Privacy Policy

01 Introduction & Personal Data Controller

This Privacy Policy sets out the rules for the collection, processing and use of personal data of users of the GTRADX website and platform (hereinafter: "GTradX"). Users’ personal data is treated with the utmost care and in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

The controller of the personal data of Portal users is GTRADX sp. z o.o., with its registered office in Krzeczyn Wielki, entered in the Register of Entrepreneurs under KRS number 0001205160, NIP: 692-254-74-19, REGON 543238445 (hereinafter: the "Controller").

You can contact the Controller in all matters relating to the processing of personal data and the exercise of rights related to data protection via email: contact@gtradx.com.

02 Types of Personal Data Collected

The Portal collects the following categories of personal data necessary to provide services and operate the marketplace:

• Identification data: first name, last name, PESEL (if applicable), company name, NIP / VAT ID, registered office address and correspondence address.
• Contact details: email address and telephone number.
• Transaction data: information about purchase and sale offers, transaction history and payments related to the use of the Platform.
• Technical data: IP address, login details, browser type and version, time zone and location settings, browser plug-in types and versions, operating system and platform, and other technologies on the devices from which the user accesses the Portal.

03 Purpose and Legal Basis of Processing

Users’ personal data is processed for the following purposes and on the following legal bases:

• Provision of electronic services – to enable users to use the functionality of the Portal, including registration and maintenance of a User Account, data verification, submission of offers and communication with the Controller and other users.
  Legal basis: necessity of processing for the performance of a contract (Article 6(1)(b) GDPR).
• Customer service and support – to provide technical support, respond to inquiries and provide expert and legal advice.
  Legal basis: performance of a contract (Article 6(1)(b) GDPR) and the legitimate interest of the Controller (Article 6(1)(f) GDPR).
• Analysis and statistics – for the purpose of monitoring and analyzing the use of the Portal, improving its functionality and optimizing the offer. Analysis and statistics are performed using cookies (Google Analytics 4 – GA4), which are activated only after the user expresses consent in the Cookie Banner.
  Legal basis: the user’s consent (Article 6(1)(a) GDPR).
• Compliance with legal obligations – to meet requirements arising from legal regulations, including tax, accounting, anti-money laundering and terrorist financing (AML/CFT) and the verification of international sanctions lists.
  Legal basis: necessity to fulfil a legal obligation (Article 6(1)(c) GDPR).
• Pursuing and defending claims – to establish, pursue or defend potential legal claims related to the operation of the Platform.
  Legal basis: legitimate interest of the Controller (Article 6(1)(f) GDPR).

04 Data Sharing, Retention and Security

Sharing personal data

Users’ personal data may be disclosed only to the extent necessary and in accordance with the law, to the following categories of recipients:

• Processors – providers of IT, accounting, legal and analytical services (including Google Ireland Limited for Google Analytics and Google Search Console), who process data on behalf of GTradX under data processing agreements.
• Other Portal users – to the extent necessary to complete transactions carried out through the Platform (e.g. seller/buyer contact details).
• Public authorities – if such an obligation results from mandatory provisions of law.
• Business partners – only where the user has given explicit consent for such sharing.

Transfer of data outside the EEA

In connection with the use of tools such as Google Analytics, users’ personal data may be transferred to third countries outside the European Economic Area (EEA), in particular to the United States. In such cases, the Controller ensures an adequate level of data protection by applying appropriate legal safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

Period of storage of personal data

Personal data is stored for the period necessary to achieve the purposes for which it was collected and no longer than is required by law:

• General processing: for no longer than is necessary for the purposes for which the data is processed (Article 5(1)(e) GDPR).
• Tax and accounting obligations: 5 years from the end of the calendar year in which the tax payment deadline expired.
• AML/CFT obligations: 5 years from the date of termination of the business relationship with the customer or from the date of an occasional transaction.
• Sanctions list verification: for the period necessary to demonstrate due diligence and compliance with international and national regulations.
• Pursuing and defending claims: for the entire period during which claims may be pursued or defended, including the duration of court and enforcement proceedings and possible appeal periods.

After the expiry of the relevant storage period, personal data is either permanently deleted in a manner that prevents identification of the data subject, or anonymised if further processing is necessary exclusively for statistical, analytical or archival purposes in the public interest.

Security measures

GTradX uses appropriate technical and organisational measures to ensure the protection of personal data against unauthorised access, loss, destruction or damage. These measures are regularly reviewed and updated to maintain an adequate level of security.

05 User Rights

Every user whose personal data is processed by GTradX has the following rights under the GDPR:

• Right of access – to obtain information about the data being processed and a copy of such data.
• Right to rectification – to request the correction of incorrect data or the completion of incomplete data.
• Right to erasure ("right to be forgotten") – to request the erasure of data if there is no legal basis for further processing.
• Right to restriction of processing – to request the restriction of data processing in specific situations provided for in the GDPR.
• Right to data portability – to receive the data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object – to object to the processing of data based on the legitimate interest of the Controller.
• Right to withdraw consent – to withdraw consent to data processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint – to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO) if the user considers that the processing of their personal data violates GDPR provisions.

06 Cookie Policy and Consent

Use of cookies

The www.gtradx.com website uses cookies and similar technologies in order to ensure the correct operation of the Platform and – only after obtaining the user’s explicit consent – for analytical and statistical purposes. Cookies are small text files stored on the user’s device. Some cookies are essential for the functioning of the website, while others are optional and require the user’s consent collected through a Cookie Banner displayed on the first visit.

Categories of cookies

The Controller uses the following categories of cookies:

• Essential cookies (no consent required) – necessary for the proper, secure and uninterrupted functioning of the Platform, in particular for:
  a) maintaining user login sessions,
  b) enabling registration and access to the dashboard,
  c) protecting forms and preventing misuse,
  d) preventing system overload and ensuring service stability,
  e) saving selected interface and theme preferences.
  These cookies do not require user consent.
• Analytical cookies (Google Analytics 4 – consent required) – activated only after the user clicks the “Initialize” button in the Cookie Banner. These cookies collect statistical data on how users interact with the Platform, including:
  a) visited pages and navigation paths,
  b) type of device, operating system and browser version,
  c) approximate geolocation (city/region),
  d) interactions with listings, marketplace components and dashboard features.
  
  Analytical cookies are used exclusively to improve the performance, security, business logic and user experience of the Platform. Google Analytics 4 uses IP anonymisation by default. Data collected using analytical cookies may be transferred to countries outside the EEA, including the United States, under Standard Contractual Clauses (SCCs).

Cookie storage periods

• essential cookies – for the time necessary to maintain the technical operation of the Platform and the user session;
• analytical cookies – in accordance with the retention settings of Google Analytics 4 (currently 14 months), unless the user deletes cookies earlier;
• cookie storing the consent decision – the file gtradx_cookie_consent indicating “accepted” or “rejected”, stored for 180 days.

Managing cookie preferences

The user may at any time:

• accept analytical cookies,
• reject analytical cookies and continue to use the Platform without limitations,
• change their previous decision by clicking the “Cookie settings” button available on the website,
• delete cookies using browser settings.

Analytical cookies are not activated without the user’s explicit consent.

Consent during registration and contact forms

When providing personal data through registration forms or contact forms on the Portal, the user is required to accept the Privacy Policy. This acceptance constitutes a valid consent to the processing of personal data pursuant to Article 6(1)(a) GDPR, where processing is based on consent. This consent is separate from the consent for analytical cookies collected via the Cookie Banner.

Submitting a form without accepting the Privacy Policy is not possible. The current version of the Privacy Policy is always published on this page and may be updated by GTradX; changes take effect from the date of publication.