1. Data Controller

The controller responsible for the processing described in this Privacy Policy is:

Xtakes Marketplace SRL
Trading as: Xpress Deals
VAT number: RO52150108
Registered office: Iași, Romania, European Union

Privacy enquiries:
office@xpressdeals.eu

Website:
www.xpressdeals.eu

References in this Privacy Policy to “Xpress Deals”, “we”, “us”, “our” or “the Platform” refer to Xtakes Marketplace SRL and the Xpress Deals service.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

• the Xpress Deals website and its language versions;
• Business Accounts and Business Listings;
• Promotional Deals and assisted publishing services;
• membership purchases, payments and invoices;
• contact forms, email, telephone and customer support;
• newsletters and marketing communications;
• security, analytics and cookie technologies;
• marketplace transactions where such functionality is available.

Xpress Deals operates primarily as a business-to-business platform. However, GDPR continues to apply whenever we process information relating to an identifiable natural person, including company representatives, employees, self-employed professionals, customers, visitors and contact persons.

3. Categories of Personal Data We Process

3.1 Account and identification data

• name and surname;
• username and account identifier;
• login and authentication information;
• role or position within a business;
• information about the authorized business representative;
• account status, membership and permissions.

3.2 Business and professional data

• registered business name and trading name;
• company registration or organization number;
• VAT number and tax status, where applicable;
• registered and operational addresses;
• business category and activity;
• professional licenses, permits or authorizations, where required;
• website and social-media account information;
• business opening hours, location and service area.

3.3 Contact data

• business and personal contact names;
• email addresses;
• telephone numbers;
• postal addresses;
• communication preferences.

3.4 Billing, payment and transaction data

• billing name and address;
• VAT and invoicing information;
• orders, memberships and purchased services;
• payment status, transaction reference and payment method;
• refund, cancellation and dispute information;
• invoices, credit notes and accounting records.

Complete payment-card details are generally processed directly by the relevant payment-service provider and are not stored by Xpress Deals.

3.5 Business Listing and Promotional Deal content

• business descriptions and promotional text;
• logos, photographs, images and other media;
• products, services, prices, discounts and offer conditions;
• contact details selected for public display;
• location and map information;
• content supplied for publication or created with our assistance.

3.6 Communications and support data

• emails and contact-form messages;
• telephone or meeting notes, where relevant;
• support requests and correspondence;
• feedback, complaints and dispute information;
• responses to surveys or requests for platform feedback.

3.7 Technical and usage data

• IP address;
• browser type and version;
• device type and operating system;
• language and time-zone settings;
• approximate location derived from IP address;
• pages visited, links selected and session information;
• referring website or campaign;
• login, security and error logs;
• cookie identifiers and consent preferences.

3.8 Marketing data

• newsletter subscription status;
• marketing preferences and consent records;
• interactions with marketing emails;
• information about the services or categories that may interest the recipient.

4. Sources of Personal Data

We may collect personal data:

• directly from you when you create an account, purchase a service or contact us;
• from an employer, colleague or authorized business representative;
• from a Vendor or customer involved in a marketplace transaction;
• from payment, hosting, security or communication providers;
• automatically through cookies, logs and similar technologies;
• from publicly accessible business sources.

Where a business asks us to create or complete its Business Listing, we may collect relevant business information from publicly available sources, including:

• the business’s official website;
• public Facebook, Instagram, LinkedIn or other social-media pages;
• official business registers;
• public maps and business directories;
• other public sources controlled or used by the business.

We use such information only where it is reasonably relevant to the creation, verification or maintenance of the Business Listing or Promotional Deal.

5. Purposes and Legal Bases for Processing

5.1 Creating and managing accounts and memberships

We process account, contact and business data to create Business Accounts, activate memberships and provide purchased services.

Legal basis: performance of a contract or steps taken at the data subject’s request before entering into a contract.

5.2 Creating and publishing Business Listings and Promotional Deals

We process supplied or publicly available business information to prepare, publish, update and administer Business Listings and Promotional Deals.

Legal basis: performance of a contract and our legitimate interest in providing and maintaining the Platform.

5.3 Processing orders and payments

We process billing, payment and transaction information to accept orders, confirm payment, provide services and manage refunds or disputes.

Legal basis: performance of a contract and compliance with applicable financial and legal obligations.

5.4 Accounting, taxation and regulatory compliance

We process invoices, transactions, VAT information and related records to comply with accounting, taxation, anti-fraud and regulatory obligations.

Legal basis: compliance with a legal obligation.

5.5 Business verification and fraud prevention

We may verify business information, payment activity, account access and published content to prevent fraud, impersonation, misuse and unlawful activity.

Legal basis: our legitimate interests in protecting Xpress Deals, its users, vendors and commercial partners and, where applicable, compliance with legal obligations.

5.6 Customer support and communications

We process contact and correspondence information to answer questions, provide support and resolve technical, billing or contractual issues.

Legal basis: performance of a contract and our legitimate interest in providing effective support.

