PRIVACY POLICY
Scent.to Marketplace
Version 1.0 [Date]
1. INTRODUCTION
1.1. This Privacy Policy (hereinafter – the "Policy") describes how SIA "SVZ Ventures and Services", operating the online marketplace under the name Scent.to, registration No. 40203722530, Vecmīlgrāvja 1. līnija 37–45, Rīga, LV-1015 (hereinafter – "Scent.to", "we", "us" or "our") collects, uses, stores and shares personal data in connection with the operation of the Platform.
1.2. Scent.to acts as the data controller in respect of personal data processed in connection with the operation of the Platform. This means that Scent.to determines the purposes and means of processing personal data collected through the Platform.
1.3. This Policy applies to all Users of the Platform, including visitors, registered users, Buyers and Sellers. It should be read together with the Terms and Conditions and any other applicable Platform Policies.
1.4. By accessing or using the Platform, creating an account or otherwise interacting with Scent.to, Users acknowledge that their personal data will be processed in accordance with this Policy.
1.5. This Policy is governed by Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) and the personal data protection laws of the Republic of Latvia. Where applicable EU or Latvian law provides additional protections, those protections apply.
2. DATA WE COLLECT
2.1. Scent.to collects personal data in the following categories depending on how a User interacts with the Platform:
Account and registration data:
(a) full name;
(b) email address;
(c) date of birth (self-declared at registration);
(d) country of residence;
(e) account login credentials (stored in encrypted form).
Seller-specific data:
(a) bank account details provided for payout purposes;
(b) identity verification information collected to satisfy Know Your Customer obligations, including copies of identity documents where required by the PSP;
(c) VAT registration number where disclosed by the Seller;
(d) transaction history and sales activity data, including aggregate sales amounts required for DAC7 reporting.
Transaction data:
(a) details of Listings created, orders placed and Transactions completed;
(b) payment information processed by the PSP — Scent.to does not store full payment card details, which are processed exclusively by the PSP;
(c) delivery addresses provided in connection with orders;
(d) dispute and returns history.
Verification and product data:
(a) photographs of products submitted by Sellers for listing purposes;
(b) photographs taken by Scent.to during the Verification process, stored in private cloud storage accessible only to platform administrators;
(c) condition assessments and Verification records associated with each Transaction.
Communications data:
(a) messages submitted through the Platform's support or messaging functionality;
(b) complaint submissions and dispute communications;
(c) email correspondence with Scent.to.
Technical and usage data:
(a) IP address and device information;
(b) browser type and operating system;
(c) pages visited, time spent on the Platform and navigation patterns;
(d) session data collected through authentication cookies.
2.2. Scent.to does not intentionally collect special categories of personal data (such as health data, racial or ethnic origin, political opinions or biometric data) in connection with the operation of the Platform. Users should not submit such data through the Platform.
2.3. Where a User provides personal data relating to another person (for example, a delivery address for a third party), the User confirms that they have the right to provide such data and that the relevant individual has been informed of this Policy.
2.4. Minor users. Scent.to does not knowingly collect personal data from persons under eighteen (18) years of age acting independently. Where a minor uses the Platform as a Buyer through a parent or legal guardian in accordance with the Terms and Conditions, the personal data of the minor is processed on the basis of the guardian's acceptance of the Terms and Conditions and this Policy. Parents or guardians may contact privacy@scent.to to request access to or deletion of data associated with a minor's use of the Platform.
2.5. Mandatory and voluntary data. Provision of account registration data — including name, email address and country of residence — is required to create an account and access the Platform. Sellers are additionally required to provide bank account details and identity verification information in order to receive payouts. Failure to provide required data will result in inability to access the relevant features of the Platform. Provision of data for analytics or optional marketing communications is voluntary and does not affect access to core Platform features.
3. LEGAL BASIS FOR PROCESSING
3.1. Scent.to processes personal data on the following legal bases under GDPR Article 6:
Performance of a contract (Article 6(1)(b)):
Processing necessary to provide the Services, including account management, Transaction facilitation, Verification, payout processing and customer support. This basis applies to the majority of data processing activities in connection with registered User accounts and Transactions.
Compliance with a legal obligation (Article 6(1)(c)):
Processing required by applicable law, including:
(a) DAC7 reporting obligations under EU Council Directive 2021/514 — transaction and payout data reported to tax authorities;
(b) anti-money laundering and Know Your Customer obligations applicable through the PSP;
(c) product safety and traceability obligations under GPSR (Regulation (EU) 2023/988);
(d) cooperation with competent authorities as required by the Digital Services Act (Regulation (EU) 2022/2065).
