Privacy Policy

1. Data controller

The website spotbuy.eu and its related pilot programme are operated by the founders of the spotbuy.eu initiative (referred to as “we”, “us”, or “our”). Registration of the operating legal entity is currently pending. Until that entity is registered and formally assumes responsibility for the processing, the founders operating the initiative act as the joint controllers for the personal data described in this notice.

For questions about data protection, to exercise your GDPR rights, or to request deletion of your data, contact our privacy representative at partner@spotbuy.eu.

The identity of the individual founder or founders acting as controllers is available to data subjects on request through the privacy contact above. This section will be updated with the registered entity’s legal identity and contact details once incorporation is complete.

2. Personal data we process

• Enquiry data: your name, corporate email address, message, and submission details when you apply for pilot access.
• Technical data: IP address, browser and device information, request time, and security logs generated when the site is delivered.
• Consent data: your analytics preference and the date it was saved in your browser.
• Analytics data: page views, interactions, approximate location, device and browser information when you consent to Google Analytics.

We do not use this website to make decisions about you by solely automated means, and we do not intentionally request special-category personal data.

3. Why we use data and our legal bases

You may withdraw analytics consent at any time through Cookie settings. Withdrawal does not affect processing that occurred before withdrawal.

4. Service providers and recipients

We disclose data only where needed to operate this website and respond to enquiries:

• Netlify: hosts and delivers the site and processes form submissions and associated technical data on our behalf.
• Google Analytics: receives analytics information only after consent. We disable Google signals and advertising-personalisation signals in the site configuration.
• Professional advisers and authorities: where reasonably necessary to establish or defend legal claims or comply with law.

We do not sell personal data.

5. International data transfers

Netlify and Google may process data outside the European Economic Area. Where this occurs, transfers must rely on a valid GDPR transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. You may contact us for more information about the safeguards relevant to your data.

6. How long we keep data

• Enquiries are kept for up to 12 months after the last meaningful contact, unless a business relationship begins or law requires longer retention.
• Security and delivery logs are retained only for the period needed for security, troubleshooting, and service operation, subject to our hosting provider’s configured retention.
• Your cookie preference is requested again after 180 days.
• Google Analytics cookies are configured to expire after no more than 395 days. Analytics event data should be configured in Google Analytics for the shortest available retention period appropriate to the site. Aggregated reports may be retained longer where they no longer identify a visitor.

Data may be kept longer where necessary to establish, exercise, or defend legal claims.

7. Your data-protection rights

Depending on the circumstances, you may ask us to:

• give you access to your personal data and a copy of it;
• correct inaccurate or incomplete data;
• delete your data;
• restrict how your data is used;
• provide data you supplied in a portable format;
• object to processing based on legitimate interests; and
• withdraw consent at any time.

Contact partner@spotbuy.eu to exercise a right. We may need to verify your identity and normally respond within one month.

8. Questions and complaints

Please contact us first if you have a privacy concern. You also have the right to complain to the data-protection authority in the EU/EEA country where you live, work, or believe an infringement occurred. A list of authorities is available from the European Data Protection Board.

9. Changes to this notice

We may update this policy when our services or legal obligations change. The date at the top shows the latest revision. Material changes affecting consent are presented to you again where required.