When you register as a member on the Platform, you must provide the following data in order to complete the registration procedure and access your Vinted account:

1. Username (necessary when you register without a Facebook or Google account);
2. Full name;
3. Email address;
4. ZIP code;
5. Confirmation that you are aged over 18;
6. Password (necessary when you register without a Facebook or Google account).

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b) of the GDPR).

We also determine your location (country) based on your IP address at the time of registration, which is to be shown on your profile. You can choose to change your location (country, city or region) at any time and make your city or region invisible to other members by going to "My settings" in your Vinted account.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you register using your Google Ireland Ltd. (Ireland), Google LLC (USA) (“Google”) or Meta Platforms Ireland Ltd. (Ireland), Meta Platforms, Inc. (USA) (“Facebook”), or Apple Inc. (USA) (“Apple”) account or later on decide to link your Google, Facebook or Apple account to your Vinted account, you will be transferred from our Platform to the Google, Facebook or Apple website and asked to enter the log-in information for your Google, Facebook or Apple ID account.

If you enter your Google log-in information, Google will share the following data with Vinted from your Google account (you may choose not to provide some data):

1. Profile photo;
2. Full name;
3. Google account ID;
4. Email address.

If you enter your Facebook log-in information, Facebook will share the following data with Vinted from your Facebook account (you may choose not to provide your email address):

1. Profile photo;
2. Full name;
3. Email address;
4. Facebook account ID.

If you enter your Apple ID log-in information, Apple will share the following data with Vinted from your Apple ID account (you may choose not to provide your email address by using Apple’s Private Email Relay Service):

1. Full name;
2. Email address;
3. Apple ID.

The data we obtain from Google, Facebook or Apple will be used to set up your Vinted account. This means that we will use the member name from your Google, Facebook or Apple ID account as your Vinted account member name so that it will be visible to other visitors to the Website and App users. No other data obtained from Google, Facebook or Apple will be visible to anyone on the Platform.

You can, at any time, unlink your Google, Facebook or Apple ID account. This can be done under "My settings" in your Vinted account. If, however, when you initially registered, you did so without linking your Google, Facebook or Apple ID account, you can create such a link later.

Collection and use of personal data is our legitimate interest to enable you conveniently authenticate your identity in order to carry out the registration process or access your Vinted account (Art. 6 (1) (f) of the GDPR).

If, however, when you initially registered, you did so without linking your Google, Facebook or Apple ID account, you can create such a link later.

If you decide to add profile details to the account you create on the Platform, we collect and use the following data when you choose to provide it:

1. Full name;
2. Gender;
3. Date of birth;
4. Profile photo;
5. Metadata of the photo you upload (geolocation, ID number of device, date and time of photo taken, etc.);
6. Whether you have enabled Holiday Mode;
7. Your favorite items;
8. Information that you choose to provide in the “About You” section.

Your profile photo, information on whether you have enabled Holiday Mode and the information you provide in the "About You" section are visible to other Platform visitors, but the remainder of the data entered by you is not visible.

Legal basis for such collection and use of your personal data is our legitimate interest to enable you to set up your profile information and to ensure that other visitors of the Platform could access relevant information you choose to provide (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years. Photo metadata containing personal data is deleted immediately.

When you are a registered member on the Platform, we collect, use and make public on the Platform the following information in order to provide other members with relevant information:

1. Last login date;
2. Verification fact;
3. Number and member names of followers;
4. Number and member names of members followed;
5. Likes.

Legal basis for such collection and use is our legitimate interest in ensuring that our members access important information about each other (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you list items on the Platform, we will collect and use the following data for the purpose of creating, publishing and deleting listings on the Platform (the required information differs depending on the chosen item category):

1. Item title;
2. Item description;
3. Item category;
4. Item brand;
5. Item condition;
6. Item size;
7. Item color;
8. Item material;
9. Item photos;
10. Item number;
11. Metadata of the photos you upload (geolocation, device ID number, date and time of photo taken, etc.);
12. ISBN (when you sell or swap books);
13. Information as to whether the item is unisex;
14. Price;
15. Discount;
16. Information on whether you are interested in swapping your items;
17. Information as to whether the item is marked as reserved;
18. Shipping options;
19. Reasons for deleting the item.

Legal basis for such collection and use of your personal data is our legitimate interest to enable you to create, publish and delete listings on the Platform when you so decide (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for eighteen (18) months and seven (7) days of inactivity. Photos are kept for three (3) months after the item is deleted. Photo metadata containing personal data is deleted immediately.

When you are a registered member on the Platform, we will provide you with notifications on the Platform regarding your new followers, your favorited items, your activity on the forum and other important messages.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you communicate with other members on the Platform, we collect and use the following data:

1. Name of the member with whom you are communicating;
2. Messages;
3. Date and time of messages;
4. Shared photos;
5. Your device;
6. Information as to whether another member has seen your message;
7. Other data submitted in messages.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you decide to remove a message from a conversation, it will be instantly hidden for you and the recipient, and permanently deleted after three (3) months from the moment you remove it. Legal basis for storing the removed message data is our legitimate interest to ensure the safety of our Platform and our members (Art. 6 (1) (f) of the GDPR).

If you leave reviews for other members, Vinted collects and uses the following data for the purpose of making the reviews publicly available on the Platform:

1. Review;
2. Star rating;
3. Member name;
4. Date and time of the review;
5. Reply to the review.

Legal basis for such collection and use of your personal data is the legitimate interest of our members and Vinted to build trust among Vinted members (Art. 6 (1) (f) of the GDPR)..

You can, at any time, edit or delete your reviews left for other members.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years. The reviews are subsequently anonymized.

When you receive reviews from other members, we will collect and use the following data for the purpose of making the reviews publicly available on the Platform:

1. Review;
2. Star rating;
3. Member name;
4. Date and time of the review;
5. Your reply to the review.

Legal basis for such collection and use is the legitimate interest of our members and Vinted to build trust among Vinted members (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

The Vinted forum is where our community comes to talk and help each other by sharing experience and tips. You can create new forum topics or post comments in our forum. We collect and use the following data which you voluntarily submit on the Platform:

1. Your member name;
2. Your picture;
3. Forum topics you created;
4. Your forum posts;
5. Photos shared in your post;
6. Date and time of your post;
7. Total number of your posts on the Platform;
8. Your device;
9. Likes under your post;
10. Your likes under other members’ posts;
11. Your favorite forum topics.

If you select to post anonymously, your member name/picture won't be visible to other members. However, your identity will still be visible to the Vinted team.

Legal basis for such collection and use of your personal data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR) as well as the legitimate interest of our members to have a platform for communication (Art. 6 (1) (f) of the GDPR).

You can delete and edit your own forum topics and posts at any time.

