Privacy policy

Data controller

The controller of your personal data for the marketplace service is:

What personal data we collect

Depending on how you use the site, we process: your name and surname where you provide them; username; email address; telephone number if you enter it; delivery and billing address; company name and registration / VAT identifier when you buy or sell as a business; IP address and technical logs (such as device/browser type and timestamps) needed for security and fraud prevention; order and purchase history; messages you exchange with buyers or sellers through the platform; and content you upload (for example product images or dispute evidence). Payments are processed by Stripe — we do not store your full card number on our servers; Stripe processes card and payment data according to its own documentation.

Legal basis for processing

We process personal data: (1) to perform a contract with you or to take steps before a contract — for example to operate your account, process orders, arrange delivery, and handle returns and disputes; (2) where required by law — including issuing and retaining invoices and accounting records (in Lithuania, accounting source documents are generally retained for 10 years unless a different period applies); (3) where necessary for our legitimate interests — such as ensuring platform security, preventing abuse, and improving the service — in a way that respects your rights; and (4) where we rely on your consent, for example for non-essential cookies when applicable.

How long we keep data

We keep account and order data while your account is active and as needed to provide the service. After you stop using the service or delete your account, we may retain certain information for limited periods — for example order and invoice-related data for up to two years after your last purchase in addition to statutory retention (such as the 10-year retention for accounting records where applicable). Technical security logs may be kept for shorter periods required for incident investigation.

Marketplace: sharing data with sellers

Rivoult acts as an intermediary between buyers and sellers. When you place an order, the relevant seller receives the contact and delivery details you provide — including name, delivery (and billing, where applicable) address, telephone number if you entered it, and the information needed to ship the order (such as ordered items). Sellers must use this data only to fulfil your order and related obligations (for example invoicing where required) and must not use it for unrelated marketing unless they have a separate lawful basis.

Recipients and payment processors

We use trusted service providers where necessary. Stripe (Stripe, Inc. and its affiliates as applicable) processes payment transactions, fraud signals, and related financial data; Stripe acts as a payment processor and its processing is described in Stripe’s privacy documentation. We also use hosting, database, and infrastructure providers that store application data, and providers that send transactional email or notifications. If you choose “Accept all” on the cookie banner, technical data (such as IP address, page URL, device/browser information, and event timestamps) may be shared with **Google** (Google Analytics 4, Google Tag Manager) and **Meta** (Facebook Pixel) as separate processors or joint controllers under their documentation. We require processors to respect confidentiality and applicable data protection requirements.

Analytics, tag management, and advertising measurement

When you choose “Accept all” on the cookie banner, the following optional tools may load: **Google Tag Manager (GTM)** — a tag container used to manage measurement scripts; **Google Analytics 4 (GA4)** — statistics on visitors, page views, traffic sources, and (where applicable) purchases; **Meta Pixel (Facebook / Instagram)** — measurement of site visits and conversions (e.g. page views, purchases) for ad optimisation and audiences on Meta platforms. Purposes: understand how the site is used; measure advertising and sales performance; improve the service. Legal basis: **your consent** (GDPR Article 6(1)(a)) for non-essential cookies and similar technologies; if you choose “Essential only”, these tools are not loaded. Data may be processed in the US and other countries — Google and Meta apply their contractual terms and safeguards (such as standard contractual clauses). See our cookie policy for more detail; provider policies: Google (policies.google.com/privacy), Meta (facebook.com/privacy).

Withdrawing consent and controlling analytics

You may withdraw or change consent for non-essential cookies (analytics, Meta Pixel) at any time: use “Cookie settings” in the site footer to reopen the banner, or choose “Essential only”. After withdrawal, new analytics / Meta scripts will not load; cookies already set by providers may remain until they expire or you delete them in your browser. Essential cookies (sign-in, cart, checkout) may still be used because they are required to provide the service.

Your rights

Subject to conditions in the GDPR and local law, you may have the right to access your personal data, rectify inaccurate data, erase data in certain cases, restrict processing, object to processing based on legitimate interests, data portability where applicable, and to lodge a complaint with a supervisory authority (in Lithuania, the State Data Protection Inspectorate). To exercise your rights, contact us using the contact details published on the website.

Cookies

We use essential cookies for sign-in, cart, and core functionality. Non-essential cookies — for analytics (Google Analytics 4, Google Tag Manager) and advertising measurement (Meta Pixel) — are used only after you consent via the cookie banner (“Accept all”). A full list, purposes, and controls are in our cookie policy.

Cookie policy · Terms of use

Changes to this policy

We may update this policy from time to time. We will publish the current version on this page. Material changes may be communicated separately where required by law.