Legitimate interests (Article 6(1)(f)):
Processing necessary for Scent.to's legitimate interests, including:
(a) fraud prevention and platform security;
(b) abuse detection and enforcement of Platform Policies;
(c) improvement of Platform functionality and user experience based on aggregated usage data;
(d) defence of legal claims;
(e) automated analysis of User account activity — including transaction history, dispute patterns and return rates — to assess platform integrity and prevent abuse. This analysis may affect certain platform features available to a User, such as access to the dispute mechanism or payout timelines. Users may request human review of any decision that significantly affects their use of the Platform by contacting privacy@scent.to.
Scent.to has assessed that its legitimate interests are not overridden by Users' interests or fundamental rights in these contexts.
Consent (Article 6(1)(a)):
Where Scent.to sends marketing communications, consent is obtained separately and may be withdrawn at any time without affecting the lawfulness of prior processing.
3.2. Automated decision-making. Scent.to uses automated analysis of account activity to assess risk and prevent abuse of the Platform, as described in clause 3.1(e). This analysis does not constitute solely automated decision-making producing legal effects within the meaning of GDPR Article 22 — human review is involved in any significant enforcement action taken against a User. Where a User believes that an automated process has produced an outcome that significantly affects them, they may request human review by contacting privacy@scent.to. Scent.to undertakes to respond to such requests within fourteen (14) days.
4. HOW WE USE PERSONAL DATA
4.1. Scent.to uses personal data for the following purposes:
(a) creating and managing User accounts;
(b) facilitating Transactions between Buyers and Sellers, including coordinating payment processing, logistics and Verification;
(c) processing payouts to Sellers through the PSP;
(d) conducting Verification of products and maintaining associated records;
(e) handling disputes, complaints and returns in accordance with the Returns and Refunds Policy;
(f) communicating with Users regarding their accounts, Transactions and support requests;
(g) fulfilling reporting obligations under DAC7 and other applicable law;
(h) detecting and preventing fraud, abuse and violations of Platform Policies;
(i) complying with product safety obligations under GPSR, including maintaining traceability records;
(j) improving the Platform and analysing usage patterns on an aggregated basis;
(k) responding to requests from competent authorities as required by applicable law.
5. DATA SHARING AND THIRD-PARTY PROCESSORS
5.1. Scent.to shares personal data with third parties only where necessary for the purposes described in this Policy and in accordance with applicable data protection law. The following categories of recipients may receive personal data:
Payment Service Provider — Stripe Payments Europe Limited
Stripe processes payment data, holds Transaction funds and performs identity verification for connected Seller accounts. Stripe Payments Europe Limited is established in Ireland and processes data in accordance with GDPR. Data shared with Stripe includes account holder name, bank account details, identity verification information and transaction amounts. Stripe's privacy practices are described at stripe.com/privacy.
Cloud Infrastructure Provider — Supabase
Scent.to uses Supabase for database infrastructure and cloud storage. Product photographs submitted by Sellers and Verification photographs taken by Scent.to are stored in Supabase-hosted storage. Scent.to uses EU-region Supabase infrastructure where available. A Data Processing Agreement is in place between Scent.to and Supabase in accordance with GDPR Article 28.
Logistics and Carrier Services
Where Scent.to arranges outbound delivery, delivery address and order reference information is shared with the relevant carrier solely for the purposes of completing delivery.
Tax and Regulatory Authorities
Scent.to is required to report Seller transaction data to the Latvian State Revenue annually under DAC7 (EU Council Directive 2021/514). Data reported includes the Seller's name, primary address, tax identification number where available, date of birth, financial account identifier, total consideration received per quarter and the number of completed Transactions. The Latvian State Revenue Service may share this data with tax authorities in other EU Member States where the Seller is resident. Sellers will receive a copy of the data reported in respect of them by 31 January of the year following the relevant reporting period. Scent.to may also be required to disclose personal data to competent authorities in response to lawful requests under applicable law, including under the Digital Services Act.
Legal and Professional Advisers
Personal data may be disclosed to Scent.to's legal or professional advisers where necessary in connection with the conduct of legal proceedings or compliance matters, subject to confidentiality obligations.
5.2. Scent.to does not sell personal data to third parties. Scent.to does not share personal data with advertisers or use personal data for targeted advertising purposes.
5.3. All third-party processors engaged by Scent.to are required to process personal data only on Scent.to's documented instructions and in accordance with GDPR Article 28. Data Processing Agreements are in place with all processors handling personal data on Scent.to's behalf.
5.4. Controller-to-controller relationships. In the course of Transactions, certain personal data — such as delivery addresses — may be made available to the other party to the Transaction. Each User who receives personal data about another User in connection with a Transaction acts as an independent data controller in respect of such data and is solely responsible for processing it in accordance with applicable data protection law. Users must not use personal data received through the Platform for any purpose other than completing the relevant Transaction and must not retain it beyond what is necessary for that purpose.
6. INTERNATIONAL DATA TRANSFERS
6.1. Scent.to processes personal data primarily within the European Economic Area (EEA). Where personal data is transferred to recipients outside the EEA, Scent.to ensures that appropriate safeguards are in place in accordance with GDPR Chapter V.
6.2. Stripe Payments Europe Limited is established in Ireland (EEA) and processes data within the EEA. No international transfer arises in connection with Stripe's processing of Transaction data under normal circumstances.
6.3. Supabase Inc. is a company incorporated in the United States. While Scent.to uses EU-region Supabase infrastructure, Supabase Inc. may have access to data as a US parent entity. Where such access occurs, it is governed by Standard Contractual Clauses adopted pursuant to GDPR Article 46(2)(c), providing appropriate safeguards for the transfer.
6.4. Users may request information about the specific safeguards in place for any international transfer of their personal data by contacting Scent.to at privacy@scent.to.
7. DATA RETENTION AND SECURITY
Retention
7.1. Scent.to retains personal data for no longer than is necessary for the purposes for which it was collected, taking into account applicable legal retention obligations. The following retention periods apply:
Account data: retained for the duration of the User's account and for a period of two (2) years following account closure, to enable resolution of any outstanding matters and to comply with applicable legal obligations. Where a User requests erasure of their account, data is deleted or anonymised within thirty (30) days of the request, subject to the exceptions in clause 7.2.
Transaction data: retained for a period of seven (7) years from the date of the Transaction, in accordance with applicable tax and accounting obligations under Latvian law and EU legislation, including DAC7 requirements.
Verification photographs: retained for a period of two (2) years from the date of the relevant Transaction, to support dispute resolution and regulatory compliance. Seller-submitted product photographs stored in public cloud storage remain accessible while the Listing is active and are deleted within thirty (30) days of the Listing being closed or the account being deleted.
Support and dispute communications: retained for a period of three (3) years from the date of closure of the relevant support request or dispute.
DAC7 reporting data: retained for a minimum of five (5) years from the date of the relevant reporting period, in accordance with applicable tax law obligations.
Technical and usage data: retained in aggregated or anonymised form for analytical purposes. Session and authentication data is retained for the duration of the session and deleted upon logout or session expiry.
7.2. Scent.to may retain personal data beyond the periods set out in clause 7.1 where:
(a) retention is required by applicable law or a binding order of a competent authority;
(b) the data is necessary for the establishment, exercise or defence of legal claims;
(c) an ongoing investigation or dispute requires continued retention.
In such cases, data is retained only for as long as necessary for the relevant purpose.
Security
7.3. Scent.to implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or alteration, in accordance with GDPR Article 32. These measures include:
(a) encryption of stored account credentials;
(b) access controls limiting data access to authorised personnel only;
(c) private cloud storage for sensitive product and Verification photographs, accessible only to platform administrators;
(d) secure transmission of data using industry-standard protocols.
7.4. Notwithstanding these measures, no system is completely secure. Users are responsible for maintaining the confidentiality of their account credentials and should notify Scent.to immediately at privacy@scent.to if they suspect unauthorised access to their account.
7.5. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of Users, Scent.to undertakes to notify the Data State Inspectorate (Datu valsts inspekcija) within seventy-two (72) hours of becoming aware of the breach, in accordance with GDPR Article 33. Where the breach is likely to result in a high risk to Users, Scent.to will also notify affected Users without undue delay in accordance with GDPR Article 34.
8. USER RIGHTS
8.1. Users have the following rights in respect of their personal data under applicable data protection law:
(a) Right of access (GDPR Article 15) Users may request confirmation of whether Scent.to processes their personal data and, if so, a copy of the personal data held together with information about how it is processed.