Unless you delete your forum topics or posts beforehand, we collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you register on the Platform, we will send you emails and messages via the Platform’s messaging system for the purpose of providing important notifications such as GTC, Privacy Policy changes.

Legal basis for the collection and use of data is the performance of a contract (compliance with our GTC) to which you are party (Art. 6 (1) (b) of the GDPR) and compliance with the legal obligations to which Vinted is subject (Art. 6 (1) (c) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you register on the Platform, we will send you offers related to Vinted services via the Platform’s messaging system (“Offers”).

Legal basis for the collection and use of data is our legitimate interest in providing offers to our members (Art. 6 (1) (f) of the GDPR, Art. 13 (2) of Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002 regarding the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), Art. 81 (2) of Lithuanian Law on Electronic Communications).

In order to send Offers, Vinted uses the service provider, Braze, Inc. (USA), established outside the European Economic Area. In this case, personal data is protected by the service provider entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you send us questions, requests or complaints, we will collect and use the following data for the purpose of providing you with customer support services you request on the Platform:

1. Your profile information;
2. Platform usage information;
3. Transaction information;
4. Shipment information;
5. Communications;
6. Age;
7. Gender;
8. IP address;
9. Session information;
10. Item listings, photos and videos;
11. Inquiries;
12. Other information submitted by you.

The type of information we collect may vary depending on your inquiry.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

In order to respond to your inquiries, Vinted provides your data to customer support service providers.

The following service providers are established outside the European Economic Area, which may result in your data being shared with our customer support agents outside the European Economic Area. In these instances, the personal data is protected by the service providers entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

1. Transcom Worldwide Albania SH.P.K. (Albania);
2. Transcom Worldwide Tunis Sarl (Tunisia);
3. Transcom Worldwide Italy SpA (Italy, Colombia);
4. Phoneact S.A.R.L (Tunisia);
5. Helpware Inc. (USA, Ukraine, Mexico);
6. Teleperformance Portugal, S.A. (Egypt).

Personal data collected and used for this purpose is kept for 2 years after the last update related to your inquiry. If your account is deleted, personal data collected and used for this purpose will be deleted along with your account.

If you purchase and/or sell and/or swap items on the platform and are involved in a dispute with another member, we will collect and use any of your personal data held by Vinted necessary to solve the dispute.

We base such collection and use on a legitimate interest in settling disputes between our members and defending the rights and interests of Vinted (Art. 6 (1) (f) of the GDPR) and, where relevant, compliance with the legal obligations to which Vinted is subject (Art. 6 (1) (c) of the GDPR).

Personal data collected and used for this purpose is kept for 1 year after the conclusion of a dispute.

If you decide to deactivate your account, we will take all reasonable efforts to make sure it is no longer viewable on the Platform and restrict the use of your personal data. For up to 3 months, it is still possible to restore your account if it was accidentally or wrongfully deactivated or in case you change your mind and wish to return to the Platform and take action in the event that someone other than yourself gained access to and deleted your account without your knowledge.

The legal basis for such storage of your data is the legitimate interest of Vinted and our members to restore your account when necessary (Art. 6 (1) (f) of the GDPR) and, where applicable, to comply with the legal obligations to which Vinted is subject (Art. 6 (1) (c) of the GDPR).

Personal data is kept for this purpose for 3 months from the date of deactivation of your Vinted account.

After 3 months, we permanently delete your account from our Platform.

If you choose to personalize the items presented to you on the Platform (on item feed, catalog and search results), we will collect and use the following data for the purpose of presenting you a feed personalized based on your preferences:

1. Information as to whether you are interested in items for women, men or children;
2. Preferred sizes of the items;
3. Preferred brands of the items.

Legal basis for such collection and use of your personal data is the legitimate interest of Vinted and its members (Art. 6 (1) (f) of the GDPR) to make the Platform more convenient for our members and allow you to see offers from other members that might interest you the most based on your set preferences.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

We also personalize item feeds by evaluating your preferences according to the following:

1. Gender;
2. Age;
3. Country;
4. Language;
5. Information about your browsing activity on the Platform;
6. Purchasing history;
7. Your preferences.

Legal basis for such collection and use is the legitimate interest of Vinted and its members (Art. 6 (1) (f) of the GDPR) to make the Platform more convenient for our members and, thanks to personalization, allow you to see offers from other members that might interest you the most.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

In order to determine whether you, as a reputable seller, offer high value items, we will collect and use the following data from you when you sell your items on the Platform:

1. Number of positive reviews;
2. Information as to whether the seller has items that are 60% cheaper than similar items sold on the Platform (similarity is determined according to item category, brand and condition).

We use results to prioritize high value items sold by reputable sellers when showing items to new members, and increase the visibility of items uploaded by members that have chosen the same language as you and/or live in the same country or region, items listed by new members, items that have three (3) favorites or more, children’s items that have one or more favorites, items that are bumped, and we show relevant items on the Platform.

Legal basis for such collection and use of your personal data is our legitimate interest in prioritizing high value items sold by reputable sellers in order to facilitate sales and member satisfaction on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you choose to create item listings on the Platform, we will collect and use data you provide in the listing (see 2.1.5 above) by analyzing it in order to either offer members who clicked on your items other relevant items or offer them to members to whom your items may be relevant.

Legal basis for such collection and use of your personal data is our legitimate interest in the improvement of the Platform and in ensuring that our members receive relevant suggestions and search results (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

We collect and use data provided in the item listings (see 2.1.5 above) with no seller-related information in order to improve search results by evaluating the degree of relevance of certain items with respect to a specific search keyword and to automatically suggest relevant categories for new listings. For this, we only use the item listing without any link to a particular seller.

Legal basis for such collection and use is our legitimate interest in improving the Platform and ensuring that our members receive relevant suggestions and search results (Art. 6 (1) (f) of the GDPR).

Vinted uses service providers who provide data analysis services to Vinted.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for 5 years.

In order to help you find previously searched items on the Platform, we save your search keywords. We collect and use the following data for the purpose of providing information about newly listed items on the Platform based keywords from your previous searches:

1. Your search history (most recent keyword searches);
2. Date and time of your search;
3. Number of newly listed items.

Legal basis for such collection and use is the legitimate interest of our members and Vinted to improve search results on the Platform (Art. 6 (1) (f) of the GDPR).

You can delete your search history at any time.

Unless you delete your search history beforehand, we collect and use your personal data for this purpose until the deactivation of your Vinted account or until 5 years of inactivity on your account have lapsed.

Should you order extra services, i.e. bumps or the “Wardrobe Spotlight” in order to increase your items’ visibility on the Platform, we collect and use the following data:

1. Your profile information;
2. Extra services you bought;
3. Items you selected for extra services;
4. Duration of extra services;
5. Date and time of extra services you bought;
6. Price of extra services;
7. Payments information;
8. Invoices;
9. Statistics related to your items during the usage of extra services.

