1. Introduction
Bazarly ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our mobile application and related services, in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the applicable laws of the Republic of Cyprus.
2. Data Controller
The data controller responsible for your personal data is Bazarly Ltd, registered in the Republic of Cyprus. Contact: bazarly@bazarly.app.
We have assessed that our current processing activities do not meet the thresholds requiring a mandatory Data Protection Officer (DPO) under GDPR Article 37. If you have data protection concerns, please contact us directly at the address above.
3. Information We Collect
We collect the following categories of personal data:
- Account information: name, email address, phone number
- Profile information: profile photo, display name
- Listing content: item descriptions, photos, pricing, category
- Communications: messages exchanged with other users through our in-app chat
- Location data: approximate location (city/area level) to display nearby listings — collected only with your consent
- Device and usage data: device type, operating system, IP address, app version, session data, crash reports, and feature interaction data
- Technical identifiers: advertising ID (if applicable), push notification token
We do not collect payment card details, bank account information, or any financial data. Bazarly does not process payments between users.
4. Legal Bases for Processing (GDPR Article 6)
We process your personal data on the following legal bases:
- Performance of a contract (Art. 6(1)(b)): to create and manage your account, enable you to post and respond to listings, and deliver the core platform services
- Legitimate interests (Art. 6(1)(f)): to improve our platform, prevent fraud and abuse, ensure platform security, and send essential service communications — we have assessed that these interests are not overridden by your rights
- Consent (Art. 6(1)(a)): to collect your location data for showing nearby listings; to send promotional and marketing communications; and to use non-essential cookies or analytics trackers — you may withdraw consent at any time
- Legal obligation (Art. 6(1)(c)): to comply with applicable laws, including tax reporting obligations under DAC7 and responses to lawful requests from authorities
5. How We Use Your Information
We use your personal data to:
- Create and maintain your account and provide platform services
- Display your listings to other users and enable you to browse listings
- Facilitate in-app messaging between buyers and sellers
- Send technical notices, security alerts, and support messages
- Monitor and analyse platform usage to improve our services
- Detect, investigate, and prevent fraud, abuse, and policy violations
- Comply with legal obligations, including DAC7 seller reporting requirements
6. Communications
a) Essential Communications (cannot be opted out of while account is active)
- Account verification (OTP messages)
- Password resets and security notifications
- Customer support responses
- Notifications regarding your account, listings, or activity
- Messages or contact requests from other users related to your listings
Legal basis: performance of contract (Art. 6(1)(b)). These communications are necessary to provide the service. To stop receiving them, you must delete your account and remove your listings.
b) Promotional Communications (optional)
- Marketing emails and promotional offers
- Product updates and announcements
Legal basis: consent (Art. 6(1)(a)). You may opt out at any time by using the unsubscribe link in the email or adjusting your account notification settings.
7. Cookies and Tracking Technologies
We use the following types of cookies and similar technologies:
- Strictly necessary: required for the platform to function (session management, security). No consent required.
- Analytics: help us understand how users interact with the platform (e.g., usage frequency, feature adoption). Used only with your consent.
- Functionality: remember your preferences such as language selection. Used on the basis of legitimate interest or consent depending on the type.
You can manage cookie preferences through your device settings or browser. Withdrawing consent for non-essential cookies does not affect the lawfulness of processing carried out before withdrawal.
8. Information Sharing
We share your personal data only in the following circumstances:
- With other users: your public profile, listings, and contact information shared for the purpose of facilitating communication about a listing are visible to other registered users
- With service providers: we engage third-party providers for hosting, analytics, customer support, and push notifications — these providers act as data processors and are bound by data processing agreements
- For legal compliance: when required by law, court order, or regulatory authority, or where necessary to protect the rights, safety, or property of Bazarly, our users, or others
- With your explicit consent: for any other purpose you specifically agree to
- Business transfers: if Bazarly is involved in a merger, acquisition, or sale of assets, your data may be transferred — we will notify you before your data becomes subject to a different privacy policy
We do not sell your personal data to third parties.
9. International Data Transfers
Some of our service providers operate outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, which may include:
- Standard Contractual Clauses (SCCs) approved by the European Commission (2021 version)
- Transfers to countries that have received an EU adequacy decision
You may request details of the safeguards applicable to your data by contacting us at bazarly@bazarly.app.
10. Data Retention
We retain personal data for as long as necessary for the purposes described in this policy and to comply with legal obligations. Indicative retention periods:
- Account data: for the duration of your account plus up to 12 months after deletion (to handle post-deletion queries or disputes)
- Listing content: for the duration the listing is active; removed listings are purged within 30 days unless subject to a legal hold
- Chat messages: retained for up to 12 months from the date of exchange
- Usage and device data: up to 24 months from collection, in aggregated or pseudonymised form where possible
- Legal and compliance records: as required by applicable law (e.g., tax records for up to 7 years under Cyprus law)
11. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): request a copy of the personal data we hold about you
- Right to rectification (Art. 16): request correction of inaccurate or incomplete data
- Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"), subject to legal retention obligations
- Right to restriction (Art. 18): request that we limit how we use your data in certain circumstances
- Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interests
- Right to withdraw consent: withdraw consent at any time for processing based on consent, without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at bazarly@bazarly.app. We will respond within 30 days. You may also delete your account and associated data directly within the app.
12. Automated Decision-Making and Profiling
We do not make decisions about you that produce legal or similarly significant effects solely by automated means. We may use automated tools to detect suspicious activity or policy violations, but any account action resulting from such detection is reviewed by a human before being applied.
13. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS), access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by GDPR Article 34.
14. Children's Privacy
Our services are not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18 without appropriate consent, we will take steps to delete it promptly. If you believe we hold data about a child, please contact us at bazarly@bazarly.app.
15. Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the supervisory authority in your country of residence. In Cyprus, the competent authority is:
- Commissioner for Personal Data Protection
- 1 Iasonos Street, 1082 Nicosia, Cyprus
- Website: www.dataprotection.gov.cy
- Email: commissioner@dataprotection.gov.cy
We would, however, appreciate the opportunity to address your concerns before you approach the regulator, so please contact us first.
16. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you by email or in-app notification at least 15 days before the new policy takes effect. The "Last updated" date at the top of this page reflects the most recent revision.
17. Contact Us
For questions, requests, or concerns about this Privacy Policy or how we handle your data: