Privacy Policy

When you use our Services, you entrust us with your personal data. “Personal data” means any information relating to you as an individual. Below, we explain how we collect and protect such data.

In this Privacy Policy, the following terms shall apply:

• “refurbed” / “we” / “us”: means Refurbed Marketplace GmbH as the operator of the Platform. Where “refurbed” is used as a brand or platform, this refers to the online marketplace under the refurbed brand.
• “refurbed Group”: the companies affiliated with Refurbed Marketplace GmbH within the group, in particular: Refurbed GmbH; Refurbed Direct GmbH; Refurbed Plus GmbH; Refurbed Deutschland GmbH.
• “Platform”: our websites and apps, including the functions available thereon.
• “Services”: all services we offer via the Platform or in connection with it.
• “Seller”: a company that sells products to you via the Platform or purchases products from you. For processing operations in connection with purchase or sale processes, Refurbed Marketplace GmbH and the respective Seller are joint controllers.
• “Partner Company”: companies that support us and the Sellers in providing or improving our Services and process personal data as data processors.
• “BuyBack Program”: the service through which you can offer a device to us for purchase or sell it to us.
• “personal data”: any information relating to an identified or identifiable natural person.
• “you” / “User”: any person who uses the Platform or the Services.

When does this Privacy Policy apply?

In this Privacy Policy, we describe how refurbed, the Sellers and the Partner Companies handle and protect your personal data. This Privacy Policy applies in particular to you if:

• you purchase products from us or the Sellers on our Platform;
• visit our websites;
• use our app;
• communicate with us electronically or by telephone.

Some of our services that you can use are subject to a separate privacy policy and we will inform you separately if this is the case. This Privacy Policy is intended to inform you about our data processing within the framework of data protection laws such as the GDPR. Please also read our Cookie Policy and our General Terms and Conditions.

To which data does this Privacy Policy apply?

In connection with the use of our Services (including the use of our websites or apps), we generally collect various types of personal data, including:

• general information (such as your name);
• contact data (such as your email address);
• transaction data (such as the products you purchase via our Platform);
• usage data (such as your interaction with our Services).

Who processes your data and who is responsible?

If you purchase products from a Seller via our Platform or sell products to a Seller, the

Refurbed Marketplace GmbH

Jakov-Lind-Straße 7, 1020 Vienna Austria

E-mail: dataprotection@refurbed.com

Website: www.refurbed.com

and the respective Seller process certain personal data as joint controllers within the meaning of Article 26 GDPR. This means that refurbed and the Seller determine how and why your personal data is used.

In particular, refurbed is responsible for collecting customer data via the Platform, providing the data protection information, and, together with the Seller, handling customer inquiries and complaints. In particular, the respective Seller is responsible for invoicing as well as handling warranty and guarantee cases. If you make use of certain other services offered via the Platform, your personal data may be processed by another company in the refurbed Group.

refurbed acts as the central point of contact for the exercise of your data protection rights. However, you may also assert your rights at any time vis-à-vis the respective Seller. We have contractually ensured with our Sellers that corresponding requests are processed properly.

Please read this Privacy Policy and be aware that your personal data may lawfully be disclosed to others, including Partner Companies (see section 4.), other companies of the refurbed Group and the Seller from which you purchase via our Platform.

When we provide our Platform services, we process various types of information and this information reaches us in different ways.

2.1. Data we receive directly from you

Most of the personal data we process is information that we have received directly from you.

Data you provide when purchasing on our Platform

If you purchase products from a Seller or directly from refurbed via our Platform, we collect and generate personal data that we use to process the transaction. During the ordering process, you provide us with the following information:

• general information including your preferred form of address, your first and last name;
• postal address, including your street, postal code and your country;
• contact information, including your e-mail address and your telephone number;
• invoicing data including, if required, a separate name and address and, where applicable, a tax number for invoicing;
• order information including the refurbished products you wish to purchase and their prices;
• payment information, i.e. your payment method and whether the payment was successful.

Payment processing is carried out by our payment service providers; refurbed does not receive any further information about your credit card, creditworthiness or similar.

In accordance with our General Terms and Conditions, you may create a user account for yourself using the information you provide to us during the ordering process, so that you can view your order data online at a later date, even if you have not completed your purchase.

Data you provide when visiting our website

When you visit a website, you leave a digital footprint. On our website, we collect information through website analytics tools or other technical means such as cookies and pixels. In this way, we receive certain information from you, namely visitor information including your IP address as well as the date and time of the website visit.