Legal basis for the collection and use of data is the fulfillment of a contract (your order for extra features under GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into or fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for 5 years.

If you choose to create an item listing on the Platform, our algorithms will analyze its price in addition to the item category, item brand and item condition. We will then use that information to show you pictures and prices of similar items sold in the last three months in order to help you determine the selling price for your item.

If the selling price you chose is above the price range for similar items sold on the Platform in the last three months, Vinted will also give you a tip regarding the recommended price range.

Legal basis for such collection and use is our legitimate interest in helping our members choose the right price for their items (Art. 6 (1) (f) of the GDPR).

To perform the above function, we collect and use pictures and prices of items sold in the last three (3) months.

Upon listing your items, we collect and use such information to analyze your items throughout the item listing process. Upon sale of your items, we collect and use the data mentioned above for three (3) months after the item’s sale.

If you favorite an item listed by another member on the Platform, Vinted will inform you when the price of your favorited goes down or when the item is sold. For this reason, we will collect and use the following data:

1. Title of favorited item;
2. Photo of favorited item;
3. Seller of favorited item;
4. Price of favorited item;
5. Information whether favorited item is sold;
6. Information about a price reduction.

Legal basis for such collection and use is the legitimate interest of our members and Vinted in facilitating sales on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you favorite an item on the Platform, Vinted will inform the seller that you have favorited their item.

Legal basis for such collection and use is the legitimate interest of our members and Vinted in facilitating sales on the Platform (Art. 6 (1) (f) of the GDPR).

You can disable these notifications by logging in to the Platform, going to Privacy Settings and changing the appropriate settings.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If a member you followed listed a new item on the Platform, we will notify you about it.

Legal basis for such collection and use of your personal data is our legitimate interest to help members receive timely information about new items of interest to them, thereby facilitating sales on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Vinted is committed to the Platform’s optimal performance. While the Platform is in use, Vinted gathers information about actions performed on the Platform (button clicks, visiting time, notifications read, other information based on a given business case) and other data described under 2.1, 2.2, 2.5, 2.6 and 5 of this Privacy Policy in order to help us make decisions on how to improve the Platform and make it a better experience for our members.

Legal basis for such collection and use is our legitimate interest in maintaining performance and improving the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

We are always looking for ways to improve your user experience with Vinted. As such, you may be invited to participate in a survey and your feedback may be used. For this purpose, we collect and use the following data:

1. User ID;
2. Your gender;
3. Your age;
4. Your region;
5. Your responses to our questions (e.g., your satisfaction with the Platform, your needs involving the Platform, problems that you encounter using the Platform).

Legal basis for inviting you to participate in the survey is our legitimate interest in receiving feedback from our members and using it to improve the Platform (Art. 6 (1) (f) of the GDPR, Art. 13 (2) of Directive 2002/58/EC of the European Parliament and of the Council of July 12, 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), Art. 81 (2) of Lithuanian Law on Electronic Communications).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

For our surveys, we use service provider, Widgix Limited (United Kingdom, which is considered to be safe in terms of data protection by the European Commission).

For our surveys we use a service provider Widgix Limited (United Kingdom, which is considered by the European Commission as safe in terms of data protection).

We will anonymize your responses after 3 months – this means that the responses will no longer be associated with you.

In order to understand our users' needs and improve your experience on the Platform, we conduct on-site or online interviews with you. For this purpose, we collect and use the following data:

1. User ID;
2. Your gender;
3. Your age;
4. Your interests;
5. Audio recording of your interview;
6. Other data you voluntarily submitted during the interview.

Legal basis for inviting you to participate in the interview is our legitimate interest in receiving feedback from our members and using it to improve the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you wish to participate in the interview, the information above will be collected based on your consent (Art. 6 (1) (a) of the GDPR).

We will anonymize your responses after three (3) months – this means that the responses will no longer be associated with you.

We are making constant improvements to our Platform and look for ways to improve your experience while using Vinted. If you agree, we enable you to share your user journey through our Platform. In so doing, we will collect and use the following data:

1. User ID;
2. Your contact details;
3. Date and time of the survey;
4. Category to which you are assigned (e.g. new member of our Platform);
5. Your screen recording;
6. Your voice recording;
7. Your face recording.

Legal basis for inviting you to participate in the sharing of your user journey is our legitimate interest in receiving feedback from our members and using it to improve the Platform (Art. 6 (1) (f) of the GDPR.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you wish to participate in the survey, the information above will be collected based on your consent (Art. 6 (1) (a) of the GDPR).

We will anonymize your responses after three (3) months – this means that the responses will no longer be associated with you.

To make the content available in all preferred member languages, we have integrated an automatic translation solution into the Platform. We collect and use the following data if you or another member wishes to have translated:

1. Information provided in the “About You” field.
2. Item descriptions;
3. Reviews;
4. Messages.

For automatic translation, Vinted uses service provider Google LLC (USA) which is established outside the European Economic Area. In this case, the personal data is protected by the service provider entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

Legal basis for such collection and use of the personal data is the legitimate interest of Vinted and its members (Art. 6 (1) (f) of the GDPR) in making the Platform more convenient and intuitive for our members.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

When you connect to the Website or App, we collect and use the following data (log files), even if you are not logged in to the Website as a member:

1. User ID;
2. IP address of your device;
3. Browser used by your device;
4. Content and URLs you connect to;
5. Date and time of your connections.

For access via mobile devices, the following log files are also recorder as part of your use of the Vinted App:

1. Model and manufacturer of your mobile device;
2. Operating system used by your mobile device (iOS, Android, etc.).

This data is used for security purposes, especially the prevention of cyber-attacks such as data scraps and denial of service attacks and to prevent unauthorized multiple applications.

Legal basis for such collection and use is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members in ensuring the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for 3 months.

If you decide to register using a password or subsequently decide to change your password, we will check it against a database of passwords compromised in previous data breaches having occurred on other platforms and through other services. To enable this functionality, we take the password, hash it and then use the first 5 characters of the hash to Have I Been Pwned (https://haveibeenpwned.com/) to conduct a search in the database for compromised passwords.

By performing this check, we are able to protect your account by confirming that you are using a password not known to be compromised.

Legal basis for such collection and use is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members in ensuring the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use personal data for this purpose only for the duration necessary to perform the password check.

