QYRONY Privacy Policy
Version: 1.0.1 Last updated: 3 August 2026 Effective from: 31 March 2025
This Privacy Policy explains how QYRONY (“we”, “us”, “our”) processes Personal Data when you use the QYRONY Hub platform under applicable data-protection laws.
1. Who we are and how to contact us
1.1. Data controller
For the core platform services (account, listings, orders, payments, wallet, support), the data controller is:
Qyrony
Website: qyrony.com
Email:
contact@qyrony.com
1.2. Joint controllers (channels)
When a User or Vendor hosts a Channel that aggregates content and interactions, they are responsible for the content they publish and for complying with any privacy obligations that apply to their own activity.
1.3. Privacy contact
Email:
contact@qyrony.com
Contact us at this address with any question about this Policy, your rights, or our processing, and to exercise any of the rights described in section 8.
2. Personal data we collect
We collect Personal Data directly from you, automatically from your device, and from third parties. The principal categories are summarised below.
| Category | Examples | Source |
|---|---|---|
| Identity & account | name, display name, email, phone, profile photo, language, time zone, hashed password | You (registration, profile, vendor verification) |
| KYC & vendor verification | date of birth, government ID, tax identifier (e.g. VAT, EIN, SIREN), bank or payout account, beneficial-owner data, sanctions-screening results | You, via KYC providers |
| Authentication & security | hashed passwords, 2FA secrets, device fingerprints, login timestamps, IP address, security-event logs | You (login), automatically |
| Transaction & wallet | order history, invoices, refunds, dispute records, Wallet balance, top-up and payout history, card tokens (PAN and CVV are never stored by us; only the card-network token) | You, payment processors |
| Listings & content | product data, images, descriptions, prices, auction bids, reviews, channel posts, messages, support tickets | You |
| Behavioural & usage | pages viewed, search queries, click patterns, referrer, time spent, items added to cart or watched, auction watchlists | Automatically, via cookies and SDKs (see §5) |
| Device & connection | IP address, user agent, OS, language, screen size, advertising IDs (where permitted) | Automatically |
| Marketing | email engagement, in-app notifications, marketing preferences, attribution data for our own ads | You, automatically |
| Customer support | messages, call recordings (where you consent), attachments | You |
| Public third-party data | sanctions and PEP lists, public company registries | Third parties |
We do not knowingly collect Special Categories of Data (Article 9 GDPR). If you choose to upload it, you do so at your own risk and you consent to our processing it for the purposes of operating the feature; you can delete it at any time.
3. Why we use your data (purposes and lawful bases)
GDPR requires us to have a lawful basis for each processing activity. The table below sets out the purposes for which we process Personal Data and the corresponding legal ground under Article 6(1) GDPR. Legitimate interests are balanced against your rights and freedoms at the time of the legitimate-interest assessment (LIA); you can request a copy of any LIA.
| # | Purpose | Lawful basis (Art. 6 GDPR) | Categories of data |
|---|---|---|---|
| 1 | Provide the Platform, including account creation, login, listings, auctions, channels, and messaging | (b) Performance of a contract | Identity, authentication, listings, content, device |
| 2 | Process payments, manage the Wallet, issue refunds, prevent fraud | (b) Contract, (c) Legal obligation (tax, AML), (f) Legitimate interests (fraud prevention) | Transaction, KYC, device, behaviour |
| 3 | Vendor verification (KYC, sanctions screening) | (c) Legal obligation (AML, sanctions), (b) Contract | KYC, identity |
| 4 | Order fulfilment, shipping, returns, customer support | (b) Contract | Identity, transaction, support |
| 5 | Safety, security, fraud and abuse prevention, dispute resolution | (f) Legitimate interests (security of service and Users) | All categories; specifically authentication, device, behaviour, transaction |
| 6 | Product analytics and improvement, A/B testing, debugging | (f) Legitimate interests, (a) Consent for non-essential cookies | Behaviour, device |
| 7 | Personalisation of search, recommendations, and homepage | (f) Legitimate interests (within the strict necessity test), with right to opt out | Behaviour, listings, content |
| 8 | Marketing communications (email, push, in-app) | (a) Consent (Article 7 + ePrivacy), or (f) for existing customers with right to opt out | Identity, behaviour |
| 9 | Personalised advertising (third-party ad networks) | (a) Consent (TCF v2.2) | Behaviour, device, advertising IDs |
| 10 | Tax accounting, financial reporting, regulatory record-keeping | (c) Legal obligation | Transaction, KYC |
| 11 | Comply with law enforcement and lawful government requests | (c) Legal obligation | All categories, as required by the request |
| 12 | Establish, exercise, defend legal claims | (f) Legitimate interests | All relevant categories |
| 13 | Reorganisations, M&A, asset sales | (f) Legitimate interests, (a) Consent for material changes | All categories, as transferred |
Automated decision-making and profiling (Art. 22). We use automated systems to: (a) detect fraud and abuse (with human review for adverse effects); (b) rank search and recommendations; (c) decide whether a Listing complies with the Acceptable Use Policy (with a human review on objection); (d) decide initial eligibility for promotional credit (with the right to contest). We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (such as refusing service, without human review), unless required or authorised by law (e.g. sanctions screening).
