Privacy Policy
1. General
We take your privacy extremely seriously. All data will be collected, stored, and used by Stuudje in accordance with the General Data Protection Regulation No. 2016/679 (“GDPR”), other statutory regulations. The services offered by us via the App and Website (jointly "Platform") can function only if we collect, store, transfer, delete, and/or otherwise use ("collect and use") specific data relating to you. Personal data means all information relating to an identified or identifiable natural person such as your name, date of birth, address, or email address.
This Privacy Policy describes which of your data we collect and for what purposes we collect and use it when you use the services offered by us on the Platform. This Privacy Policy also contains important information on the protection of your data, especially the statutory rights you have in connection with it.
Under applicable data protection laws, Stuudje is obligated to inform you about data processing and Stuudje fulfills this obligation within this Privacy Policy. This Privacy Policy and any parts of it are not meant as contractual clauses and do not become part of the general Terms and Conditions ("GTC") as a contract that is concluded with registered users.
Under applicable data protection laws, Stuudje can process data that is necessary for the performance of a contract with you or necessary for taking steps at the request of you prior to entering into a contract (Art. 6 (1) (b) GDPR). References to the GTC should at all times be understood as information on data processing (Art. 13 and 14 GDPR) and never as clauses that become part of the GTC. By using the Platform and our services, you enter into a legally binding contract between you and Stuudje conditions of which are described in the GTC.
2. Right of amendment
As we are constantly developing our services, we reserve the right to change this Privacy Policy at any time subject to the applicable regulations. Any changes will be published promptly on this page. Regardless of the aforementioned, you should check this page regularly for any updates.
3. Why and how do we collect and use your data?
3.1. To enable you to use the Platform, allow us to provide our services and perform our GTC
We collect and use your personal data to allow you to use our Platform, to provide our services, and to perform a contract (GTC) with you and especially to undertake commercial transactions via the Platform, or to leave reviews and communicate with other members. To use these services, you need a Stuudje account. For this purpose, you must register as a member of the App.
Most of your personal data is required to perform a contract (GTC) with you. In case you do not provide us with this personal data, we will not be able to conclude and execute a contract (GTC) with you. Part of your data is required to fulfill our legal obligations when you are a member of our Platform. In case you do not provide us with this personal data, we will not be able to comply with legal requirements and provide our services.
This data is also used for the improvement of the Platform in order to make it a better experience for our members.
Stuudje collects your personal data to allow you to use our Platform, to provide our services, and to perform a contract (GTC) with you and keeps it for as long as we keep your Stuudje account - for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.1.1. To enable registration on the Platform
When you register as a member on the Platform, you must provide the following data in order to carry out the registration procedure and access your Stuudje account:
First Name and Last Name
Mobile Number
E-mail
Password
Facebook or Google+ profile (optional)
Legal basis for the collection and use of data is the performance of a contract (GTC) to which you are a party or in order to take steps at your request prior to entering into a contract (GTC) (Art. 6 (1) (b) of the GDPR).
Personal data collected and used for this purpose are kept for as long as we keep your Stuudje account – for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
We would like to point out that when you use the services of Facebook or Google+ through Stuudje, these parties also gain access to some of your personal data on our platform. These external parties apply their own terms of use and privacy conditions. We advise you to read these conditions carefully. Stuudje is not responsible for this and does not have control over this.
3.1.2. To enable you to set up your profile information
If you decide to add profile details to the account you create on the Platform, we collect and use the following data when you choose to provide it:
Full name;
Profile photo;
Your wishlist.
Your profile photo is visible to other visitors of the Platform, but the remainder of the data entered by you is not visible.
Legal basis for such collection and use is your consent (Art. 6 (1) (a) of the GDPR).
Personal data collected and used for this purpose are kept for as long as we keep your Stuudje account – for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.1.3. To enable you to list your items
If you list products on the Platform to your wish list, we will collect and use the following data for the purpose of creating listings on the Platform (list of required information differs depending on the chosen item category):
Product title;
Product description;
Product category;
Product condition;
Product photos;
ISBN (when you sell or lend out books).
Legal basis for such collection and use is your consent (Art. 6 (1) (a) of the GDPR).
Personal data collected and used for this purpose are kept for 18 months and 7 days of inactivity. Photos are kept for 3 months after the item is deleted.