If you forgot your password or decide to change it for other reasons and do not have access to your email, we may ask you to answer a few security questions to verify your identity. For this purpose, we will collect and use the following data:

1. Email address;
2. Date of birth;
3. Registration date;
4. Last transaction information.

Legal basis for such collection and the use of your personal data is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members in ensuring the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If we detect activity on your account considered to be suspicious by Vinted, we will ask you to perform a basic verification by confirming your email, Facebook or Google accounts. For the purpose of performing a basic verification, we will collect and use the following data:

1. Email address; or
2. Information received during Facebook or Google authentication (as described 2.1.2 above).

Legal basis for such collection and use is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members in ensuring the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Should you decide to apply an additional layer of protection to your account and activate phone verification, we will use your phone number in order to enable this function. Legal basis for such collection and use is our legitimate interest in providing our users with additional measures to protect their account (Art. 6 (1) (f) of the GDPR).

You may also be asked to verify your phone number in case of suspicious activities on your account. In that event, verification is mandatory and personal data collection and use is based on the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

When you verify your phone number, Vinted will collect and use your phone number for two-step verification purposes.

Personal data for mandatory verifications is required to enter into and fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

In order to carry out phone number and two-step verifications, we use service provider, Vonage Holdings Corp. (USA), enabling us to send you verification messages or make verification calls to dictate verification code if you do not verify your phone number within 5 minutes. While this results in your data being shared outside the European Economic Area, the data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

As part of the security process, we ask our members to provide verification of their payment source. In order to perform such security checks, Vinted collects and uses the following personal data:

1. Username;
2. When we perform a payment card security check – information contained in a photo of the payment card: full name, card’s expiration date and the last four digits of the card number, other information visible on the front of the card if the member chooses not to cover it;
3. When we perform a bank account security check – information contained in a photo/screenshot of the bank statement listing the most recent charge/charges: date and description of the last Vinted charge, other payment information if the member chooses not to redact other information.

Legal basis for such collection and use is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members to ensure the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for 4 days after the security check is passed.

As part of the security process, we request our members to verify ownership of their PayPal accounts where there was no actual charge. As part of this process, Vinted collects and uses the following data:

1. Username;
2. Registration email address;
3. Information in the screenshot(s) of PayPal profile: account holder’s full name, address and other visible data.

As part of the security process, we also ask our members that use PayPal to verify ownership of their PayPal accounts. As part of this process, Vinted collects and uses the following data:

1. Username;
2. Registration email address;
3. Information in the screenshot(s) of the expanded version of the statement of the most recent Vinted order: date, amount, account holder’s full name, shipping address and other visible data.

Legal basis for such collection and use is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members to ensure the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for 4 days after the security check.

For some listings, we collect and use the following data in order to ensure that such listings comply with our Authenticity Policy:

1. Information provided in the listing (see 2.1.5 above);
2. Information on the item’s authenticity: photos of e.g., the receipt, certificate, tag, logo, pattern, stitches, original packaging, date code, authenticity code or any other relevant information that would demonstrate the item’s authenticity

Legal basis for such collection and use of your personal data is our legitimate interest to protect the Platform and our members from eventual counterfeit (Art. 6 (1) (f) of the GDPR).

We may share photos of listings or other proofs of authenticity free of your personal data with brand owners in order to verify certain items.

Personal data collected and used for this purpose is kept for 2 years when it is necessary to solve disputes between our users.

As part of the security process, we may ask our members to verify ownership of their Vinted account. To confirm your identity, we will need one of the following as proof:

1. A photo/screenshot of your bank statement showing your most recent Vinted charge(s);
2. A photo/screenshot of the expanded version of the Paypal statement showing the most recent Vinted order (the date, total amount, shipping address and account holder’s name should be visible);
3. Proof of address: it can be a household utility bill with your name and current address that is no longer than 3 months old (e.g., gas, electricity, water, landline telephone; cellular phone bills are not permitted), or a photo/screenshot of your bank statement showing your billing address;
4. A photo of your credit card used for your purchases on Vinted (the photo needs to include the cardholder’s full name, and the card’s last four (4) digits and expiration date);

Legal basis for such collection and use of your personal data is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members to ensure the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for 3 days from receipt of the proof.

If you would like to report inappropriate messages, forum activity, members, items, spam or spoof mail, we will collect and use the following data for the purpose of ensuring the security of the Platform and its members:

1. Reported content;
2. Reporting reason;
3. Information provided in the report;
4. Date and time of your report.

Legal basis for such collection and use of your personal data is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members to ensure the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

In exceptional cases, where we notice suicidal posts on our Platform, we may report them to the police. In such cases we will collect and use and disclose the following data for the purpose of reporting suicidal posts:

1. Username;
2. E-mail address
3. Full name;
4. IP addresses and last logins;
5. Telephone number (if verified);
6. Print screen/link of forum post or thread where the suicidal declaration appears.

Legal basis for such collection and use is the protection of your vital interests (Art. 6 (1)(d) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

In order to ensure the security of the Platform and its members, Vinted makes automated decisions and assigns each member a "trust score" calculated with an algorithm and maintaining a black base of member’s personal data suggestive of unlawful activities. The "trust score" indicates the likelihood of improper use of the Platform.

Our algorithm takes into account members’ comments on a forum, messages to other members, items listed on the platform, transactions, reports from other members on that member, the member's profile and contact information, the member's violations of our GTC, IP addresses, and browser fingerprints, other content provided to use by the member.

When member evaluations meet certain thresholds, the member's usage of the platform is restricted or the member is asked to verify his/her telephone number, email, Facebook or Google accounts.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

In order to protect our members and the Platform, we use spam filtering tools. These tools include a list of keywords that are commonly associated with spam. If your messages include these keywords, they are stopped by the above-referenced tools and reviewed manually before being sent to other members.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

In order to ensure the security of the Platform and its members we regularly moderate your activity on the Platform. We may check your listings automatically or we may check your listings, comments, and messages upon receipt of reports from other members or third parties.

If you communicate with another Vinted member via private message and either you or another member sends us a report or escalates a transaction, we collect and use information contained in your communications to check for potential violations of our GTC.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

As a member, if you violate our GTC or take other actions that result in a warning being issued to you, we collect and use the following data to issue and enforce the warning:

1. Username;
2. Type of warning issued to member;
3. Date of warning issued to member.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you list items that violate our GTC, we will remove or hide them. However, we will retain deleted listings as proof of the violation. For this purpose, Vinted uses personal data included in the listing as specified under 2.1.5.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

Deleted listings are stored for 30 days after their removal.

In order to protect our members and the Platform, we regularly check for suspicious activities to detect compromised accounts. If we determine that your account may be compromised or at your request, we may lock your account.

Legal basis for such collection and use of your personal data is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you send too many messages in a short period of time, you may get suspended for between one (1) and six (6) hours. For this purpose, Vinted collects and uses the time and duration of the suspension.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you violate Vinted GTC in a way that results in your ban, we will use the reason for your ban, its time and your profile data.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for three (3) months from the time you were blocked.

