Privacy policy

Version 2026-11

1. Controller and contact details
Data controller: Pawel Jozefczyk (self-employed), NIE X6057848Q, Avenida Tagomago 51, 07660 Cala d'Or (Balearic Islands), Spain. Contact for privacy matters and exercising your rights: pcphonec@gmail.com. No data protection officer has been appointed because the activity does not require one.

2. Data, purposes and legal bases
We process account data (name, email, password protected by hashing, and sessions), listings and photographs, product references and characteristics, the location you provide, favourites, saved searches, conversations, product requests, reports and moderation decisions.

- Providing the service (account, publishing listings, saved searches, favourites, messages and transactions): performance of the contract you accept with the terms of use (Art. 6(1)(b) GDPR).
- Security, prevention of fraud and abuse, content moderation and technical logs: legitimate interest in keeping the portal safe and reliable (Art. 6(1)(f) GDPR).
- Responding to requests from authorities and keeping information required by law: compliance with legal obligations (Art. 6(1)(c) GDPR).
- Web push notifications and optional analytics: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Name, email and password are mandatory: without them an account cannot be created and nothing can be published. You decide on any other data when using each feature. Passwords are never published. Messages are only accessible to their participants through their account.

Your display name and listings may be public. Location is used for proximity search: avoid publishing your home address, telephone numbers, documents or third-party data in texts and photographs. The coordinates you provide are stored with the listing, but public pages and responses show them rounded to two decimal places (about one kilometre); the exact value is only visible to the owner and to moderation, and is used internally to calculate distances. A draft saved in the browser keeps only listing data and photos for seven days from the last edit; it can be discarded without publishing it.

If transactions and reviews are enabled, each participant's confirmation is recorded together with one buyer review, subject to moderation. A two-party confirmation does not prove payment or delivery. Manual reviews of contact or business details show their type and date; the review evidence is kept internal. Do not request or provide copies of identity documents through these forms.

3. Recipients, providers and transfers
Data is not disclosed to third parties unless required by law. The server, database, search engine and backups are hosted on a server contracted from IONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany), which acts as processor under its data processing agreement, in a data centre in the European Union. The search engine runs on that same server and does not send data to third parties.

Web push notifications are optional per device: the endpoint, technical keys, session and preferences are stored; your browser's provider (Apple, Google or Mozilla) carries a generic notice without the message text or the account email. These providers may be located outside the European Economic Area and operate under their own transfer safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses. Analytics is currently not enabled; if it is enabled, Google Analytics 4 will only load after you accept analytics, and this policy and the cookie information will be updated beforehand. Searches, messages, email addresses and private parameters are not sent in measurements.

4. Retention
- Account, listings, favourites, saved searches and messages: while the account is active. After you request closure, they are deleted or anonymised within a maximum of 30 days, except data that must be kept blocked to meet possible legal liabilities, for the applicable limitation periods.
- Reports, moderation decisions, security logs and review evidence: up to 12 months from being recorded, or longer if needed for an open procedure.
- Backups: kept with restricted access and deleted once no longer needed to restore the service, at the latest six months after creation.
- Push jobs are valid for one hour and completed jobs are purged after seven days by maintenance; the browser provider may apply its own periods.

Please also check the periods for cookies and local storage. Account closure is handled on request by email; this version does not include automatic account deletion.

5. Rights and choices
You may request access, rectification, erasure, objection, restriction and portability, and withdraw consent without affecting earlier lawful processing, by writing to pcphonec@gmail.com from your account email. If there is reasonable doubt about your identity, only the information strictly needed to confirm it will be requested. Requests are answered within one month, extendable in the cases provided for by the GDPR. You can turn off notifications in your account and browser, withdraw analytics in Cookie preferences and discard the local draft. You may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es), without prejudice to other competent authorities.

No automated decisions with legal effects are taken and no profiles are built for commercial purposes; the order of search results depends on the filters and text relevance. The service is intended for people aged 18 or over. No age or identity verification is carried out; if we detect an account belonging to a minor, it will be deleted.

Version 2026-11, in force from 10 November 2026.