3.1.4. To enable notifications for you
When you are a registered member of the Platform, we will provide you with notifications regarding your activity on the forum and other important messages.
Legal basis for the collection and use of data is the performance of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data collected and used for this purpose are kept for as long as we keep your Stuudje account – for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.1.5. To enable you to communicate with other members
If you communicate with other members on the Platform, we collect and use the following data:
Name of the member you are communicating with;
Messages;
Date and time of messages;
Shared photos;
Your device;
Other data submitted in messages.
Legal basis for the collection and use of data is the performance of a contract (GTC) to which you are a party (Art. 6 (1) (b) of the GDPR).
Personal data collected and used for this purpose are kept for as long as we keep your Stuudje account – for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.1.6. To enable you to post in the communities
The Stuudje Communities is where all communities can be found. You can create new communities or post content in communities if you are a member of that community. We collect and use the following data which you voluntarily submit on the Platform:
1. Your member name;
2. Your picture;
3. Your created community topics;
4. Your community posts;
5. Photos shared in your post;
6. Date and time of your post;
7. Your device.
Legal basis for such collection and use is your consent (Art. 6 (1) (a) of the GDPR).
You can delete your own community topics and posts at any time.
Personal data collected and used for this purpose are kept for as long as we keep your Stuudje account – for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.1.7. To send you important communication regarding the Platform
If you register on the Platform, we will send you e-mails and messages via the Platform’s messaging system for the purpose of providing important notifications e.g. GTC, Privacy Policy changes.
Legal basis for the collection and use of data is the performance of a contract (compliance with our GTC) to which you are a party (Art. 6 (1) (b) of the GDPR) and compliance with the legal obligations to which Stuudje is subject (Art. 6 (1) (c) of the GDPR).
Personal data collected and used for this purpose are kept for as long as we keep your Stuudje account – for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.1.8. To provide you with our support service
If you send us a query, request, or complaint, we will collect and use the following data for the purpose of providing you with the customer support services you request on the Platform.
Your profile information;
Platform usage information;
Communications;
IP address;
Open text field with your question or message to us.
The type of information we collect can vary depending on your inquiry. We process this personal data to answer your question or respond to your message, contact you as part of the processing of your question, and to be able to analyze the most common questions to improve our service.
Legal basis for the collection and use of data is the performance of a contract (compliance with our GTC) to which you are party (Art. 6 (1) (b) of the GDPR) and the legitimate interest in improving the service of Stuudje for our members and Stuudje (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for 2 years.
3.1.9. To resolve any purchase-related disputes between members
If you purchase and/or sell and/or lend out items on the Platform and get involved in a dispute with another member, we will collect and use any of your personal data held by Stuudje necessary to solve the dispute.
We base such collection and use on a legitimate interest to settle disputes between our members and defend the rights and interests of Stuudje (Art. 6 (1) (f) of the GDPR) and, where relevant, compliance with the legal obligations to which Stuudje is subject (Art. 6 (1) (c) of the GDPR).
Personal data collected and used for this purpose are kept for 1 year after a dispute is concluded.
3.1.10. Other
We may also process your personal data for the following purposes:
• For the execution of business processes, management reporting, and internal management. The legal basis for this is our legitimate business interest (Art. 6 (1) (f) of the GDPR).
• To combat and prevent fraud and/or abuse of Stuudje and to protect the position of Stuudje and/or third parties. The legal basis for this is our legitimate business interest (Art. 6 (1) (f) of the GDPR).
• To ensure the security and stability of IT systems. The legal basis for this is our legitimate business interest (Art. 6 (1) (f) of the GDPR).
3.2 To improve your experience when using our Platform
3.2.1. To improve our Platform
Stuudje is committed to the best performance of the Platform. When the Platform is being used, Stuudje gathers information about actions performed on the Platform (button clicks, visiting time, notifications read, and other information depending on a particular business case) in order to help us make decisions on how to improve the Platform and make it a better experience for our members.
Legal basis for such collection and use is our legitimate interest to maintain performance and improve the Platform (Art. 6 (1) (f) of the GDPR).
Stuudje collects and uses your personal data for this purpose for as long as we keep your Stuudje account - for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.3. To ensure the security of your Account and the Platform
Stuudje strives to ensure that the accounts of our members and the Platform itself would be secure and protected from cyber attacks, unauthorized access, and other related risks.
3.3.1. To track visits to the Platform for security purposes
When you connect to the Website or App, we collect and use the following data (logfiles), even if you are not logged in to the Website as a member:
IP address of your device;
Browser used by your device;
Content and URLs you connect to;
Date and time of your connections.
In the event of access via mobile devices, the following log files are also captured as part of your use of the Stuudje App:
Model and manufacturer of your mobile device;
Operating system used by your mobile device (iOS, Android).
This data is used for security purposes, especially the prevention of cyberattacks such as data scraps and denial of service attacks and for preventing impermissible multiple applications.
Legal basis for such collection and use is our legitimate interest to protect the Platform and ensure its security and the legitimate interest of our members to ensure the safety of their accounts on the Platform (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for 3 months.
3.4. To supervise compliance with and enforce GTC
Stuudje actively supervises compliance with and enforces GTC for the purpose of ensuring the security of your account and the Platform.
3.4.1. To moderate your activity on the Platform
In order to ensure the security of the Platform and its members we regularly moderate your activity on the Platform. We may check your comments, and messages when we receive other members’ or third party’s reports.
If you communicate with another Stuudje member via private messages and either you or another member sends us a report or escalates a transaction, we collect and use information contained in your communication to check for a potential violation of our GTC.
Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).
Stuudje collects and uses your personal data for this purpose for as long as we keep your Stuudje account - for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.4.2. To issue and enforce warnings
If you as a member violate our GTC or take other actions that result in a warning being issued to you, we collect and use the following data to issue and enforce the warning:
Username;
Kind of warning received by member;
Date of warning received by member.
Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).
Stuudje collects and uses your personal data for this purpose for as long as we keep your Stuudje account - for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.4.3. To delete or hide items that violate Stuudje GTC
If you list items that violate our GTC, we will remove or hide them. However, we will retain deleted listings as proof of the violation. For this purpose, Stuudje uses personal data included in the listing as specified under 3.1.3.
Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).
Deleted listings are kept for 30 days after their removal.
3.4.3. To enforce bans
If you violate Stuudje GTC in a way that results in you getting banned, we will use your ban reason, time and your profile data.
Legal basis for such collection and use is our legitimate interest to protect the Platform and its users and ensure its security and the legitimate interest of our members to ensure their safety on the Platform (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for 3 months from the moment you have been blocked.
3.5. For legal purposes
3.5.1. To handle your requests related to personal data
If you use your statutory rights regarding your data (see 6 below), we will collect and use the data contained in your request in addition to any other personal data held by Stuudje for the purpose of examining the request, responding to it, and, when necessary, taking necessary action.
In order to respond to requests, Stuudje provides your data to service partners who consult us on questions of data protection law.
We base such collection and use on a legitimate interest to exercise our members’ rights (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for two years from the day we respond to your request.
3.5.2. To provide information to law enforcement and other state institutions
If we have reasonable grounds to suspect that you are involved in illegal activities, we will collect and use the necessary data of your profile data (see 3.1), data related to your activities on the Platform (see 3.2) and data collected and used for security purposes (see 3.3 and 3.4) in order to notify the law enforcement and other state institutions.
Stuudje also provides the aforementioned data to law enforcement and other state institutions when we receive requests for information in relation to investigations carried out by these institutions.
This is necessary in order to comply with the legal obligations to which Stuudje is subject (Art. 6 (1) (c) of the GDPR).
Personal data are required to fulfill our legal obligations when you are a member of our Platform. In case you do not provide us with this personal data, we will not be able to comply with legal requirements.
Stuudje collects and uses your personal data for this purpose for as long as we keep your Stuudje account - for 3 months from the date of deletion of your Stuudje account or for 5 years and 3 months of inactivity on your account.
3.5.3. To defend the rights and interests of Stuudje
If you get involved in a dispute with Stuudje or we need to carry out enforcement of our GTC or otherwise defend, enforce, exercise, and uphold our rights, we will collect and use all of your personal data held by Stuudje to the extent necessary to resolve a particular situation.
We base such collection and use on a legitimate interest to defend the rights and interests of Stuudje (Art. 6 (1) (f) of the GDPR).
Personal data collected and used for this purpose are kept for 1 year following the moment we became aware of the aforementioned circumstances or for the duration of a dispute or legal proceedings, depending on which one of these periods is longer.
4. Recipients of personal data
4.1. Sharing internally
Stuudje shares your personal data internally only with employees who are authorized to have access to your details when this is necessary for their work.
