Privacy policy

The data controller is ResellPicks. For anything about personal data, write to geral@resellpicks.com.

Account: email, display name, preferred language, membership status and the dates you activated the account and accepted the terms.

Ways to sign in (optional): the mobile number you add to sign in by text message, and the identifier and email of the Google or Apple account you link. They are kept only in the authentication system and you can remove them from your account.

Access requests: name, email, your message and how you heard about us.

Security: to limit sign-in and form attempts, the IP address and email are turned into an irreversible identifier (HMAC) kept for at most 24 hours. The server keeps technical logs without the content of forms.

Purchases: what you order, the delivery address or pickup point, the order phone and email, and the payment status. Card details stay with Stripe; we never receive them.

Statistics (on our own server only, no third-party tools): which invitation and product pages are viewed, cart additions, checkouts, purchases and deliveries. Without your permission, visits are counted with no identifier at all. With permission, we also keep your member id or an anonymous id of our own (cookie "rp_aid"). An approximate location (country, region, city) given by the infrastructure in front of the site may also be kept; the IP address is never stored.

Managing your account and club access: performance of the contract you accept when activating the account (Art. 6(1)(b) GDPR).

Reviewing your access request: pre-contractual steps taken at your request (Art. 6(1)(b)).

Protecting the platform against abuse and keeping audit logs of admin actions: legitimate interest (Art. 6(1)(f)).

Visit statistics linked to an identifier: your consent (Art. 6(1)(a)), which you can withdraw at any time under "Cookie preferences". Aggregate statistics on purchases and invitation activation: legitimate interest in running the shop (Art. 6(1)(f)).

Supabase (database and authentication), with the data stored in the EU (Frankfurt, Germany).

Stripe (payments).

Carriers (DPD, InPost, CTT and others) and, when used, Packlink: name, address or pickup point, phone and email to deliver the order.

Partner suppliers, for "supplier deals" pieces: name, delivery address and phone, so they can ship the piece directly.

Amen (email for the resellpicks.com domain), to send sign-in codes and order emails.

Google and Apple, only if you choose to sign in with those accounts: they confirm who you are and send us the account identifier and email.

An SMS provider, only once phone sign-in is available and only if you add a number.

The provider of the server (VPS) the site runs on.

If any of these providers processes data outside the European Economic Area, the transfer relies on the European Commission standard contractual clauses.

Account: while you are a member. If you ask us to delete it, we delete the account data within 30 days, except order records the law requires us to keep.

Rejected access requests: 12 months. Security identifiers: up to 24 hours. Audit logs: 2 years.

Statistics events: 13 months; after that only daily counts remain, with no identifiers or city. The "rp_aid" cookie lasts at most 13 months and is deleted when you refuse.

You can ask for access, rectification, erasure, restriction or portability of your data, and object to processing based on legitimate interest. Just write to geral@resellpicks.com.

You can also lodge a complaint with the Portuguese data protection authority, CNPD (www.cnpd.pt).