Skip to content
VEXLOOT
Legal

Privacy notice

1. Data controller

The data controller for personal data processed on Vexloot is the operator identified on our imprint page. You can contact our data-protection lead at [email protected].

2. Data we collect

  • Account data: email, display name, hashed password, and optional profile fields (locale, currency preference, country, date of birth).
  • Order data: items purchased, delivery evidence, order status, dispute notes, and, where applicable, screenshots you upload.
  • Payment metadata: card BIN and last four (never full PAN), payment provider transaction ids, FX snapshot at capture. Card numbers themselves never touch our systems — they go straight to the payment gateway.
  • Technical data: IP address (hashed for CSP reports), user-agent, session cookies, device fingerprints used only for fraud detection.
  • Support data: messages you send us and the timestamps of your interactions with support.

3. Legal bases

  • Contract: creating your account, processing orders, delivering goods, running support.
  • Legal obligation: tax records, sanctions screening, DSA transparency, chargeback evidence.
  • Legitimate interest: fraud prevention, aggregate analytics, product improvement.
  • Consent: optional marketing communications, non-essential cookies (see our cookie notice).

4. Retention

Data is kept only as long as necessary. See our retention schedule for the full matrix. Highlights: profile data until you delete your account, orders 7 years for tax, financial ledger entries 10 years, CSP reports 90 days.

5. Your rights

You have the right to access, rectify, erase, restrict, port and object to processing of your personal data. You can exercise most rights directly from your account settings; the rest are reachable at [email protected]. You also have the right to lodge a complaint with your national data-protection authority.

6. Cookies

Vexloot uses only a small set of first-party cookies for session, currency and locale preferences. Non-essential cookies (analytics, marketing) are gated behind a consent banner. See our cookie notice for the details.

7. International transfers

Vexloot runs primarily from a data centre inside the European Economic Area. Where a specific integration (e.g. a payment provider, transactional email provider) transfers data outside the EEA, we rely on the European Commission's Standard Contractual Clauses or the equivalent safeguard for the destination country.

8. Contact

General privacy questions: [email protected]. Data subject access requests: use the "Export my data" and "Delete my account" tools in your account settings, or email us at the same address. We aim to respond within 30 days.