4. Who we share your data with
We do not sell Personal Data. We share data only as set out below.
4.1. Other Users
- Buyers see the Vendor’s public profile and Listing details.
- Vendors see the Buyer’s name, delivery address, and any messages in connection with an order.
- Channel members see the content the host publishes and may see your public profile if you post.
4.2. Service providers (processors)
We engage carefully vetted processors under Article 28 GDPR contracts. The current sub-processors include cloud infrastructure, payment processors, KYC/sanctions providers, and customer support tooling. Changes are notified at least 30 days in advance.
Categories include cloud hosting, database and object storage, payment processing, email delivery, content moderation, and security tooling. We publish provider names only after confirming the active production service and the disclosure is useful to customers.
4.3. Payment and banking partners
Payment data is shared with licensed payment-service providers and, where required, card networks. We share the minimum data needed to authorise, settle, and reconcile a transaction. We do not store full card numbers or CVV.
4.4. Shipping and logistics
Order data (name, address, phone, items) is shared with the chosen carrier to fulfil delivery. Tracking events are returned to the Platform.
4.5. Professional advisors and authorities
Auditors, lawyers, tax advisors, banks, and regulators where necessary for the purposes in §3.
4.6. Law enforcement and courts
Where we receive a binding legal request or have reasonable grounds to believe disclosure is necessary to prevent imminent harm, illegal activity, or to enforce our Terms. We assess each request for legal validity, publish aggregate statistics, and challenge over-broad requests where appropriate.
4.7. Corporate transactions
If QYRONY is acquired, merged, or sells assets, your data may be transferred to the acquirer under a written undertaking to honour this Policy.
5. Cookies, SDKs, and similar technologies
We use cookies and similar technologies for authentication, security, preferences, analytics, and (with your consent) marketing.
| Category | Strictly necessary? | Consent required? | Examples |
|---|---|---|---|
| Authentication, security, fraud | Yes — required for the service to work | No (Article 6(1)(f) and Recital 32) | session, csrf, device fingerprint |
| Functional preferences | No | No (legitimate interests for non-intrusive UX preferences) | language, dark mode |
| Analytics (first-party) | No | Yes | page views, performance, error tracking |
| Marketing / advertising | No | Yes | third-party ad pixels, retargeting |
You can revisit your choices at any time via the /legal/cookies page or the banner preferences link.
For mobile, the equivalent preferences for SDKs are in your device settings (“Limit Ad Tracking” on iOS, “Opt out of Ads Personalisation” on Android).
6. International data transfers
Our service providers may process Personal Data outside your country. Where data-protection law requires a transfer safeguard, we use an applicable legal mechanism and contractual or technical protections appropriate to the transfer.
Contact contact@qyrony.com if you have a question about a transfer that affects your data.