(b) Right to rectification (GDPR Article 16) Users may request correction of inaccurate or incomplete personal data held by Scent.to.
(c) Right to erasure (GDPR Article 17) Users may request deletion of their personal data where it is no longer necessary for the purposes for which it was collected, where consent has been withdrawn and there is no other legal basis for processing, or where the data has been unlawfully processed. This right is subject to exceptions where processing is required by law or for the establishment, exercise or defence of legal claims.
(d) Right to restriction of processing (GDPR Article 18) Users may request that Scent.to restrict processing of their personal data in certain circumstances, including where the accuracy of the data is contested or where the User has objected to processing pending verification of legitimate grounds.
(e) Right to data portability (GDPR Article 20) Where processing is based on consent or the performance of a contract and is carried out by automated means, Users may request receipt of their personal data in a structured, commonly used and machine-readable format and, where technically feasible, direct transfer to another controller.
(f) Right to object (GDPR Article 21) Users may object to processing of their personal data based on legitimate interests. Scent.to shall cease such processing unless it can demonstrate compelling legitimate grounds that override the User's interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing purposes, Users have an absolute right to object at any time, and Scent.to shall cease such processing immediately upon receipt of the objection.
(g) Right to withdraw consent Where processing is based on consent, Users may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal. Withdrawal of consent to marketing communications may be exercised through the unsubscribe mechanism included in any marketing email or by contacting privacy@scent.to.
(h) Right to human review of automated decisions Where a User believes that an automated analysis of their account activity has produced an outcome that significantly affects their use of the Platform, they may request human review in accordance with clause 3.2.
8.2. To exercise any of the rights set out in clause 8.1, Users should submit a request to Scent.to at privacy@scent.to or through the account settings functionality on the Platform where available. Scent.to undertakes to respond to requests within one (1) month of receipt, extendable by a further two (2) months where the complexity or volume of requests requires it, in accordance with GDPR Article 12.
8.3. Scent.to shall not charge a fee for responding to requests unless they are manifestly unfounded or excessive, in which case a reasonable fee reflecting administrative costs may be charged, or the request may be refused, with reasons provided.
8.4. Where a User believes that Scent.to has not complied with applicable data protection law in connection with the processing of their personal data, the User has the right to lodge a complaint with the competent supervisory authority. In Latvia, the competent authority is the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv). Users may also lodge a complaint with the supervisory authority of their country of residence within the European Union.
9. COOKIES AND TRACKING TECHNOLOGIES
9.1. The Platform uses cookies and similar technologies to support the operation of the Platform and to enhance User experience.
9.2. The following types of cookies are used:
Strictly necessary cookies: session cookies used for authentication purposes, enabling Users to remain logged in during their session. These cookies are essential for the operation of the Platform and do not require consent. They are deleted upon logout or when the browser session ends.
Functional cookies: cookies used to remember User preferences and settings, such as language selection. These cookies improve the User experience but are not strictly necessary for the Platform to function.
Analytics cookies: where used, cookies that collect aggregated and anonymised information about how Users interact with the Platform, to enable Scent.to to improve its functionality. Scent.to will seek User consent before placing analytics cookies where required by applicable law.
9.3. Users may control cookies through their browser settings. Disabling strictly necessary cookies may affect the functionality of the Platform, including the ability to remain logged in. Disabling other cookies will not affect access to the Platform.
9.4. Scent.to does not use advertising cookies or share cookie data with advertising networks.
10. GENERAL PROVISIONS
10.1. Amendments. Scent.to shall be entitled to amend this Policy from time to time to reflect changes in applicable law, Scent.to's processing activities or the Platform's infrastructure. Any material amendment shall be communicated to Users through the Platform or by email no less than thirty (30) days before its effective date. Users who continue to use the Platform after the effective date of an amendment shall be deemed to have accepted the amended Policy.
10.2. Contact. Questions, requests or complaints relating to the processing of personal data under this Policy should be directed to Scent.to at privacy@scent.to. Scent.to undertakes to respond to all data protection enquiries within the timeframes required by applicable law.
10.3. Completeness. This Policy, together with the Terms and Conditions and applicable Platform Policies, constitutes Scent.to's complete disclosure of its personal data processing practices in connection with the operation of the Platform.
10.4. Governing law. This Policy is governed by the laws of the Republic of Latvia and applicable EU data protection legislation.