If there are signs of cyber-attacks or other risks to the Platform’s security coming from your IP address, in order to protect the platform, we will collect and use your IP address and block it.

Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose is kept for five (5) years.

When you add a payment card or purchase an item or our extra services via the Platform, we collect and use the following data for the purpose of allowing you to make payments:

1. Full name;
2. First six and last four digits of your payment card number;
3. Expiration date.

When you add a payment card or purchase an item or our extra services via the Platform, relevant payment service provider (please see 2.5.3 and 2.5.4 below) receives the following data:

1. Payment card holder’s full name;
2. Payment card number;
3. Expiration date;
4. Security code (CVV/CVC) number.

Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

If you agree, we will store your bank card details for future use.

Legal basis for such collection and use is your consent (Art. 6 (1) (a) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

When you add a bank account for withdrawal purposes, we collect and use the following data to allow you to withdraw money:

1. Account holder’s full name;
2. Account number;
3. Address.

Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you opt to pay a seller or for extra services by payment card or other payment method integrated on the Platform, or if you use other services on the Platform for which a charge is made, the transaction in question will be collected and used via the electronic payment system ADYEN (see our GTC), which is operated by ADYEN N.V. (Netherlands) ("ADYEN"). On behalf of Vinted, ADYEN will collect the payment information based on the payment method selected (e.g. payment card, etc.). The payment will then be implemented via ADYEN and the payment scheme owner or facilitator of the payment method you have selected. To this extent, the data protection rules of ADYEN and the payment scheme owner or facilitator of the payment method you have selected will apply.

For more information on payment procedure, see Article 6 of our GTC. If you use a payment card as your payment method, Vinted will see only the card holder’s full name, the first six and last four digits of your payment card number and expiration date.

This information will be used by us solely for the purpose of confirming payment. The rest of the card data is masked and forwarded to ADYEN to handle the transaction.

Legal basis for the collection and use of data is the fulfillment of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).

Personal data are required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Additionally, if you are a seller on Vinted and you want to receive payments from buyers through the above electronic payment system for the purchase of your products, you will have to accept ADYEN’s Terms and Conditions and create an e-wallet with ADYEN (referred to on the Platform as a "Vinted Balance"). In order to do so, you must provide the following data:

1. Full name;
2. Date of birth;
3. Billing address;
4. Social security number.

ADYEN processes this information in accordance with applicable laws and as described in AYDEN's Privacy Policy.

Legal basis for the collection and use of your personal data is the fulfillment of a contract (compliance with our GTC and ADYEN’s Terms and Conditions) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data are required to fulfill contracts (GTC and ADYEN Terms and Conditions) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill contracts with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Please note, this section only applies to our old Platform.

If you opt to pay a seller by payment card or other payment method integrated on the Platform, or if you use other services on the Platform for which a charge is made, the transaction in question will be collected and used via the electronic payment system, STRIPE (see our GTC), which is operated by Stripe, Inc. (United States) ("STRIPE").

On behalf of Vinted, STRIPE will collect the payment information required according to the payment method selected (e.g. payment card, etc.). The payment will then be implemented via STRIPE and via the payment scheme owner or facilitator of the payment method you have selected. To this extent, STRIPE’s data protection rules and those of the payment scheme owner or facilitator of the payment method you have selected will apply. For more information on payment procedure, see Article 13 of our GTC.

If you use a payment card as your payment method, Vinted will see only the card holder’s full name, the last four digits of your payment card number, expiration date, brand and country code. This information will be used by us solely for the purpose of confirming payment. The remaining card data is masked and forwarded to STRIPE to handle the transaction.

Legal basis for the collection and use of your personal data is the fulfillment of a contract (compliance with our GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data are required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Additionally, if you are a seller on Vinted and you want to receive payments from buyers through the above electronic payment system for the purchase of your products, you will have to accept STRIPE’s Terms and create an e-wallet with STRIPE (referred to on the Platform as a "Vinted Balance"). For this, you must provide the following data:

1. Full name;
2. Date of birth;
3. Address;
4. Social security number (last 4 digits).

You can find out more on how STRIPE collects and uses your data by consulting STRIPE's privacy policy, accessible at the following address: https://stripe.com/privacy.

Legal basis for the collection and use of your personal data is the fulfillment of a contract (compliance with our GTC and STRIPE Terms) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill contracts (GTC and STRIPE Terms and Conditions) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill contracts with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Whenever you reach the KYC thresholds which are set by ADYEN, ADYEN will ask you to provide a copy of your passport, ID card or driver’s license, including temporary licenses. In that case, we will enable ADYEN to collect the following data from you in order to allow ADYEN, as payment service provider, to perform an identity check (so-called Know Your Customer, KYC):

1. Full name;
2. Date of birth;
3. Address;
4. Social security number;
5. Email address;
6. Information present on the provided document (exact list depends on the document provided): document number, picture, gender, nationality, date of issue, expiration date, place of birth, personal code, signature, other information on a particular document.

As a separate safety check, ADYEN may also request a photo/screenshot of the bank statement listing transactions for a one-month period. In that case, we collect the following information as requested by ADYEN:

1. Full name;
2. Date of birth;
3. Country;
4. Address;
5. Information present on the provided statement: account holder's full name, transaction history (deposits, charges, withdrawals) and other information present on a particular statement.

For this purpose, Vinted implemented ADYEN’s API – a technical measure that allows you to submit a copy of your document and other data to ADYEN without leaving the platform. All document copies go straight to our payment provider ADYEN without being saved on our systems.

This is necessary in order to fulfill our legitimate interest to provide ADYEN with necessary information for their compliance with the legal obligations to which ADYEN is subject (Art. 6 (1) (f) of the GDPR).

Please note, this section only applies to our old Platform.

Whenever you reach the KYC thresholds which are set by STRIPE, STRIPE will ask you to provide a copy of your passport, ID card or driver’s license, including temporary license. In that case, we will enable STRIPE to collect the following data from you in order to allow STRIPE, as payment service provider, to perform an identity check (so-called Know Your Customer, KYC):

1. Full name;
2. Date of birth;
3. Country;
4. Address;
5. Social security number;
6. Routing No.;
7. Bank account No.;
8. Personal ID number;
9. Information present on the provided document (exact list depends on the document provided): document number, picture, gender, nationality, date of issue, expiration date, place of birth, personal code, signature, other information on a particular document.

For this purpose, Vinted implemented STRIPE’s API – a technical measure that allows you to submit a copy of your document and other data to STRIPE without leaving the platform. All document copies go straight to our payment provider STRIPE without being saved on our systems.

This is necessary in order to fulfill our legitimate interest to provide STRIPE with necessary information for their compliance with the legal obligations to which STRIPE is subject (Art. 6 (1) (f) of the GDPR).

