1. Introduction
Bazarly ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our mobile application and related services, in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the applicable laws of the Republic of Cyprus.
2. Data Controller
The data controller responsible for your personal data is Bazarly, operated by Digital Services. Contact: bazarly@bazarly.app.
We have assessed that our current processing activities do not meet the thresholds requiring a mandatory Data Protection Officer (DPO) under GDPR Article 37. If you have data protection concerns, please contact us directly at bazarly@bazarly.app.
3. Information We Collect
We collect the following categories of personal data:
- Account information: name, email address, phone number
- Profile information: profile photo, display name
- Listing content: item descriptions, photos, pricing, category
- Communications: messages exchanged with other users through our in-app chat
- Location data: approximate location (city/area level) to display nearby listings — collected only with your consent
- Device and usage data: device type, operating system, IP address, app version, session data, crash reports, and feature interaction data
- Technical identifiers: advertising ID (if applicable), push notification token
- Newsletter sign-up: if you subscribe on our website, your email address, plus the IP address and browser information (user agent) sent when you sign up
We do not collect payment card details, bank account information, or any financial data. Bazarly does not process payments between users.
4. Legal Bases for Processing (GDPR Article 6)
We process your personal data on the following legal bases:
- Performance of a contract (Art. 6(1)(b)): to create and manage your account, enable you to post and respond to listings, and deliver the core platform services
- Legitimate interests (Art. 6(1)(f)): to improve our platform, prevent fraud and abuse, ensure platform security, and send essential service communications — we have assessed that these interests are not overridden by your rights
- Consent (Art. 6(1)(a)): to collect your location data for showing nearby listings; to send promotional and marketing communications; and to use non-essential cookies or analytics trackers — you may withdraw consent at any time
- Legal obligation (Art. 6(1)(c)): to comply with applicable laws, including tax reporting obligations under DAC7 and responses to lawful requests from authorities
5. How We Use Your Information
We use your personal data to:
- Create and maintain your account and provide platform services
- Display your listings to other users and enable you to browse listings
- Facilitate in-app messaging between buyers and sellers
- Send technical notices, security alerts, and support messages
- Monitor and analyse platform usage to improve our services
- Detect, investigate, and prevent fraud, abuse, and policy violations
- Fraud prevention in chat: we automatically check chat messages for common scam patterns (for example requests for verification codes or card details, fake payment or courier schemes, or demands for payment in advance) so we can warn the person receiving them. We store only which pattern was detected — never a separate copy of the message — and delete these indicators after 90 days. Messages containing blocked web links are emailed to our team for review. This is based on our legitimate interest in keeping the marketplace safe.
- Sale outcomes: when you mark a listing as sold, you can tell us where it sold (on Bazarly or elsewhere), the final price and, from the people who messaged you about it, who bought it. Every answer is optional and never shown on your listing or profile. We use them for marketplace statistics (for example how quickly items sell), to decide who is invited to leave a review, and later for confirmed-sale labels and anonymised price estimates. If a seller names you as the buyer, we link your account to that sale for the same purposes. This is based on our legitimate interest in running a trustworthy marketplace.
- How you found Bazarly: if you open the app from a Bazarly link that carries a source tag (for example a shared listing or a moving-sale link), we keep that tag on your device and attach it to your account when you sign up and to listings you post (and record it in our analytics, Google Analytics), to count which links bring sellers to Bazarly. On Android, we also read the Google Play install referrer once (the campaign that led you to install the app) and use it in the same way. Neither is shared with advertising partners. This is based on our legitimate interest in improving the service.
- Comply with legal obligations, including DAC7 seller reporting requirements
- Newsletter: if you subscribe on our website, we use your email address to send you occasional Bazarly product news. This is based on your consent (Art. 6(1)(a)). We keep it until you unsubscribe, using the link in every email or by emailing bazarly@bazarly.app.
6. Communications
a) Essential Communications (cannot be opted out of while account is active)
- Account verification (OTP messages)
- Password resets and security notifications
- Customer support responses
- Notifications regarding your account, listings, or activity
- Messages or contact requests from other users related to your listings
Legal basis: performance of contract (Art. 6(1)(b)). These communications are necessary to provide the service. To stop receiving them, you must delete your account and remove your listings.
b) Promotional Communications (optional)
- Marketing emails and promotional offers
- Product updates and announcements
Legal basis: consent (Art. 6(1)(a)). You may opt out at any time by using the unsubscribe link in the email or adjusting your account notification settings.
c) Tips and suggestions (optional)
Now and then (at most twice a week) we may send you a notification with a tip: for example, items people in your city are searching for, new listings that match your recent searches, or ideas to help a listing of yours get messages. These tips are based only on what you do in Bazarly (your searches, your listings, whether they have received messages, and when you joined) and are never shared with advertisers. To check that tips are actually useful, some users are randomly not sent certain tips. You can turn them off at any time in Settings → Profile → Tips & suggestions; chat, offer and saved-search notifications are not affected.
Legal basis: legitimate interest (Art. 6(1)(f)). You may opt out at any time in Settings → Profile → Tips & suggestions.
