Privacy Policy | PrintExchange

1. Data Controller

The data controller responsible for processing your personal data is PrintExchange.eu. You may contact us at any time via our support channels regarding your data rights. As a B2B marketplace operating within the EU, we process personal data under lawful bases including contract performance (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR), legal obligation (Art. 6(1)(c) GDPR), and where required, consent (Art. 6(1)(a) GDPR).

2. Data We Collect

We collect the following categories of personal and business data:

Account Data: Full name, business email address, company name, VAT number, billing address, and role (agency or print vendor).
Transactional Data: Inquiry details, bid amounts, awarded contracts, payment references, shipping addresses, and order history.
Communication Data: Messages exchanged through the in-platform messaging system between agencies and vendors.
Technical Data: IP address, browser type and version, time zone, operating system, device type, and session identifiers.
Cookie & Analytics Data: Usage patterns, page interactions, and performance metrics collected via cookies. See our Cookie Policy for details.
Uploaded Files: Print-ready artwork files and proof documents uploaded to the platform.

3. How We Use Your Data

We process your personal data for the following purposes:

✓Platform account registration and management

✓Facilitating inquiry posting, bidding, and awarding

✓Processing payments and escrow transactions

✓EU VAT validation and invoice generation

✓White-label order fulfillment coordination

✓Dispute resolution and mediation

✓Platform security and fraud prevention

✓Service improvement and analytics

✓Legal compliance and record-keeping

✓Communication regarding your transactions

4. Data Sharing & Third Parties

We never sell your personal data. We share data only with trusted third parties strictly necessary to operate the platform:

Payment Processors (Stripe): To process escrow payments and disbursements. Stripe's own Privacy Policy applies to payment data.
Cloud Infrastructure: Our hosting and database providers operate within the EU/EEA and are bound by data processing agreements.
VAT Validation APIs: Business VAT numbers are validated against the official EU VIES database (European Commission).
Legal Authorities: We may disclose data to competent authorities when required by EU law or court order.
Counterparty (limited): Anonymized vendor identifiers are shown to agencies; shipping addresses are shared with awarded vendors only after payment.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide services. Transaction records (invoices, contracts) are retained for 7 years to comply with EU financial and tax regulations. After account deletion, most personal data is deleted within 30 days, except where legal retention obligations apply.

6. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

Right of Access (Art. 15)

Request a copy of all personal data we hold about you.

Right to Rectification (Art. 16)

Correct inaccurate or incomplete personal data.

Right to Erasure (Art. 17)

Request deletion of your data where no legal basis for retention exists.

Right to Restriction (Art. 18)

Restrict how we process your data in certain circumstances.

Right to Portability (Art. 20)

Receive your data in a structured, machine-readable format.

Right to Object (Art. 21)

Object to processing based on legitimate interests.

To exercise any of these rights, contact us through the platform support. You also have the right to lodge a complaint with your national data protection authority (e.g., your local DPA).

7. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. All data is transmitted over HTTPS/TLS encryption. Access to personal data is restricted to authorized personnel on a need-to-know basis.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-platform notification at least 30 days before the changes take effect.