enabled, bot protection (Turnstile).

Communication: SMS gateways (SMS-fly, Messaggio, TurboSMS, Twilio — only the phone number and the code); Telegram, WhatsApp (Meta Platforms Ireland Ltd.) and Viber — when you choose them to confirm your phone number or receive notifications; Google Firebase Cloud Messaging and Apple Push Notification service, and the push services of browser vendors — for push notifications. Emails are sent by our own mail server directly to your mail provider.

Payments: LiqPay (JSC CB PrivatBank), Stripe Payments Europe Ltd. and Apple (for purchases in the iOS app) receive the data needed to process payments, refunds and fraud checks and act as independent controllers for their own obligations.

Moderation and support: providers of AI models — currently Alibaba Cloud (Model Studio, international region) for image analysis and the support assistant, and Amazon Web Services EMEA SARL (Rekognition, Frankfurt region) as a second image check; Google (Web Risk) receives only links found in texts. They receive the photo, the frame or the text to be analysed, without your account details, under business terms that do not allow them to use it for their own purposes.

Analytics: Google Ireland Ltd. (Google Tag Manager, Google Analytics 4) — only with your consent where it is required (section 10).

Sign-in and integrations: Google, Apple and Meta (Facebook) when you sign in with them; OLX, Allegro, Prom and Google Merchant Center when you connect them; Nova Poshta for looking up branches in a Safe Deal (no personal data is sent to it by us); Checkbox (Ukraine) when a business seller issues a fiscal receipt from its own connected cash register — then the receipt data, including the buyer's email if the seller enters it, is processed by us as the seller's processor and by Checkbox for that seller.

Authorities and others: courts, law enforcement and regulators where we are required by law or an order, or where necessary to protect the rights and safety of Users and third parties; the European Commission's DSA Transparency Database receives statements of reasons without personal data; professional advisers bound by confidentiality; a successor in the event of a reorganisation or sale of the business. We do not sell personal data.

7. Transfers outside the EU/EEA

Our main servers are in the European Union. Some recipients (for example, Google, Meta, Apple, Stripe, Twilio, Cloudflare, Alibaba Cloud, Telegram) may process data in countries outside the EEA, including the United States, Singapore, the United Kingdom and Ukraine.

Such transfers take place only where the European Commission has recognised an adequate level of protection (for example, the EU–US Data Privacy Framework for certified companies, the United Kingdom) or on the basis of the Commission's Standard Contractual Clauses with additional safeguards where needed (Articles 45 and 46 GDPR). For Users served by the Ukrainian Operator, transfers to countries not recognised as providing adequate protection rely on the necessity of performing the contract with you or on your consent (Article 29 of the Law of Ukraine “On Personal Data Protection”). You can obtain a copy of the relevant safeguards at admin@exgo.io.

8. How long we keep data

Account and Content: while your account exists. When you delete your account, your profile, listings, photos, messages and storefront are deleted without delay, and personal data in remaining records (for example, the delivery details in a completed Safe Deal) is erased or anonymised; backups containing it are overwritten within 14 days.

Listings expire after 30 days unless renewed. Phone confirmation codes are valid for 10 minutes. Search logs (with a pseudonymised IP address) are kept for 90 days, notifications for 90 days, advertising reach data for 120 days, aggregated advertising and partner statistics for 400 days.

Support conversations: the contact details are anonymised 90 days after the last activity and the conversation is deleted after 365 days. Business outreach contacts: 180 days if we never wrote, 730 days after the last letter, or immediately on request.

Data we must keep by law is kept for the period the law requires and then deleted: accounting and payment records (typically 10 years), moderation decisions and statements of reasons (for the duration of possible complaints and proceedings), data preserved on an authority's order. Data needed to establish or defend legal claims is kept until the claim is time-barred.

9. Security

We use encrypted connections (HTTPS), password hashing, optional two-factor authentication, encryption of tokens for integrations, access control and logging for staff, rate limiting and regular backups stored in the EU.

No system is completely secure. If a personal-data breach is likely to result in a high risk to your rights, we will inform you and the supervisory authority as required by Articles 33 and 34 GDPR.

10. Cookies and similar technologies

Strictly necessary cookies, which do not require consent: the sign-in session (authjs.session-token and related CSRF and callback cookies), the steps of two-factor and phone sign-in (exgo_2fa, exgo_phlogin), the guest support session (exgo_support, 30 days), and your answer to the cookie banner (consent, 1 year).