5.7 Platform security and technical administration

We process technical logs, account activity and device information to secure the Platform, detect misuse, diagnose errors and maintain availability.

Legal basis: our legitimate interests in maintaining the security, integrity and reliability of the Platform and, where applicable, compliance with legal obligations.

5.8 Improving the Platform

We may analyse aggregated or limited usage information to understand how the Platform is used, correct errors and improve functionality and usability.

Legal basis: our legitimate interests in improving our services. Where non-essential cookies or similar technologies are used, the legal basis is consent.

5.9 Direct marketing

We may send relevant communications about Xpress Deals services, memberships, platform updates and business opportunities where legally permitted.

Legal basis: consent or our legitimate interests in communicating relevant B2B services to existing or prospective business contacts, as permitted by applicable law.

You may object to direct marketing or unsubscribe at any time.

5.10 Establishing and defending legal claims

We may retain and use relevant information to establish, exercise or defend legal claims and to respond to authorities or lawful requests.

Legal basis: our legitimate interests and compliance with legal obligations.

6. Our Legitimate Interests

Where we rely on legitimate interests, those interests may include:

• operating and improving Xpress Deals;
• protecting accounts, systems and users;
• preventing fraud and misuse;
• verifying businesses and published information;
• providing effective customer support;
• promoting relevant B2B services;
• maintaining accurate business information;
• protecting our contractual and legal rights.

We consider whether the processing is necessary, proportionate and reasonably expected and whether the interests or fundamental rights of the affected person override our interests.

7. Public Business Information

Business Listings and Promotional Deals are intended to be publicly accessible. Information selected for publication may therefore be visible to website visitors and may be indexed by search engines.

Public information may include:

• business name and category;
• business address and location;
• telephone number and business email;
• website and social-media links;
• names of representatives where expressly supplied for publication;
• photographs, logos and promotional content.

Businesses must avoid submitting private contact information for public display unless the relevant individual has authorized its publication.

Removal from Xpress Deals does not guarantee immediate removal from external search-engine caches or independent third-party services.

8. Mandatory and Optional Information

Certain information is required to create an account, verify a business, issue an invoice, process payment or provide a purchased service.

Where required information is not provided, we may be unable to:

• create or verify the Business Account;
• activate the Business Membership;
• process an order or payment;
• publish a Business Listing or Promotional Deal;
• comply with legal or accounting obligations;
• provide the requested service.

Optional information will be identified as such or may be omitted without preventing access to the core service, unless it becomes necessary for a particular requested feature.

9. Data Sharing and Recipients

We may share personal data only where necessary and lawful with the following categories of recipients:

• payment-service providers, including Mollie where used;
• hosting, content-delivery and infrastructure providers;
• website, database and technical-support providers;
• email, communications and customer-support providers;
• analytics and consent-management providers, where enabled;
• accountants, auditors, legal advisers and compliance partners;
• Vendors or customers involved in a relevant transaction;
• banks, insurers and fraud-prevention partners;
• public authorities, regulators and courts where legally required;
• potential purchasers or advisers in connection with a merger, restructuring, investment or sale of the business.

Service providers receive only the information reasonably necessary for their role and may process it only according to our instructions, their legal obligations or their own stated role as an independent controller.

Where required by law, we enter into data-processing agreements and require appropriate confidentiality, security and data-protection safeguards.

We do not sell personal data.

10. Payment Processing

Payments may be processed by independent payment-service providers such as Mollie.

The payment provider may process:

• payer identity and contact information;
• payment method and transaction information;
• bank or card-related information;
• fraud-prevention and security information.

Payment providers may act as independent controllers for parts of their processing. Their processing is also governed by their own privacy notices and legal obligations.

11. International Data Transfers

We aim to process personal data within the European Economic Area (EEA). However, some service providers or their sub-processors may process information outside the EEA.

Where a restricted international transfer occurs, we use an appropriate transfer mechanism where required, which may include:

• an adequacy decision adopted by the European Commission;
• European Commission Standard Contractual Clauses;
• Binding Corporate Rules;
• another safeguard or derogation permitted by GDPR.

Where appropriate, supplementary technical, contractual or organizational safeguards may also be applied.

Information about the relevant safeguards may be requested by contacting: office@xpressdeals.eu.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the relevant purpose, including contractual, accounting, security and legal requirements.

The following general retention criteria apply:

• Business Account and membership data: while the account or membership is active and for up to three years after closure or the end of the commercial relationship, unless a longer period is necessary.
• Business Listings and Promotional Deals: for the applicable publication or membership period and for a limited archival period after removal.
• Contracts, invoices and accounting records: for the period required under applicable Romanian tax, accounting and commercial law.
• Payment and transaction records: for the period required to complete the transaction, manage disputes and comply with financial and legal obligations.
• Customer-support and contractual correspondence: generally for up to three years after the relevant issue or relationship ends, unless needed for an unresolved dispute or legal claim.
• Security and technical logs: generally for up to twelve months, unless a longer period is required to investigate a security incident, fraud or misuse.
• Marketing data: until consent is withdrawn, an objection is made, the information becomes outdated or the marketing purpose no longer applies.
• Cookie and consent records: for the period described in the Cookie Policy or required to demonstrate consent.
• Legal claims: for the relevant statutory limitation period and until any dispute is fully resolved.

