Privacy Policy
Data controller: EriMarket (operated by [Operator Name], [Country]). Contact: support@erimarket.shop
Last updated: July 2025
1. Who we are
EriMarket ("we", "us", "our") is an online marketplace connecting Eritrean diaspora sellers and buyers. We are responsible for the personal data you provide to us when using our platform.
2. What data we collect
- Account data: name, email address, password (hashed), role (buyer or seller), and optional profile details (phone, city, country, bio).
- Order data: shipping address, items purchased, and payment status. Payment card details are handled by our payment processor and never stored by us.
- Shop data: shop name, description, product listings, and images uploaded by sellers.
- Usage data: product view counts and basic server logs.
3. How we use your data
- To provide and operate the marketplace (process orders, manage accounts).
- To communicate with you about your account and orders.
- To facilitate payouts to sellers via our payment provider.
- To improve platform performance and detect fraud.
Lawful basis for processing (GDPR Art. 6)
| Processing purpose | Lawful basis |
|---|---|
| Order processing, payments, and delivery | Contract performance (Art. 6(1)(b)) |
| Account creation and profile management | Contract performance (Art. 6(1)(b)) |
| Financial records (7-year retention) | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention and server logs | Legitimate interests (Art. 6(1)(f)) |
4. Data sharing
We do not sell your personal data. We share data only with:
- Our payment processor — for secure payment processing and seller payouts.
- Our infrastructure providers — database, authentication, and hosting services.
- Sellers receive your shipping address and name solely to fulfil your order.
5. Data retention
We retain your account data for as long as your account is active. Order records are kept for legal and accounting purposes for up to 7 years. You may request account deletion at any time by contacting us.
6. Your rights
Under the GDPR you have the following rights:
- Right to access your personal data (Art. 15).
- Right to data portability — export a copy of your data in machine-readable format (Art. 20). Use the “Export my data” feature in your account settings.
- Right to rectification — correct inaccurate data (Art. 16).
- Right to erasure — request deletion of your data (Art. 17).
- Right to restriction of processing (Art. 18).
- Right to object to processing based on legitimate interests (Art. 21).
- Right to lodge a complaint with your national data protection authority (Art. 77 GDPR).
To exercise these rights, contact us at support@erimarket.shop.
7. Cookies and tracking
We use only strictly necessary cookies for authentication (session tokens) and a preferred-currency cookie to remember your display preference. We do not use tracking, advertising, or analytics cookies. When you click a referral link, a referral cookie (30 days) is set solely to attribute your signup to the referrer — this is strictly necessary to fulfil the referral feature you actively initiated.
Do-Not-Track: We respect DNT browser signals. Because we do not engage in cross-site behavioural tracking, enabling DNT has no additional effect on our practices beyond what is already described here.
8. Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS/TLS), hashed password storage, and access controls that limit who can view your data. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by GDPR Art. 33–34.
No method of transmission over the internet is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security.
9. Minors
EriMarket is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a child under 18 has provided us with personal information, please contact us at support@erimarket.shop and we will delete it promptly.
10. Data processors
We share data with the following third-party processors to operate the platform:
- Database and authentication infrastructure — stores your account data and manages secure sign-in (EU region).
- Payment processor (Stripe) — handles payments and seller payouts. Card data is processed under their own PCI-DSS certification and never touches our servers.
- Email delivery provider (Resend) — sends transactional emails (order confirmations, account notifications).
- Hosting provider (Vercel) — serves the platform and processes requests.
Each processor is bound by a Data Processing Agreement and may only process your data on our documented instructions.
11. Contact
For any privacy-related questions or to exercise your rights, contact us at support@erimarket.shop. We aim to respond to all requests within 30 days.