Functional cookies and storage, which keep the choices you make: language (NEXT_LOCALE), colour theme (theme), catalogue view and display currency (catalog_view, display_currency, 1 year), selected city (geo_city), the draft of a listing you are writing (exgo.post.draft in your browser's local storage), dismissed install prompts and notification settings.

Attribution cookies, which record which invitation, partner or advertisement brought you, so that the reward or the advertising statistics are counted correctly: exgo_ref (30 days), exgo_p (90 days), exgo_adref (7 days). They are set only after you accept cookies in the banner, contain only a code, not your identity, and are not shared with third parties.

Analytics and advertising-measurement cookies (Google Tag Manager, Google Analytics 4 and Google's advertising signals), only after you click “Accept” in the banner, wherever you are. They measure how the Platform is used and how our own advertising campaigns perform; Google may use the data under its own terms as a separate controller. If you decline, the Google tag is not loaded. It is never loaded on sign-in, registration, password-reset and report pages, or in the iOS app.

If you accepted cookies and arrived through a link to a shop prepared for transfer to the Platform, a signed cookie (up to 30 days) records that link, so that the resulting import and payments can be attributed to it. Withdrawing consent deletes that association, except for financial records we must keep; earlier activity is not restored if you consent again later.

You can change or withdraw your choice at any time through “Cookie settings” at the bottom of every page or the settings below this Policy; withdrawing is as easy as giving consent (Article 7(3) GDPR). Browser settings also let you block cookies, but the Platform will not work without the strictly necessary ones.

11. Your rights

Under the GDPR you have the right to: access your data and receive a copy (Article 15); have inaccurate data corrected (Article 16); have data erased (Article 17); restrict processing (Article 18); receive the data you provided in a structured, machine-readable format and transmit it to another controller (Article 20); withdraw consent at any time.

Right to object (Article 21): you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests; we will then stop unless we demonstrate compelling legitimate grounds or need the data for legal claims. You may object to the use of your data for direct marketing at any time, without giving reasons.

You have the right not to be subject to a decision based solely on automated processing that significantly affects you, and to obtain human review of such a decision, express your point of view and contest it (Article 22) — through the appeal in your account.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. Where the Operator is the Slovak company, the lead authority is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk). Where the Operator is the Ukrainian sole trader, Ukrainian data-protection law applies and the competent authority is the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua). Users in Poland may also apply to the President of the Personal Data Protection Office (UODO), in Czechia to ÚOOÚ, in Romania to ANSPDCP, in Bulgaria to the Commission for Personal Data Protection, in Slovenia to the Information Commissioner, and in Israel to the Privacy Protection Authority.

12. How to exercise your rights

Most rights can be used directly in your account: edit your profile, download a copy of your data (“Download your data”), switch notifications off, delete your account. For anything else, write to admin@exgo.io from the email linked to your account.

We answer within one month; for complex or numerous requests this period may be extended by two further months, and we will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive. We may ask for information to confirm your identity. The copy of your data does not include messages written by other people or the identity of those who wrote reviews about you, to protect their rights.

13. Children

The Platform is intended for adults (18 and over) and is not directed at children. We do not knowingly collect data of minors and do not use profiling to show them advertising. If you believe a child has created an account, let us know at admin@exgo.io and we will delete it.

14. Company contacts from public sources

We collect published business contacts (email, sometimes phone) from company shop pages on other marketplaces, in order to offer once to move that shop to us. Contacts of private individuals are not stored at all.

The source is named in the letter itself, together with our legal name and postal address. The basis is legitimate interest (Article 6(1)(f) GDPR); the notice about the source is given under Article 14 GDPR.

We also keep a snapshot of the public shop page (titles, prices, image links) to show how it would look with us. That page is not indexable and is reachable only through the link in the letter.

Every letter carries a never-write-again link: the address goes on a refusal list for good. Contacts we never wrote to are deleted after 180 days, contacted ones after 730. On request to admin@exgo.io we delete the record and the snapshot at once.

15. Notifications and marketing messages

Service messages — about your account, security, listings, messages, payments, decisions on your Content and changes to our terms — are part of the service and are sent regardless of marketing preferences.

Saved-search alerts, push notifications, messages in Telegram, WhatsApp or Viber and newsletters are sent only if you switch them on. Advertising messages are marked as such, identify the sender and carry an opt-out; every email has an unsubscribe link, and all channels can be switched off in the account settings or in the device settings.

16. Changes to this Policy

We update this Policy when our processing changes, for example when we add a feature or change a provider. The date of the current version is shown at the top. We will inform you of material changes by email or in your account before they take effect; where a change requires your consent, we will ask for it.