If you participate in purchase-sale and/or other transactions when using the Platform, Vinted will collect and use the following data in order to carry out its accounting-related duties:

1. Full name;
2. Username;
3. Address;
4. VAT identification number (where applicable);
5. Value and description of supplied goods and/or services.

This is necessary in order to comply with the legal obligations to which Vinted is subject (Art. 6 (1) (c) of the GDPR).

Financial regulations require us to keep accounting documents that confirm the transactions for 10 years.

If you choose to enter your shipping information or when you buy, sell or swap items, we collect and use the following data that you provide for dispatch and shipping purposes:

1. Full name;
2. Country;
3. City;
4. Telephone number;
5. E-mail address;
6. Signature;
7. Address of the package drop off point;
8. Package tracking number;
9. Confirmation of package delivery;
10. Other shipping information required by a particular shipping service provider.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you.

We provide personal data collected and used for this purpose to the following recipients:

1. Seller of the item;
2. If we are unable to gather tracking information directly from a particular shipping provider, we use a tracking service provider AfterShip Limited (Hong Kong, China). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission;
3. If the shipping provider integrates its shipping services with Vinted, we also provide the above data directly to your chosen shipping provider.

Otherwise, it is up to the seller to follow the instructions and provide your data to the shipping provider.

Personal data collected and used for this purpose is kept for 10 years.

When you buy, sell or swap items on the Platform, we collect and use the following data for shipment tracking purposes:

1. Date and time of package delivery;
2. Package tracking number;
3. Address;
4. Package location of the parcel.

If we are unable to gather tracking information directly from a particular shipping provider, we provide the aforementioned information to a tracking service provider AfterShip Limited (Hong Kong, China). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission.

Legal basis for the collection and use of your personal data is the legitimate interest of Vinted and our members to track shipment when it is impossible to gather tracking information directly from a particular shipping provider (Art. 6 (1) (f) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

Personal data collected and used for this purpose is kept for 10 years.

You can register for our newsletter and for other marketing emails ("Marketing Emails"). When you register, we will ask you for your permission to use your email address to send you Marketing Emails containing the latest information on our products and services, especially regarding goods available on the Platform, special offers and marketing campaigns. If, upon registration, you do not give your permission, you can change your mind at any time and agree to receive Marketing Emails by changing the settings on your Vinted account.

We base such collection and use on your consent (Art. 6 (1) (a) of the GDPR, Art. 81(1) of Lithuanian Law on Electronic Communications).

You can grant or revoke your consent to receive Marketing Emails at any time with future effect. In your Vinted account, you can adjust your settings to choose what emails you wish to receive or disable the receipt of further Marketing Emails. Alternatively, you can click "Unregister" at the end of the Marketing Email. Revoking your consent will not affect the legality of the collection and use carried out prior to withdrawal of your consent.

Vinted uses the service provider, Braze, Inc. (USA), established outside the European Economic Area, to send Marketing Emails. In this case, the personal data is protected by the service provider entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years or until you revoke your consent.

Vinted will use the data used to register you on the Platform (see above under 2.1.1, 2.1.2 and 2.1.3) and related to your Vinted account (see 2.2), the data on your forum activity (see 2.1.10), your log files (see 2.3.1 above) and other means (see 2.7.7) to personalize marketing messages and advertisements presented to you.

We base such collection and use of your personal data on our legitimate interest to present you with marketing messages that we consider relevant to you (Art. 6(1)(f) of the GDPR).

Vinted uses service provider, Braze, Inc., (USA) established outside the European Economic Area, to send you personalized marketing messages. In this case, the personal data is protected by the service provider entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you register on the Platform, we may contact you via email or via the Platform’s messaging system to offer you to share your content (e.g., pictures) on our social media profiles, or to participate in our marketing campaigns, or to have your information shared with the press, or for other publicity and/or earning opportunities. This is done in order to ensure that only members who give their consent are featured on our social media profiles or receive other publicity and/or earning opportunities.

We base such collection and use on our legitimate interest to increase your publicity and that of Vinted and/or provide you with earning possibilities (Art. 6(1)(f) of the GDPR).

If you consent, we may check your profile information to ensure that we only offer publicity and/or earning opportunities to members with a good reputation (i.e., compliance with the GTC). The collection and use of your personal data for this purpose will be based on your consent (Art. 6 (1) (a) of GDPR).

If you agree to participate in publicity and/or earning opportunities offered by us, the further collection and use of your personal data will be based on your consent (Art. 6(1)(a) of the GDPR).

If you sign a contract with Vinted related to the publicity and/or earning opportunity, the collection and use of your personal data will be based on a contract between Vinted and you (Art. 6(1)(b) of the GDPR).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Messages themselves are deleted after twelve (12) months.

If you agree to participate in our advertisement campaigns, we will use your telephone number to contact you with a proposal to participate in our advertisement campaign and give you more details about the project.

If you sign a contract with Vinted related to the advertising campaign, we will collect and use the following data for the purpose of completing and fulfilling a contract between you and Vinted:

1. Full name;
2. Date of birth;
3. Nationality;
4. Information about your business certificate or individual business activity.

If you provide your address and room photos we will use them to arrive at your location and film the advertisement. If you agree, we may also use your name, age, city or story to be included in advertising campaigns.

We base your invitation to participate in our advertisement campaigns on our legitimate interest in increasing your publicity and that of Vinted (Art. 6(1)(f) of the GDPR). If you agree, your participation in our advertisement campaign will be based on a contract between Vinted and you (Art. 6(1)(b) of the GDPR).

This data may be transferred to our partners (advertising agencies, directors) that are responsible for implementing the advertisement campaign.

Personal data for your participation in our advertisement campaign are required to fulfill a contract with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you agree, we will post your content on our social media accounts for marketing and PR purposes.

We base such collection and use on your consent (Art. 6(1)(a) of GDPR).

You may grant or revoke your consent at any time by logging into the Platform, visiting Privacy Settings and changing relevant settings.

In order to post your content on our social media accounts, we provide data to social media platform operators.

The following social media platform operators are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases the personal data is protected by the operators entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:

1. LinkedIn Corporation (USA);
2. Google LLC (USA);
3. Meta Platforms, Inc. (USA).

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

Upon your consent, Vinted will allow advertising service partners to collect your IP address and/or mobile device identifier and place their cookies on your devices and then use the data to personalize advertisements presented to you. This means that with your consent, you will receive advertisements based on your interests and your activity on the Platform. Namely, advertising service partners will collect and use the following data:

1. IP address of the connection;
2. Mobile Device ID;
3. Advertising ID;
4. Information on websites browsed by the visitor - list of pages and products viewed, clicked, put in a basket or bought the Platform;
5. URL of the pages viewed by the visitor (“referrer”); URL of the previous page viewed by the visitor;
6. Technical information related to the browser, device type and visitor operating system version (“user-agent”);
7. Timestamp (date, time);
8. Information about the possible relationships among different browsers and devices;
9. Other information collected by a particular advertisement services provider.

