GivEco Privacy Policy

Effective 18 October 2026 · Version 2.6. This Policy explains what personal data GivEco processes, why, on what legal basis, who may receive it, how long it is kept and what rights individuals have. The main framework is Regulation (EU) 2016/679 (GDPR).

1. Controller and contact

The controller is DIGIT-ALL Rafał Polewski, ul. Alojzego Majchra 5a/5, 54-026 Wrocław, Poland, NIP 8942764500. Contact: giveco@giveco.eu or +48 504 043 640. The Controller has not appointed a Data Protection Officer.

2. Data we process

Account data: display name, email, password hash, email-verification date, adult confirmation, and versions and dates of Terms acceptance and Privacy Policy acknowledgement. Profile data: optional avatar, town, description and, if supplied, coordinates used to calculate distance; exact coordinates are not public. Listing data: type, title, description, category, condition, town, optional coordinates, photos, status and publication/expiry dates. Communication and handover data: messages and times, conversation participants, selected handover method, shipment code entered by a user, confirmations, problem reports and ratings. Safety data: user reports, moderation decisions, anti-fraud flags, account status and events needed to prevent abuse. Contact-form data: name or username, email, selected topic and message. Technical data may include IP address, session identifier, browser type, request time and errors as recorded by Laravel or the hosting provider.

3. Purposes and legal bases

Account creation and operation, listings, search, chat, reservations, confirmations and ratings are processed to perform the electronic-services agreement (GDPR Article 6(1)(b)). Email verification, requested technical messages, chat-notification emails and account security are processed to provide the service; fraud prevention may also rely on legitimate interests (Article 6(1)(f)). Contact enquiries are handled to provide the requested service or respond on the basis of legitimate interests, as applicable. Moderation, reports, fraud prevention, user protection and legal claims rely on legitimate interests. Legal disclosures rely on a legal obligation (Article 6(1)(c)). Events such as creating listings, sending messages or completing handovers may also be recorded to operate the service and produce account-activity statistics; these do not use the optional analytics identifier. Optional analytics rely on your consent under Article 6(1)(a), which can be withdrawn through Cookie Settings.

4. Location, analytics and automated filters

Device location is optional; the browser asks permission. Search coordinates are stored in the session and used for up to two hours. Optional analytics run only after consent and measure page views, unique browsers and direct-banner impressions and clicks. The analytics identifier is random; its hash and events are stored without IP address or browser details and are not linked to an account. Consent can be withdrawn through Cookie Settings; recorded events for that browser identifier are then deleted. Account activity statistics needed to operate the service do not use the optional analytics identifier. Listing filters can hold a listing for moderator review. A chat filter may flag selected phrases, warn the recipient and create a report, but does not block or delete messages. No decision with legal or similarly significant effects is made solely by automated means.

5. Recipients and hosting

The Controller and authorised service operators can access data as needed for their duties. Website, database and email infrastructure are supplied by VH.PL Prociv Sp. z o.o., ul. Czerniawska 2A/27, 50-576 Wrocław, Poland. Emails (verification, password reset, chat notification and contact correspondence) are sent using PHP mail on the hosting server. A chat email contains the sender’s display name, listing title and conversation link, not the message body. VH.PL states that its data centres are in Gdańsk and Gdynia; this does not establish which centre hosts this account or where backups are held. Confirm account and backup locations, retention and subprocessors with the provider under the current hosting contract. Public authorities may receive data where required by law. GivEco does not currently send data to SMS providers, Google Analytics, Google Ads or InPost. If the hosting provider or its subprocessors transfer personal data outside the EEA, an applicable GDPR transfer mechanism and safeguards must be used; contact the Controller for available details. If personal data are transferred outside the EEA by the hosting provider or its subprocessors, the transfer must use a valid GDPR mechanism and appropriate safeguards; contact the Controller for available details.

6. Public and private information

Listings, display name, profile and ratings are public to the extent shown on the website. Email, password, private conversations and shipment code are not public. A conversation is accessible to its participants and to the Administrator where needed for moderation and reports. Users independently use carrier services; GivEco does not integrate with InPost for shipping.

7. Cookies

Essential session and CSRF cookies support login, form protection and session continuity; blocking them may prevent account use. The giveo_cookie_choice cookie remembers consent or refusal for 12 months. After consent, giveo_analytics_id stores a random browser identifier for up to 13 months, solely for the analytics described above. It is not set and analytics do not run without consent. Direct banners do not use profiling or external advertising analytics.

8. Retention

Account and profile data are generally kept until account deletion, except information needed for safety, reports or claims. Listings and images are removed through the application after account deletion, subject to handover, moderation and report needs. Messages are kept while needed for account use and handovers; material linked to an open report may be retained until it is resolved or claims are no longer relevant. Contact correspondence is kept while the matter is handled and for up to 12 months afterwards unless law or claims require longer. Raw analytics events are deleted after 13 months; consent withdrawal triggers deletion of events tied to that browser identifier. Technical logs and backups follow the hosting and infrastructure retention cycle; exact periods depend on the configured hosting service and should be confirmed with VH.PL.

9. Your rights

Subject to GDPR conditions, you may request access, a copy, rectification, erasure, restriction, portability and object to processing based on legitimate interests. You may withdraw consent at any time without affecting prior processing. You may complain to the President of the Polish Personal Data Protection Office (UODO) or to the supervisory authority in your country of habitual residence, place of work or alleged infringement. Send requests to giveco@giveco.eu. The Controller normally responds within one month and may request information needed to verify identity, but never your password. Account data are needed to provide an account; avatar, profile description and optional location are voluntary.

10. Security and changes

Passwords are stored as cryptographic hashes, administrative access is restricted, and the website should be used over HTTPS. Application files and listing images are kept outside the public web directory and images are served through a controlled application route. No technical measure guarantees absolute security. The Policy may change when law, the service, providers or processing changes; material changes will be published with a new date and renewed acknowledgement requested where needed. Privacy questions can be sent to giveco@giveco.eu.