Privacy policy

Privacy Policy

Version 1.1, effective from the date of publication on the Site. In case of discrepancies between language versions the Polish version prevails.

1. Controller

The controller of the personal data of users of the Top Change site (topchangemagic.com) is Mighty Little Steps spółka z ograniczoną odpowiedzialnością, ul. Gospodarcza 26, 20-213 Lublin, Poland, KRS 0001108348, NIP 9462741095 (the "Operator" or "we"). For personal-data matters write to contact@topchangemagic.com. The Operator has not appointed a data protection officer.

2. Where the data come from

• from you: when registering, completing your profile, applying for seller verification, publishing listings, sending messages, bidding, rating, reporting and appealing;
• from your Google account, if you sign in with Google: e-mail address, name and account identifier;
• from other users: messages to you, ratings, reports about your content;
• automatically from your browser: IP address, browser and device data, event times.

If you report content without an account, we process the e-mail address you provide and the content of the report.

3. What data we process

• account data: e-mail address, password (hash only), username, display name, country, city, bio, social-media links, language, currency, notification settings, two-factor sign-in key (encrypted);
• seller verification data: description, profile links, call date and notes, decision (visible only to the Operator);
• content: listings, photos (metadata, including location, is removed before saving), messages, ratings, reports, appeals;
• transaction data: purchase declarations, bids and their amounts, price proposals, statuses, dates, strikes and moderation decisions;
• technical data: IP address and browser data as a salted hash (only to detect linked accounts in bidding and abuse), application error logs, administrator action log;
• consents and acceptances: version and date of acceptance of the Terms and Privacy Policy, declaration of adulthood, private-seller declaration.

We do not collect payment-card or bank-account data: payments take place outside the Site.

4. Purposes and legal bases

| Purpose | Legal basis (GDPR) | | --- | --- | | Creating and maintaining the account, publishing listings, messages, bids, transactions, ratings, notifications about events in your matters | Art. 6(1)(b) – performance of a contract | | Seller verification, detecting fraud and linked accounts, new-account limits, strikes | Art. 6(1)(f) – legitimate interest of the Operator and users (safe trading) | | Handling reports and appeals, statements of reasons, point of contact, moderation log | Art. 6(1)(c) – obligations under Regulation (EU) 2022/2065 (DSA) | | Listing assistant and automatic translations (listing descriptions and photos only) | Art. 6(1)(b) – performance of a contract, at your request | | E-mail notifications other than necessary ones (e.g. watched auctions, saved searches) | Art. 6(1)(a) – consent given in the settings, which you can withdraw at any time | | Welcome e-mail and information about changes to the Terms or the Site | Art. 6(1)(b) – performance of a contract | | Visit statistics (no cookies, no identification of individuals), error monitoring, backups, security | Art. 6(1)(f) – legitimate interest | | Handling complaints, defending and pursuing claims | Art. 6(1)(f) – legitimate interest | | Disclosure to authorities and reporting duties, if the law imposes them on the Operator (e.g. reporting by digital platforms) | Art. 6(1)(c) – legal obligation |

Providing account data is voluntary, but without it an account cannot be created. If the rules on reporting by digital platform operators (DAC7) come to apply to the Operator, we will separately ask sellers for the additional data required by law and explain their scope before collecting them.

5. Who can see the data and who processes them

Other users. The following are public: username and display name, country, city, bio, links, verification badge, ratings and replies to them, listings with photos and the anonymised bid history in auctions. The other party to a transaction additionally sees your messages and what you write in them (e.g. a shipping address). Your e-mail address is not shown to other users.

Processors acting on our behalf under data-processing agreements:

• Supabase (database, sign-in, photo storage; servers in the Frankfurt region, EU);
• Vercel (application hosting; functions run in the Frankfurt region);
• Resend (e-mail delivery; EU region);
• Cloudflare (DNS, Turnstile bot protection, inbound e-mail routing);
• Anthropic (AI model for the listing assistant and translations; receives only listing descriptions and photos, never messages or account data; the provider does not use this content to train models);
• Sentry (error monitoring; EU region);
• Plausible (cookie-free visit statistics; EU).

Google is an independent controller of the data processed when you sign in with Google, under its own privacy policy.

Public authorities receive data only on the basis of the law, upon a valid request.

6. Transfers outside the European Economic Area

Data are stored in the European Union. Some providers (Vercel, Cloudflare, Anthropic, Sentry, Google) are established in the USA; transfers to them rely on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) for providers certified under it and otherwise on the standard contractual clauses adopted by the European Commission. You can obtain a copy of the safeguards by writing to the point of contact.

7. Retention

• account and profile: until the account is deleted; after deletion the profile is anonymised, and your listings, messages and ratings remain visible to the other party without a link to your identity only to the extent needed to close ongoing matters;
• records of transactions, declarations and bids, moderation decisions, strikes and proof of acceptance of documents: 6 years from the end of the year in which they arose (limitation period for claims), anonymised after account deletion;
• reports and appeals with correspondence: 3 years from closure of the matter;
• seller verification data (description, links, call notes): until the account is deleted;
• technical data, address and browser hashes, error logs: 12 months;
• administrator action log: 6 years;
• database backups: up to 7 days.

8. Your rights

You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing, data portability (a JSON export is available in the account settings), to object to processing based on legitimate interest and to withdraw consent at any time without affecting the lawfulness of earlier processing. Send requests to the point of contact; we reply within one month.

You have the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl), or the supervisory authority in the country of your habitual residence.

9. Automated decisions

Restricting an account after the strike threshold is exceeded and temporary limits for new accounts are decisions taken automatically on the basis of events in your transactions. They are necessary for the performance of the contract (safe trading between users). You are informed of every such decision, can express your point of view and can appeal to a human in the "Account status" tab. Automated signals about content or suspicious bidding never by themselves hide content or block an account – a human takes the decision. We do not profile users for marketing purposes.

10. Security

Data are transmitted over an encrypted connection, passwords are stored only as hashes, access to data in the database is restricted at row level, and administrator accounts require two-factor sign-in. You can enable two-factor sign-in for your account too.

11. Minors

The Site is intended for adults only. If we learn that an account belongs to a minor, we will delete it.

12. Cookies

The use of cookies and similar mechanisms is described in the Cookie Policy.

13. Changes

Changes to this Policy are published on the Site with a version number and date; we inform you of material changes by e-mail.