4.2. Third parties
In addition, as part of the outsourcing of certain activities, we may share personal data with external parties, so-called processors, with whom we have concluded processing agreements and who may not use your data for their own purposes. Stuudje transfers or shares personal data with service providers only insofar as necessary and allowed in accordance with applicable laws.
Some external parties are independently or jointly responsible with Stuudje for the processing of your personal data, for example, if you create an account there (e.g. Facebook). We also conclude agreements with these parties about the careful processing of your data.
Inter alia the following external parties have access to (a part of) your data:
Payment providers
Social media providers
Ad networks
Software suppliers for analysis purposes
Providers of communication software
Suppliers of stability software for Stuudje
4.3. Other
We may provide your personal data to other parties that we need within the framework of our services, such as lawyers or bailiffs. For the rest, we only provide data to third parties with your consent or if we are required to do so by law or regulation, we are forced to do so as a result of legal proceedings and/or in the event that we consider it necessary to protect our own interests and/or the interests of third parties.
5. Use of the Platform and Cookies
When you visit our Platform, small text files are stored on your computer, smartphone, or other device. These files are called “cookies”.
6. Your statutory rights regarding your data
6.1. What rights do you have?
Subject to conditions, limitations, and exceptions established by statutory data protection provisions, you have the right at any time:
• to be informed of the data we collect and use and to request access or demand a copy of the data concerned (right to access). All the data that you have actively provided for us on the Platform (3.1, 3.5, and 3.6), can also be accessed by you at any time in your Stuudje account;
• to demand the correction of inaccurate data and, subject to the nature of the collection and use, the completion of incomplete data (right to rectification). All the data that you have actively provided us with on the Platform (3.1, 3.5, and 3.6) can also be amended by you yourself at any time in your Stuudje account (except sent messages and any forum posts or reviews);
• subject to just cause, to demand the deletion of your data (right to deletion);
• to demand restriction of the collection and use of your data, provided the statutory criteria are met (right to restrict processing);
• subject to the statutory criteria being met, to receive the data you have provided in a structured, current, and machine-readable form and to transfer this data to another data controller or, where technically feasible, to have it transferred by Stuudje (right to data portability);
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects on you, unless the statutory conditions for such automated decision-making are met;
• to object to the collection and use of data – only where the collection and use are based on a task carried out in the public interest or in the exercise of official authority vested (Art. 6 (1)(e) of GDPR) or legitimate interest (Art. 6 (1)(f) of GDPR), including profiling, based on the same data collection and use grounds as explained in other sections of this statement (right to object). You also have the right to at any time object to the collection of your personal data for direct marketing purposes;
• to withdraw at any time any permission you have provided to us. Such withdrawal will not affect the lawfulness of the collection and use carried out prior to withdrawal and based on the permission granted;
• not to receive discriminatory treatment while exercising your rights.
We take the protection of personal data seriously and Stuudje takes appropriate measures to prevent misuse, loss, authorized access, unwanted disclosure, and unauthorized modification. In addition, you can take the following measures yourself to secure your account:
Use a strong password;
Inform us of changes in your personal data or incidents concerning your personal data in a timely manner;
Be careful when disclosing personal information about yourself in your public account, via social media and through messages;
Log out after your visit to our website when using a public computer.
You can submit a request to exercise the above rights by contacting us. We aim to respond within four weeks of receiving the request. Regardless of any other legal remedy, you also have the right at any time to submit a complaint to the supervisory authorities.
6.2. How will you verify my request?
Your request must provide sufficient information that allows us to reasonably verify you are the person or an authorized representative of a person whose personal data we have collected (name, surname, your public profile URL, your e-mail, other information we may request for verification purposes), describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it, provide a confirmation under a penalty that you are the individual whose personal data is the subject of the request. If your request is submitted by an authorized agent, a written permission and information that verifies the identity of the agent must be enclosed with the request. We cannot provide you with the information or exercise your other right if we cannot verify your identity or authority to make the request and confirm the information relating to you. In order to verify your identity, we may request you to provide additional information about yourself. We will only use this information and information provided in the request to verify your identity or authority to make the request.
7. Our contact details
The controller is Stuudje V.O.F., with registration number of Chamber of Commerce: 81401116. If you have any queries regarding the collection and use of your data as part of your use of the Platform, or regarding your rights, please contact us.