Legal basis to conduct this is Art. 61(4) of Lithuanian Law on Electronic Communications. To the extent that it involves personal data, we base such collection and use on your consent (Art. 6 (1) (a) of the GDPR).

You can choose not to receive personalized marketing and advertisements at any time by changing relevant settings on the Platform. Withdrawal of permission will not affect the lawfulness of the collection and use carried out prior to the withdrawal of permission.

To enable our service providers to show you personalized advertisements, your data is used by partners who provide personalized advertisement services.

When you use the Platform, Vinted analyzes its marketing activities and how you use the Platform (when you register, login, create a listing, make a sale, swap or purchase, upload an item’s photo, open our App, register or install the app, etc.) for the purpose of evaluating the efficiency of promotional campaigns, and to better comprehend visitor behavior after they have viewed a certain ad and visited our Platform or downloaded our App.

We base such collection and use on our legitimate business interest to evaluate the efficiency of our promotional campaigns in order to improve upon them (Art. 6 (1)(f) of the GDPR).

In order to carry out the above evaluations, Vinted provides your data to service providers who evaluate the efficiency of promotional campaign services.

Our service provider, Braze, Inc. (USA), is established outside the European Economic Area. In this case the personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission.

In order to optimize our advertising campaigns, we send certain information on your activities like apps opened, sessions, registrations, logins, information about you listing an item, uploading an item’s photo or buying an item, etc. to Google and Facebook advertising platforms. Thus, we transfer the data of your activities to the following recipients:

1. Meta Platforms, Inc. (USA). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission;
2. Google LLC (USA). Personal data is protected by the service provider entering into the EU Standard Contractual Clauses for the transfer of data as approved by the European Commission.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you are interested in our activity and follow our profiles on social media, we collect and use the following data about you in order to manage our social networking sites:

1. Full name;
2. Email address;
3. Gender;
4. Country;
5. Picture;
6. Message;
7. Time and date the message was received;
8. Content of the message;
9. Message attachments;
10. Response to the message;
11. Message response time;
12. Information about our rating;
13. Comments on a post;
14. Post shares;
15. Information about post reactions.

We base such collection and use on our legitimate interest to manage our social media profiles (Art. 6(1)(f) of GDPR).

In order to manage our social media accounts, we receive and provide data to social media platform operators.

The following social media platform operators are established outside the European Economic Area, which may result in your data being transferred outside the European Economic Area. In these cases personal data is protected by the operators entering into the EU standard contractual clauses for the transfer of data as approved by the European Commission:

1. LinkedIn Corporation (USA);
2. Google LLC (USA);
3. Meta Platforms, Inc. (USA).

Personal data collected and used for this purpose are kept as long as you are registered on a specific social media network.

Joint Controllership with Facebook (“page insights”)

Vinted operates a so-called fan page on the social media platform of Facebook. Vinted operates a so-called fan page on the social media platform of Facebook. Facebook and Vinted are only jointly responsible for the processing of so-called "insights data" (Art. 26 (1) sentence 1 of the GDPR) insofar as this data is used for the creation of so-called "page insights" and only for the data collection phases from Vinted's fan page until its transmission to Facebook. For other data processing, Vinted and Facebook are separately responsible for data processing.

Within the scope of their joint controllership, Vinted and Facebook have entered into an agreement (referred to as the "page insights controller addendum"). The agreement covers the data processing that is collected and used in connection with a visit or interaction with our fan page, but only to the extent that this data is also (subsequently) processed for "page insights". "Page insights" includes analysis services that help us to better understand interactions on our site. In this context, we do not receive any personal data from Facebook, only an anonymous evaluation and illustration. Facebook provides more information on this on its help page for "page insights". The information about data for "page insights" explains how "insights data" is collected and used to create "page insights". This includes the following actions:

1. Views and interactions with a page, post, video, story, or other content associated with a page;
2. Subscribing or unsubscribing to a page;
3. Reactions to a page or a contribution (e.g. a "like"; recommendation, share, comment, subscription, etc.);
4. Hiding a page contribution or reporting it as spam;
5. Moving the mouse over a link to a page or the name or profile picture of a page to see a preview of the page contents;
6. Clicks on the website, phone number, "route planning" button or any other button on a page;
7. Views of an event of a page, reactions to an event (including the type of reaction), clicks on a link for event tickets;
8. Starting a messenger conversation with the page;
9. Views or clicks on articles in a website shop;
10. IP address as well as other information that is available on your end device in the form of cookies.

The processing of visitor data from our fan page serves the purpose of providing the page as well as the statistical evaluation of the use of our page. This evaluation is made anonymous for Vinted. The legal basis for data processing is Art. 6 (1)(f) of the GDPR. Our legitimate interests in the processing of personal data when visiting the site and the creation of "site insights" consist of presenting the company and the Platform. Similarly, we also seek to contact members and interested parties in order to provide information on products and promotions, as well as for the collection of data in order to generate anonymous evaluations and illustrations on the use of our fan page.

If you wish to exercise your rights with respect to your data (see bullet point 6. below), contacting Facebook directly is the most effective way. You can contact us if you still need help in exercising your rights. In accordance with our agreement, Facebook assumes primary responsibility for fulfilling the obligations for the joint processing of "insights data". This includes fulfilling the following rights:

• The right to access (Art. 15 of the GDPR);
• The right to ratification (Art. 17 of the GDPR);
• The right to restrict processing (Art. 18 of the GDPR);
• The right to data portability (Art. 20 of the GDPR); and
• The right of objection (Art. 21 of the GDPR).

Facebook provides more details on how to exercise these rights in the "page insights data" information.

Joint Controllership with LinkedIn

Vinted operates a so-called company page on LinkedIn, the social media platform. LinkedIn and Vinted are only jointly responsible (Art. 26 (1) sentence 1 of the GDPR) for the processing of so-called "insights data", enabling us to receive anonymized statistics and insights on how visitors interact with our page. For other data processing, Vinted and LinkedIn are separately responsible for data processing.

Within the scope of the joint controllership, Vinted and LinkedIn have entered into an agreement (referred to as the "Page Insights Joint Controller Addendum") in which the data protection obligations are allocated between LinkedIn and Vinted. The agreement stipulates the following:

• LinkedIn is responsible for enabling you to exercise your rights pursuant to the GDPR. In order to do so, you can contact LinkedIn online via https://www.linkedin.com/help/linkedin/ask/PPQ or via the contact information in the data protection guidelines. You can contact LinkedIn Ireland’s Data Protection Officer via the following link: https://www.linkedin.com/help/linkedin/ask/TSO-DPO. You can also reach out to us using the contact information mentioned below to exercise your rights with respect to the processing of your personal data for insights. In such a case, we will forward your request to LinkedIn.
• LinkedIn and Vinted have agreed that the Irish Data Protection Commission shall be the responsible supervisory authority monitoring the processing for insights. You always have the right to lodge a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or any other supervisory authority.

The data processing of LinkedIn company page visitors serves to provide the page itself as well as the statistical evaluation of the use of our page. This evaluation is made anonymous for Vinted (LinkedIn does not share personal data with us when providing us with the insights, we only have access to a summarized version of the insights; also, we are unable to make conclusions about individual members based on information in the insights). The legal basis for the processing of your personal data is Art. 6 (1)(f) of the GDPR. Our legitimate interests in the processing of personal data when visiting the site and the creation of the "insights" consist of presenting the company and the Platform and, for example, contacting members and interested parties and providing information about products and promotions, as well as the collection of data for the creation of anonymous evaluations and illustrations on the use of our company page.

If you refer one or more friends to Vinted’s Platform, you can earn Vinted shopping vouchers. We will collect and use the following data for the purpose of enabling you to participate in Vinted’s referrals program and to provide you with a Vinted shopping voucher:

1. Your member name;
2. Your referral link;
3. Profile data on the member you invited;
4. Date and time of the registration of your invited member;
5. Number of items uploaded of your invited member;
6. Date and time of items uploaded;
7. Information on successful sale of listed items of your invited member;
8. Shopping voucher;
9. Amount of shopping voucher;
10. Expiration of shopping voucher.

Legal basis for the collection and use of data is the fulfillment of a contract (GTC) to which you are party (Art. 6 (1) (b) of the GDPR).

Personal data is required to fulfill a contract (GTC) with you. If you do not provide us with this personal data, we will not be able to enter into and fulfill a contract (GTC) with you.

We collect and use your personal data for this purpose until your Vinted account is deactivated or inactive for five (5) years.

If you exercise your statutory rights regarding your data (see 6 below), we will collect and use the data contained in your request in addition to any other personal data held by Vinted for the purpose of examining the request, responding to it and, when necessary, taking necessary action.

We base such collection and use on a legitimate interest to exercise our members’ rights (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose are kept for two (2) years from the day we respond to your request.

If we have reasonable grounds to suspect that you are involved in illegal activities, we will collect and use necessary data from your profile data (see 2.1), data related to your activities on the Platform (see 2.2) and data collected and used for security purposes (see 2.3 and 2.4) in order to notify the law enforcement and other state institutions.

Vinted also provides the above data to law enforcement and other state institutions when we receive requests for information in relation to investigations carried out by these institutions.

This is necessary in order to comply with the legal obligations to which Vinted is subject (Art. 6 (1) (c) of the GDPR).

Personal data is required to fulfill our legal obligations when you are a member of our Platform. If you do not provide us with this personal data, we will not be able to comply with legal requirements.

Vinted collects and uses your personal data for this purpose for the same amount of time that your Vinted account is stored – for 3 months from the date of deactivation of your Vinted account or after five (5) years of inactivity on your account.

If you have made transactions via our payment service providers, we will collect and use your personal data held by Vinted to the extent necessary to resolve a particular situation.

We base such collection and use of your personal data on a legitimate interest to defend our rights in case a chargeback procedure is initiated against Vinted (Art. 6 (1) (f) of the GDPR).

If you become involved in a dispute with Vinted or we need to carry out enforcement of our GTC or otherwise defend, enforce, exercise and uphold our rights, we will collect and use all of your personal data held by Vinted to the extent necessary to resolve a particular situation.

We base such collection and use on a legitimate interest to defend the rights and interests of Vinted (Art. 6 (1) (f) of the GDPR).

Personal data collected and used for this purpose are kept for 3 years or until the dispute is resolved (including the time limit for appeal, if applicable), or until the investigations/legal proceedings are pending (including the time limit for appealing these investigations/legal proceedings), or until final issuance of the binding decision from the authorized body.

If you are a California consumer, you may have the right to request that Vinted provide you with information regarding what personal information about you we have collected, used, disclosed or sold in the preceding twelve (12) months. Once we receive your request and verify your identity, we will disclose to you the following:

1. The categories of personal information we have collected about you in the preceding twelve (12) months.
2. The categories of sources from which we collected your personal information in the preceding twelve (12) months.
3. The business or commercial purposes for collecting your personal information in the preceding twelve (12) months.
4. The categories of third parties with whom we shared your personal information in the preceding twelve (12) months.
5. The specific pieces of personal information we collected about you in the preceding twelve (12) months.

If you are a California consumer, you may have the right to request that Vinted delete a portion of your personal information that we have collected from you. However, this right to deletion does not apply to any of your personal information that is subject to an exception under the CCPA (as described below). Once we receive your request and verify your identity, we will delete (and direct our service providers to delete) any of your personal information in our records that is not subject to any of the CCPA exceptions. Specifically, we may deny your deletion request if your personal information is required for any of the following reasons, which we will identify in our response to you if we deny your request:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. To be able to fulfill the terms of a written warranty or product recall conducted in accordance with federal law.
3. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
4. Debug products to identify and repair errors that impair existing intended functionality.
5. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
6. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
8. Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with Us.
9. Comply with a legal obligation.
10. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

If you are a California consumer, you may have the right to request that Vinted stop selling some or all your personal information.

Once we receive your request and verify your identity, we will process your request as soon as feasibly possible and will also provide notification of your request to any third parties to whom we sold your personal information in the ninety (90) days prior to your request.

You may also use an authorized agent to submit a request to opt-out on your behalf, as long as you provide the authorized agent with written permission to do so, and the agent provides such proof to Us when they submit your request.

We cannot fulfill your request to delete or to know and access your personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with Us.

To verify your identity, we may ask that you provide the following personal information when you submit your request:

1. Full name;
2. Username;
3. Email address.

You may need to provide additional information as part of your responses to our identity verification questions. We will only use this information to confirm your identity. Depending on your type of request or the information requested by you, we may require additional information in order to verify your identity and fulfill your request.

If we cannot successfully verify your identity, we will inform you of that fact.

We will respond to your request within forty-five (45) days. However, in certain circumstances, we may require additional time to process your request, as permitted by the CCPA or other applicable law. We will advise you within forty-five (45) days after receiving your request if such an extension is necessary and why it is needed. Any disclosures we provide will only cover the 12-month period preceding our receipt of your verifiable consumer request.

If we cannot fulfill your request, our response to you will also explain the reason why we cannot fulfill your request.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

You may only make a verifiable consumer request to know about or access your personal information twice within a twelve-month period.