Privacy Policy

What data we collect, why, and your rights under the GDPR.

Last updated: 2026-04-27 · Data controller: Pikastore Sneaker Trade s.r.o., Czech Republic

1. What we collect

  • Identity: email, display name, optional Discord handle.
  • Tax data (KYC): Company ID (IČO), VAT ID (DIČ), IBAN — encrypted at rest with AES-256 (pgcrypto), only accessible to admins for payout processing.
  • Listings & sales: products you consign with us, prices, photos you upload, and the resulting orders.
  • Audit log: sign-ins, tier changes, and other account-affecting events (10-year retention for tax compliance).
  • Operational telemetry: request IDs, user agent, IP — used for rate-limiting and abuse detection.

2. Why we process it (Article 6 GDPR lawful basis)

  • Contract performance (Art. 6(1)(b)) — listings, sales, payouts, withdrawals.
  • Legal obligation (Art. 6(1)(c)) — Czech tax law requires we keep sales records 10 years.
  • Legitimate interest (Art. 6(1)(f)) — fraud-prevention rate-limiting, audit trail, security monitoring.
  • Consent (Art. 6(1)(a)) — for optional channels (Discord, Slack, SMS notifications) you opt in to in your seller profile.

3. Where data lives

All servers and backups are hosted in the EU (Netcup Germany; Hetzner Storage Box Germany). Photos are served from Cloudflare R2 EU. Email is sent via Resend (EU region). No data leaves the EU for processing under our control.

4. Your rights

  • Access & portability (Art. 15 / 20) — POST /api/v1/gdpr/me/export from your seller portal produces a JSON bundle of every personal-data row tied to your account. One request per 24 h.
  • Rectification (Art. 16) — edit your profile in Settings.
  • Erasure (Art. 17, "right to be forgotten") — POST /api/v1/gdpr/me/delete. Your account is paused for 30 days (recovery window), then identifiers are pseudonymised irreversibly. Listings + sales rows must be retained 10 years for tax purposes (Art. 17(3)(b)).
  • Objection & withdrawal of consent (Art. 21, 7(3)) — toggle channels in Settings → Notifications.
  • Complaint — Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7.

5. Sub-processors

Cloudflare (CDN/DNS, EU), Resend (transactional email, EU), Netcup (hosting, DE), Hetzner (backup, DE), Discord (when you opt in to Discord notifications). When the operator connects Shopify or Zásilkovna for fulfillment, those become processors of the data necessary for those features.

6. Cookies

Strictly-functional cookies only: a session token after sign-in, a CSRF cookie on state-changing requests. No analytics or marketing cookies. No cookie banner is required because we use no non-essential cookies.

7. Contact

Data Protection Officer: privacy@consignthem.com. We respond within 30 days of any GDPR request.