7. How long we keep your data
We retain Personal Data only for as long as needed to provide the service, meet legal obligations, resolve disputes, enforce agreements, and maintain security. The period depends on the data, the reason it was collected, account status, and any mandatory record-keeping requirement. We delete or anonymise data when it is no longer needed, subject to backup cycles and legal holds.
Where a legal hold or ongoing dispute requires longer retention, we preserve the data for the duration of the hold and delete it afterwards.
8. Your rights under GDPR
Subject to the conditions and exceptions in GDPR, you have the following rights. They are free of charge, normally answered within one month, and extendable by two further months for complex requests (we will tell you within one month if an extension is needed).
| Right | What it means | How to exercise it |
|---|---|---|
| (a) Access (Art. 15) | Confirm whether we process your data and obtain a copy | Contact contact@qyrony.com |
| (b) Rectification (Art. 16) | Correct inaccurate or incomplete data | Edit your profile, or write to us |
| (c) Erasure (Art. 17) | “Right to be forgotten” — delete data we are not required to keep | Contact contact@qyrony.com |
| (d) Restriction (Art. 18) | Pause processing while a dispute is resolved | Write to contact@qyrony.com |
| (e) Portability (Art. 20) | Receive your data in a structured, machine-readable format (JSON or CSV) and transmit it to another controller | Contact contact@qyrony.com |
| (f) Objection (Art. 21) | Object to processing based on legitimate interests, including profiling | Opt-out controls in product, or write to us |
| (g) Automated decisions (Art. 22) | Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, and to obtain human review | Write to contact@qyrony.com |
| (h) Withdraw consent (Art. 7(3)) | Withdraw any consent at any time — the withdrawal does not affect the lawfulness of prior processing | Cookie preferences, marketing unsubscribe, account settings |
| (i) Lodge a complaint (Art. 77) | Lodge a complaint with your local supervisory authority | See §8.2 below |
We will not retaliate against you for exercising your rights.
8.1. Identity verification
To prevent unauthorised disclosure, we may need to verify your identity before responding. We use a risk-based approach — the more sensitive the request, the stronger the verification.
8.2. Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with the data-protection authority in your habitual residence, place of work, or place of the alleged infringement. A list of EEA supervisory authorities is available at edpb.europa.eu. UK residents may complain to the ICO (ico.org.uk); Swiss residents to the FDPIC (edoeb.admin.ch).
9. Children
The Platform is not directed at children under 18. We do not knowingly collect data from children under 18. If you believe a child has provided data to us, contact contact@qyrony.com and we will delete it promptly.
10. Security
We use administrative, technical, and organisational safeguards designed to protect Personal Data. These include access controls, secure transport, monitoring, and review of sensitive operations. No service can guarantee absolute security.
You can read more at /trust-and-safety and review our latest security measures.
11. Marketing communications
- We send marketing communications only with your consent (or, for existing customers, on a soft-opt-in basis where the law allows, with a clear unsubscribe in every message).
- Every email contains an unsubscribe link and a preference centre link.
- Push notifications can be turned off in your device or in-app settings.
- We do not pass your email to third parties for their own marketing.
12. Third-party links and embedded content
The Platform may link to or embed third-party sites, ads, or social widgets. Those providers set their own cookies and read your IP. We are not responsible for their privacy practices — review their policies before interacting.
13. Changes to this Policy
We will update this Policy when our practices change or when the law requires it. The current version is always at this URL with an updated “Last updated” date. Material changes are notified by email and an in-product banner at least 30 days in advance.
14. Contact
For privacy matters:
Qyrony
Website: qyrony.com
Privacy Email:
contact@qyrony.com
For a Subject Access Request or any other data-subject request, email contact@qyrony.com.
Defined terms
- “Personal Data” — any information relating to an identified or identifiable natural person.
- “Processing” — any operation performed on Personal Data (collection, storage, use, disclosure, deletion).
- “Special Category Data” — data revealing racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data, health data, sex life, or sexual orientation.
- “Profiling” — automated processing of Personal Data to evaluate certain personal aspects, in particular to analyse or predict performance, economic situation, preferences, interests, reliability, behaviour, location, or movements.
- “Consent” — freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
End of Privacy Policy.