How A&A-EUcoins uses and protects personal data

A&A-EUcoins

Einzelunternehmen

Proprietor: Aliaksandr Dziatlau

Karlstr. 2, 27607 Geestland, Deutschland

Email: aa.eucoins@gmail.com

Phone: +49 176 41444558

Account data (name, email, country and password hash), profile and shipping data, seller checks, listings, bids, orders, messages, reports and technical security data are processed only for the relevant platform functions.

In the P2P model, item-payment details are exchanged directly between the parties. A&A-EUcoins does not store full card details or accept item payments.

Necessary transaction emails cover registration and security, purchases or sales, payment, shipping, disputes and the first unread chat event. Chat contents are not copied into email; further unread chat messages are rate-limited. These service messages contain no advertising. Marketing email is sent only after separate consent.

Contract and pre-contract steps (GDPR Article 6(1)(b)): account, auction, order and communication. Legal obligation (c): tax, commercial, authority and platform duties. Legitimate interests (f): IT security, fraud prevention, abuse prevention and legal claims. Consent (a): optional analytics and marketing only.

Data is shared only with the necessary contracting party, instructed hosting/email/IT providers and legally authorised bodies. Brevo is used as the SMTP processor for transactional email; the recipient address, subject, necessary message content and technical delivery metadata are transferred, but not passwords or full payment data. Payments for A&A-EUcoins' own platform services (buyer access, promotions, banners, software licences and seller commissions) open a page hosted by the payment provider or an embedded payment form, depending on the payment flow. The embedded form loads only when opening payment; the payment provider may process technical device, browser and security data for payment processing and fraud prevention. A&A-EUcoins sends or receives the internal customer and payment reference, service, amount, currency, payment status and limited billing or contact data required for the transaction. Full card numbers and CVV are neither sent to nor stored by A&A-EUcoins. The payment provider's privacy and transfer information applies and is available on the payment page. The legal bases are GDPR Article 6(1)(b) for contract performance, (c) for accounting and evidence obligations and, where applicable, (f) for fraud prevention and security. Processing arrangements, subprocessors and any third-country safeguards must remain documented. Transfers outside the EU/EEA use a lawful mechanism and required safeguards.

Services used where enabled: Stripe Payments Europe, Ltd. (Ireland) for payments for the platform's own services; Cloudflare, Inc. for the Turnstile bot protection at sign-in and registration (IP address, browser and device characteristics; GDPR Art. 6(1)(f)) and for storing images and videos; Brevo (Sendinblue SAS, France) or Google Ireland Ltd. (Gmail SMTP) for service emails; Google Cloud Translation or a self-hosted LibreTranslate service for automatic translation of listing texts and reviews, transmitting only the text to be translated; Google Analytics 4 (Google Ireland Ltd.) for visit statistics only after your consent (GDPR Art. 6(1)(a), TDDDG section 25(1)), where enabled; Telegram (Telegram FZ-LLC, United Arab Emirates) only if you connect the bot yourself in your profile: the chat ID, @username and connection time are stored, and the text of your notifications is sent according to your notification settings (GDPR Art. 6(1)(a); withdraw at any time in your profile or with /stop in the bot). The transfer to Telegram takes place at your request (GDPR Art. 49(1)(a)); Telegram's privacy policy applies to its own processing. The public Telegram group shows only the listing, the price and the seller's public short name (GDPR Art. 6(1)(f)). Where data reaches the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses.

Account data is generally processed until account deletion. German tax accounting vouchers are generally retained for eight years, books and records for ten years, and commercial or business correspondence for six years from the statutory starting point (AO section 147; HGB section 257). Order chats remain available during the active order and are retained until the end of the third calendar year following the year of completion or cancellation. An open dispute, message report, or documented legal hold pauses deletion only for the affected chat; after closure or release, the same period is calculated from that event. Where A&A-EUcoins is a reporting platform operator, PStTG records are retained for ten years and then deleted (PStTG section 24). Other contract, dispute and security data follows a documented purpose-specific deletion schedule. Backups rotate.

Subject to the legal requirements, you have rights to access, rectification, erasure, restriction of processing and data portability, and the right to object. You may withdraw consent at any time with effect for the future. In particular, you may file a complaint with the Lower Saxony data protection authority: Open official source. Contact A&A-EUcoins: aa.eucoins@gmail.com.

Messages are not end-to-end encrypted. Authorised staff may access them only to handle a report, dispute, security case or lawful request; access to sensitive areas is logged.

Automated risk signals may prioritise or provisionally restrict content. A solely automated decision with legal or similarly significant effect is not intended; affected users may request human review.

At registration A&A-EUcoins records the document version, language, timestamp, minimised technical metadata and a SHA-256 proof of the displayed text. The privacy notice is acknowledged; it is not blanket consent for required processing. Marketing remains separate and optional.

For seller verification A&A-EUcoins processes contact and company data, proof of email control, result references for identity and liveness checks, representative authority, payment-account ownership, official register and tax checks, sanctions screening, and the trader's self-certification of compliance with Union law. Passport or ID scans are not currently uploaded through the seller profile. Raw identity documents must not be sent by ordinary email; identity evidence is checked through a specialist verification service or a separately agreed secure channel. A&A-EUcoins stores only dated result IDs or protected references and the check outcome.

The resulting verification status and date are public, and for traders the seller profile (linked from every listing) shows the company name, legal form, address, telephone number and email address that consumers must receive before contracting (Art. 246a § 1 EGBGB; GDPR Art. 6(1)(c)). The buyer receives delivery and payment details inside the relevant order where needed to complete it. Identity documents, liveness data, payment/bank data, tax data, internal references and review notes are not public. Verification is a best-efforts plausibility assessment, not a guarantee of delivery, solvency or refund.

Material changes are published transparently under a new version. Where fresh agreement to contract terms is required, it is requested separately; continued use alone does not replace required agreement.

A&A-EUcoins does not disclose data on an informal request or an allegation alone. Each request is checked for the authority's identity and competence, legal basis, case reference, scope, time period, proportionality, territorial jurisdiction, and any non-disclosure duty. Where legally permitted, overbroad requests are rejected or narrowed.

A valid legal order may require preservation and disclosure of specifically identified account, seller, listing, bid, order, message, platform-payment, and security data. Affected persons are informed where legally permitted; binding non-disclosure obligations are respected. Access and disclosure are logged.

A documented legal hold pauses routine deletion only for the affected records and only while preservation is necessary. The deletion schedule resumes when the hold ends. A&A-EUcoins does not collect extra data merely for a hypothetical future authority request.

A&A-EUcoins does not collect full card or CVV data, plaintext passwords, private communications outside A&A-EUcoins, address books, persistent precise location, criminal-record data, or biometric templates unless a separate mandatory legal basis and documented necessity applies. Identity documents should primarily be processed by a contracted verification provider; where possible A&A-EUcoins stores only the result, provider reference, and necessary evidence.

Appointment is assessed under GDPR Article 37 and additionally BDSG section 38. It is required in particular where at least 20 persons regularly and continuously process personal data by automated means, or regardless of headcount where a data-protection impact assessment is mandatory. Contact details are published only when the role is actually appointed and notified to the authority.

Optional. We show a random pseudonym and the average rating of completed purchases: at least 5 reviews from 3 sellers, rating at least 4.7. Name, photo, profile, orders and spending remain private. No effect on purchases; withdraw consent here at any time.

Publication relies on separate consent (GDPR Article 6(1)(a)). A pseudonym does not guarantee anonymity. Withdrawal ends further displays; minimal consent evidence is retained. Completed-order reviews determine selection, never buying rights or service conditions. Contact support to correct underlying reviews.

Full legal name, country of establishment, billing address, VAT ID where applicable and business evidence are processed for contract formation and performance, invoicing and statutory tax duties under GDPR Article 6(1)(b) and (c). VAT IDs and necessary company details may be transmitted to VIES and national registries for tax verification.

Verification results and payment tax grounds are recorded at order time. Access is restricted to authorised administrators; the payment provider processes card data. Invoices are retained for the statutory period, generally eight years from the end of their year of issue under UStG section 14b, subject to longer statutory duties or disputes. Account deletion does not override mandatory financial-document retention. Service-balance records (top-ups, spending, refunds, PDF confirmations) are retained eight years from the end of the year of the record (section 147 AO).

Activation and revocation of automatic commission payments are recorded as separate entries with the seller identifier, timestamp, payment mode and terms version. These records evidence the payment mandate and its revocation; corrections are made through new entries while preserving history.

Payment directly to a seller does not, by itself, exempt a platform from PStTG/DAC7 duties. Where reporting-platform duties apply, the law requires seller information to be checked and prescribed data to be submitted to the competent tax authority. In Germany this is the Bundeszentralamt für Steuern (BZSt).

For sales of goods, the small-activity exclusion applies only if both conditions are met during the reporting period: fewer than 30 sales and less than €2,000 in total consideration paid or credited. Exactly 30 sales or exactly €2,000 do not meet this exclusion. These are reporting thresholds, not tax-free income allowances.

Where the law applies, reporting covers the identity or company details, address, tax identifiers and residence required by section 14, together with available financial-account details and quarterly consideration, transaction counts and fees charged. These details are not published in listings. Reporting is generally due by 31 January of the following year; sellers receive the legally required information about the reported data. Records are retained for ten years from the end of the year they were created. Individual records under section 24(1), points 2–5, are then deleted unless another applicable legal basis requires retention.

Official legislation: Open official source · Open official source · Open official source · Open official source · Open official source · Open official source