7. Cookies and Tracking Technologies
We use the following types of cookies and similar technologies:
- Strictly necessary: required for the platform to function (session management, security), including Google reCAPTCHA, provided by Google Ireland Limited, which we use to protect our forms from automated abuse. No consent required.
- Analytics: help us understand how users interact with the platform (e.g., usage frequency, feature adoption). We use Google Analytics 4, provided by Google Ireland Limited, for this purpose. Used only with your consent.
- Functionality: remember your preferences such as language selection. Used on the basis of legitimate interest or consent depending on the type.
You can manage cookie preferences through your device settings or browser. On this website, you can accept or reject analytics cookies when you first visit, and change that choice at any time using the Cookie settings link in the footer of any page. Withdrawing consent for non-essential cookies does not affect the lawfulness of processing carried out before withdrawal.
8. Information Sharing
We share your personal data only in the following circumstances:
- With other users: your public profile, listings, and contact information shared for the purpose of facilitating communication about a listing are visible to other registered users
- With service providers: we engage third-party providers for hosting, analytics, customer support, and push notifications — these providers act as data processors and are bound by data processing agreements
- With advertising measurement partners: the Bazarly app shares app activity events (such as app installs, app opens and when a listing is posted), basic device information and your device's advertising identifier with Meta Platforms Ireland Ltd, so we can measure which of our advertising campaigns on other apps and websites bring people to Bazarly. On iOS, the advertising identifier is shared only if you allow tracking when the app asks; on Android, you can turn this off at any time in the app under Settings → Privacy → Ad measurement, or reset or delete your advertising ID in your device settings. Meta processes this data under its own terms and privacy policy. We do not show ads inside Bazarly.
- For legal compliance: when required by law, court order, or regulatory authority, or where necessary to protect the rights, safety, or property of Bazarly, our users, or others
- With your explicit consent: for any other purpose you specifically agree to
- Business transfers: if Bazarly is involved in a merger, acquisition, or sale of assets, your data may be transferred — we will notify you before your data becomes subject to a different privacy policy
We do not sell your personal data to third parties.
9. International Data Transfers
Some of our service providers operate outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, which may include:
- Standard Contractual Clauses (SCCs) approved by the European Commission (2021 version)
- Transfers to countries that have received an EU adequacy decision
You may request details of the safeguards applicable to your data by contacting us at bazarly@bazarly.app.
10. Data Retention
We retain personal data for as long as necessary for the purposes described in this policy and to comply with legal obligations. Indicative retention periods:
- Account data: for the duration of your account plus up to 12 months after deletion (to handle post-deletion queries or disputes)
- Listing content: for the duration the listing is active; removed listings are purged within 30 days unless subject to a legal hold
- Chat messages: kept to run the service and for safety and dispute handling, until you ask us to delete them. They are not automatically deleted when you delete your account, so email bazarly@bazarly.app if you want them erased. Scam-pattern indicators on chat messages are deleted after 90 days.
- Sale outcomes: kept for marketplace statistics, including after the listing is removed; the link to a buyer's account is removed 24 months after the sale.
- Usage and device data: up to 24 months from collection, in aggregated or pseudonymised form where possible
- Legal and compliance records: as required by applicable law (e.g., tax records for up to 7 years under Cyprus law)
11. Your Rights
Under GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): request a copy of the personal data we hold about you
- Right to rectification (Art. 16): request correction of inaccurate or incomplete data
- Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"), subject to legal retention obligations
- Right to restriction (Art. 18): request that we limit how we use your data in certain circumstances
- Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format
- Right to object (Art. 21): object to processing based on legitimate interests
- Right to withdraw consent: withdraw consent at any time for processing based on consent, without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at bazarly@bazarly.app. We will respond within 30 days. You may also delete your account and associated data directly within the app.
12. Automated Decision-Making and Profiling
We do not make decisions about you that produce legal or similarly significant effects solely by automated means. We may use automated tools to detect suspicious activity or policy violations, but any account action resulting from such detection is reviewed by a human before being applied. Automated scam-pattern checks can show a safety warning to the person receiving a message and can contribute to the risk indicator shown in chat; they never block or delete messages, and you can contact us to challenge an indicator.
13. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS), access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by GDPR Article 34.
14. Children's Privacy
Our services are not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18 without appropriate consent, we will take steps to delete it promptly. If you believe we hold data about a child, please contact us at bazarly@bazarly.app.
15. Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the supervisory authority in your country of residence. In Cyprus, the competent authority is:
- Commissioner for Personal Data Protection
- 1 Iasonos Street, 1082 Nicosia, Cyprus
- Website: www.dataprotection.gov.cy
- Email: commissioner@dataprotection.gov.cy
We would, however, appreciate the opportunity to address your concerns before you approach the regulator, so please contact us first.
16. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will notify you by email or in-app notification at least 15 days before the new policy takes effect. The "Last updated" date at the top of this page reflects the most recent revision.
17. Contact Us
For questions, requests, or concerns about this Privacy Policy or how we handle your data: