PRIVACY POLICY

1. Introduction & Scope
2. Data Controller Information
3. Legal Basis for Processing
4. Data We Collect
5. How We Use Your Data
6. Data Sharing & Third-Party Services
7. International Data Transfers
8. Data Retention Periods
9. Your Privacy Rights
10. Security Measures
11. Cookies & Tracking Technologies
12. Children's Privacy
13. California Privacy Rights (CCPA)
14. Changes to This Policy
15. Contact Information

Under the General Data Protection Regulation (GDPR) and other applicable data protection laws, we process your personal data based on the following legal grounds:

We use your data for: Account management (create/maintain accounts, authentication, password recovery, transactional emails); Transaction processing (purchases/sales, payment processing, escrow, refunds, invoices); Service delivery (buyer-seller communication, delivery coordination, tracking confirmations, 24-hour inspection, auto-acceptance); Dispute resolution (investigations, evidence review, negotiation, Final Resolution Committee escalation); KYC verification & compliance (identity verification, AML compliance, fraud detection, tax reporting); Fraud prevention & security (monitoring suspicious activity, duplicate accounts, chargeback prevention, IP blocking); Customer support (responding to inquiries, troubleshooting, issue resolution); Platform improvements (analytics, A/B testing, feature development, bug fixes); Legal compliance (tax reporting, law enforcement cooperation, regulatory obligations); Marketing communications (newsletters, promotions, platform updates - opt-out available).

We DO NOT sell, rent, or trade your personal data. We share data only in these circumstances:

Primary Storage: Global (Cloudflare's global network with data centers worldwide, including EU locations) - GDPR compliant.
Image Storage: Cloudflare R2 (global distributed storage with automatic geographic routing).
Database Hosting: OVHcloud (France - EU data centers in Roubaix/Gravelines) for primary database.
Transfers Outside EU/EEA: Your data may be transferred to the United States and other countries through Cloudflare's global network (not all "adequate" under GDPR Article 45).
Legal Safeguards:
- Standard Contractual Clauses (SCCs) 2021/914 with all US-based service providers (Cloudflare, Stripe, PayPal)
- EU-US Data Privacy Framework compliance (Cloudflare certified)
- Data Processing Agreements (DPAs) with all third-party processors
- Cloudflare's EU Data Localization option available upon request
Your Rights: Obtain transfer safeguard information, request EU-only data storage (may limit platform functionality), object to transfers, file complaint with local data protection authority.

We retain personal data only as necessary for stated purposes or as legally required.
| Data Type | Retention Period | Legal Basis |
|--------------------------------|-------------------------------------|---------------------------|
| Account registration | Account lifetime + 7 years | Tax/legal requirement |
| KYC documents (sellers) | 5 years after account closure | AML/KYC regulations |
| Transaction records | 7 years after transaction | Tax/accounting laws |
| Payment data | 7 years after transaction | Financial regulations |
| Platform messages | 3 years after last message | Dispute resolution |
| Support tickets | 3 years after closure | Customer service |
| Raw server logs (IP) | 90 days | Fraud prevention |
| Anonymized analytics | 24 months | Statistical analysis |
| Marketing email lists | Until opt-out or account deletion | Consent |
| Delivery evidence | 120 days minimum (seller responsibility) | Dispute resolution |
| Dispute records | 5 years after resolution | Legal defense |
| Suspended/banned accounts | 10 years (permanent record) | Fraud prevention |
Automated Deletion: We automatically anonymize IP addresses after 90 days, delete expired sessions/tokens, purge old logs, remove unverified accounts after 30 days inactivity, and delete user accounts upon request (see Section 9.5).

We implement industry-standard technical and organizational security measures to protect your personal data from unauthorized access, disclosure, alteration, or destruction.
Technical Measures: TLS 1.3 encryption (in transit), AES-256 encryption (at rest for passwords/KYC/payment data), bcrypt/Argon2 password hashing, optional 2FA, secure KYC file storage (OVH private access-controlled), database firewalls/access controls/regular audits.
Organizational Measures: Access on need-to-know basis, staff data protection training, background checks for key personnel, NDAs for all staff, quarterly security audits & penetration testing, documented incident response plan.
Third-Party Security: All service providers (payment processors, cloud hosts) are GDPR-compliant, SOC 2 Type II certified (or equivalent), subject to Data Processing Agreements, regularly audited.
Your Responsibility: Use strong unique password, enable 2FA (recommended), never share credentials, log out of shared devices, report suspicious activity to {{ support_email }}. Warning: StarShipDealers will NEVER ask for your password via email/support tickets (phishing).
Data Breach Notification (GDPR Article 33): Within 72 hours via email + Platform homepage notice. Notification includes: breach nature, consequences, mitigation measures, contact information. Your Action: Change password, enable 2FA, monitor accounts, contact [email protected]

We use cookies and tracking technologies to provide, secure, and improve our Platform. For comprehensive details, see our Cookie Policy at www.starshipdealers.com/legal/cookie-policy.
Essential Cookies (Always Active): Session management, CSRF tokens, language preferences, shopping cart. Legal basis: Legitimate interest.
Analytics Cookies (Optional): Google Analytics (anonymized IPs), page views, user flow. Legal basis: Consent (EU/EEA/UK). Opt-out: Cookie settings or Google Analytics Opt-Out.
Marketing Cookies (Optional): Google Ads, Facebook Pixel, retargeting. Legal basis: Consent (EU/EEA/UK). Opt-out: Cookie settings or browser settings.
Third-Party Cookies: PayPal, Stripe, Google may set cookies. See their privacy policies: PayPal, Stripe, Google.
Cookie Management: Cookie Settings banner (first visit), Account Settings > Privacy > Cookie Preferences, browser settings (may affect functionality).
Do Not Track (DNT): No industry standard exists. We do not alter data collection for DNT signals. Use cookie settings to control tracking.

StarShipDealers is NOT intended for children under 18 years. We do NOT knowingly collect data from anyone under 18. If you are under 18, you must NOT create an account, use the Platform, purchase/sell items, or submit personal information.
Parental Notice: If your child has provided us with personal data, contact [email protected] immediately. We will verify the claim, delete the account and data within 7 days, and refund transactions if applicable.
COPPA Compliance (US): We do NOT collect personal information from children under 13.

Scope: California residents have additional rights under CCPA/CPRA.
Categories of Personal Information Collected: See Section 4. Summary: Identifiers (username, email, IP), commercial information (purchase history), internet activity (browsing history), geolocation (IP-based), financial information (payment method, not card numbers), professional information (KYC: company name, VAT), biometric information (KYC selfies for sellers).

StarShipDealers reserves the right to modify this Privacy Policy at any time.
Material Changes (new data collection, rights changes): Email notification 30 days before effective date + Platform homepage notice + "Last Updated" date change.
Minor Changes (clarifications, typos): "Last Updated" date change only (no email).
Acceptance: Continuing to use the Platform after changes = acceptance.
Objection: You may delete account before changes take effect, withdraw consent, or exercise GDPR/CCPA rights (Sections 9, 13).
Version History: Previous versions archived, available at [email protected].

General Inquiries: [email protected] | www.starshipdealers.com/legal/privacy | [Your Complete Business Address]
Data Protection Officer (GDPR): [email protected] (subject: "GDPR Request" or "Privacy Inquiry"). Response: 5 business days (acknowledgment), 30 days (full response). Handles: GDPR rights, CCPA rights (California), privacy complaints, data breach inquiries, consent withdrawal, cookie preferences, account deletion.
Customer Support (Non-Privacy): {{ support_email }} (24-48h response). Handles: Order issues, technical support, dispute resolution, account recovery.
Legal Department: [email protected]. Handles: Legal compliance, law enforcement requests, subpoenas/court orders, intellectual property disputes.
Business Hours: Monday-Friday, 9:00 AM - 6:00 PM EST. GDPR Requests: Processed 24/7 (response within statutory timeframes).

Personal Data: Any information relating to an identified or identifiable natural person (e.g., name, email, IP address, transaction history).
Data Controller: The entity that determines the purposes and means of processing personal data (StarShipDealers).
Data Processor: A third party that processes personal data on behalf of the Data Controller (e.g., OVH, Railway, Stripe, Zoho).
Data Subject: The individual to whom personal data relates (you, the user).
Processing: Any operation performed on personal data (collection, storage, use, disclosure, deletion).
Consent: Freely given, specific, informed, and unambiguous indication of your agreement to processing.
Legitimate Interest: A lawful basis for processing when necessary for the legitimate interests of the Data Controller, balanced against your rights.
GDPR: General Data Protection Regulation (EU Regulation 2016/679).
CCPA: California Consumer Privacy Act (California Civil Code § 1798.100 et seq.).
COPPA: Children's Online Privacy Protection Act (US federal law).
KYC: Know Your Customer (identity verification process for sellers).
AML: Anti-Money Laundering (regulations to prevent financial crimes).
DPA: Data Protection Authority (government regulator for privacy/data protection).
DPO: Data Protection Officer (person responsible for data protection compliance).
SCC: Standard Contractual Clauses (EU-approved contracts for international data transfers).
PCI-DSS: Payment Card Industry Data Security Standard (security standards for handling credit card data).

This Privacy Policy complies with:
- General Data Protection Regulation (GDPR) - EU Regulation 2016/679
- California Consumer Privacy Act (CCPA) - California Civil Code § 1798.100–1798.199
- California Privacy Rights Act (CPRA) - Effective January 1, 2023
- Children's Online Privacy Protection Act (COPPA) - 15 U.S.C. §§ 6501–6506
- ePrivacy Directive - EU Directive 2002/58/EC (Cookie Law)
- Data Protection Act 2018 (UK)
- Delaware General Corporation Law (if incorporated in Delaware)
- Electronic Communications Privacy Act (ECPA) - 18 U.S.C. § 2510 et seq.

Effective Date: November 11, 2025
Last Updated: November 11, 2025
Version: 1.01
Document ID: PP-2025-101
For questions or concerns about this Privacy Policy, contact:
[email protected]