Data may be anonymized instead of deleted where it is no longer reasonably capable of identifying an individual.

13. Cookies and Similar Technologies

Xpress Deals uses cookies and similar technologies for functions such as:

• website operation and account authentication;
• security and fraud prevention;
• remembering language and user preferences;
• payment and checkout functionality;
• analytics and service improvement;
• marketing, where enabled and consented to.

Strictly necessary cookies may be used where required to provide the website or requested service.

Non-essential analytics, personalization or marketing cookies are activated only after valid consent where required by law.

Users may accept, reject or modify non-essential cookie preferences through the cookie-consent tool available on the website.

Further details are available in our Cookie Policy.

14. Direct Marketing

We may send service-related and commercial communications to business contacts where permitted by law.

Service communications concerning an account, order, payment, security issue, membership or requested support are not marketing communications and may be necessary to perform the service.

Marketing recipients may unsubscribe at any time by:

• using the unsubscribe link in the communication;
• changing available account preferences;
• contacting office@xpressdeals.eu.

We may retain limited suppression-list information after an unsubscribe request to ensure that the preference continues to be respected.

15. Automated Decision-Making and Profiling

Xpress Deals does not currently use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

We may use limited automated tools for security, fraud detection, spam prevention, content organization or service recommendations. Where such tools are used, they do not ordinarily constitute automated decision-making within the meaning of Article 22 GDPR.

If this changes, this Privacy Policy will be updated and any additional information or rights required by law will be provided.

16. Data Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction.

Measures may include:

• HTTPS encryption;
• access controls and role-based permissions;
• account-authentication controls;
• security monitoring and logging;
• software and infrastructure updates;
• backups and recovery procedures;
• restricted administrative access;
• contractual confidentiality and data-protection obligations.

No internet service is completely secure. Users are responsible for protecting their credentials and notifying us promptly of suspected unauthorized access.

17. Personal Data Breaches

Suspected personal-data breaches are assessed and managed in accordance with applicable data-protection law.

Where legally required, we will notify the competent supervisory authority and affected individuals within the applicable time limits.

18. Your Data-Protection Rights

Subject to the conditions and limitations established by GDPR, you may have the following rights:

• Right of access – to obtain confirmation and a copy of personal data processed about you.
• Right to rectification – to correct inaccurate or incomplete data.
• Right to erasure – to request deletion where the legal conditions apply.
• Right to restriction – to request limited processing in certain circumstances.
• Right to data portability – to receive certain data in a structured, commonly used and machine-readable format.
• Right to object – to object to processing based on legitimate interests.
• Right to object to direct marketing – at any time and without providing a reason.
• Right to withdraw consent – at any time, without affecting the lawfulness of processing performed before withdrawal.
• Rights relating to automated decisions – where Article 22 GDPR applies.
• Right to lodge a complaint – with a competent supervisory authority.

These rights are not absolute. A request may be refused or limited where permitted by law, including where data must be retained for legal obligations, fraud prevention or the establishment, exercise or defence of legal claims.

19. How to Exercise Your Rights

Requests may be submitted to:

office@xpressdeals.eu

Please describe the request clearly and identify the account, business or interaction concerned.

We may request reasonable information necessary to confirm identity and prevent unauthorized disclosure.

We normally respond within one month. This period may be extended where permitted by GDPR for complex or numerous requests, in which case the requester will be informed.

Requests are generally handled free of charge. A reasonable fee may be charged, or a request may be refused, where it is manifestly unfounded or excessive, as permitted by GDPR.

20. Complaints to a Supervisory Authority

You may lodge a complaint with the Romanian supervisory authority:

National Supervisory Authority for Personal Data Processing (ANSPDCP)

Website: www.dataprotection.ro

You may also contact the competent data-protection authority in the EU or EEA country where you habitually reside, work or believe an infringement occurred.

We encourage you to contact us first so that we have an opportunity to address the issue directly.

21. Third-Party Websites and Services

Xpress Deals may contain links to business websites, social-media pages, payment services and other third-party websites.

We are not responsible for the privacy practices of independent third parties. Users should review the relevant third party’s privacy notice before submitting personal data.

22. Children

Xpress Deals is a business platform and is not directed at children.

Business Accounts and paid business services may be created or purchased only by persons legally authorized to act for the relevant business.

We do not knowingly collect personal data directly from children for the purpose of creating Business Accounts or Business Listings.

23. Changes to This Privacy Policy

We may update this Privacy Policy to reflect legal, technical, operational or commercial changes.

The current version will be published on this page with an updated revision date.

Where required by law or where a change materially affects individuals, we may provide additional notice through the Platform or by email.