When you visit our website for the first time, you will be asked to provide your preferences regarding cookies. Your choice determines how much additional information (e.g. data about visitor behaviour) we will collect and process from you. Please be sure to read our Cookie Policy to obtain further information and to understand that certain cookies and data processing operations do not require your consent.

Data you provide when selling via our BuyBack Program

If you sell us your old device or offer it for sale, you share with us information related to this transaction, namely:

• general information including your first and last name;
• address data, including your street, city and your country; payment information, including your IBAN;
• device data including the function, specification and quality of your device;
• price information including the estimated purchase price.

If you exceed a certain threshold of sales under our BuyBack Program, we are legally obliged to collect additional information from you. If applicable, we will inform you accordingly.

Other data

In order to assist you with your inquiries, whether you are already a customer or not, we offer you various ways to contact us or the Sellers. You can contact us for many reasons and most of them result in us processing some of your personal data.

For example, you can contact us via:

• our web form;
• your customer account;
• by e-mail or by telephone;

in such inquiries, we generally process your name, your contact information and the message you provide to us. We or a Seller may ask you to provide identity documents if there is a dispute in connection with a delivery or if we need to establish your identity when, for example, you exercise your rights under the GDPR.

2.2. Data we generate in the provision of our services

When providing our Services to you, we sometimes also generate additional information relating to you. For example:

• we may assign an order number to your purchases;
• intervene on your behalf if there is a dispute with a Seller and create a corresponding record in our records;
• adapt our communication with you based on your previous interactions with our Services;
• collect usage data when you visit our website.

2.3. Data we receive from other sources

In certain cases, we process information that we have received from other trusted sources in order to update or supplement the information you provide to us. For example:

• we may receive additional information about you when we carry out risk and fraud prevention processes (in cooperation with our Partner Companies);
• when we communicate with logistics Partner Companies regarding the shipment of goods purchased by you;
• when you download our app from a third party.

We process your personal data to provide you with a great experience when you use our Services. More precisely, parts of your personal data are processed for different purposes, and this affects how your personal data is stored and disclosed and which rights you have.

We process your data to fulfil our contractual obligations towards you

When you use our Platform, you request that we connect you with our Sellers or provide you with other services that we can offer. In order to provide you with these services, it is necessary for us to process some of your personal data. This also includes the steps you take before entering into a contract with us or via our Platform. For example:

• we must process some of your personal data when you make a purchase;
• create a user account;
• browse our website;
• sell a product back to us via our BuyBack Program;
• assert your statutory warranty rights or your guarantee rights.

We process your data when you have given your explicit consent

We work hard to make your experience on our Platform as good as possible. Some of our efforts for which we use your personal data are not strictly necessary for you to use our service. Therefore, we ask for your permission to ensure that you agree. For example:

• with your permission we will process some of your personal data when you sign up for our newsletter or other direct marketing activities;
• consent to the optional cookies and technical analytics tools in our cookie banner (be sure to read our Cookie Policy!);
• respond to one of our surveys.

We process your data when we are legally obliged to do so

Like everyone else, we are subject to rules and laws depending on where we are located, in which countries we operate and which services we offer. In certain cases, we are legally obliged to process some of your personal data. For example:

• we will process some of your personal data in order to comply with general record-keeping and accounting obligations in connection with sales on our Platform;
• reporting obligations in connection with our BuyBack Program;
• processing obligations in connection with the exercise of your rights (including your requests as a data subject within the meaning of applicable data protection laws).

We process your data when we have a legitimate interest

Where we process personal data that does not fall into any of the categories described above, we do so on the basis of our legitimate interest as a company. This helps us improve our service and provide our users with a safe and enjoyable experience. We will only rely on our legitimate interest if we are convinced that this can be reconciled with your interests, rights or fundamental freedoms (including your right to privacy). For example, we will process some of your personal data on the basis of our legitimate interests in order to:

• analyse how you use our Platform;
• improve our customer service for you;
• collect your feedback via reviews or services;
• categorise user data for internal purposes;
• prevent fraud and other risks, and protect our technical infrastructure and the integrity of our Services.

Under our refurbed brand, our Services are provided to you by a group of companies. We will share information among these companies where they are involved in the Services we provide to you. Beyond refurbed, we only share your personal data under certain circumstances and only on a legal basis (including our legitimate interests as a company), taking into account your expectations regarding our commitment to your privacy.

With whom do we share your data?

As a Platform, we connect you with our Sellers from whom you purchase products and Partner Companies that help us improve or provide our Services. In doing so, we share some of your personal data with them. In order for you to be able to make an informed decision about how and where you disclose your personal data, it is important that you know with which categories of recipients refurbed shares your personal data:

• Sellers, who sell via the Platform and are jointly responsible with refurbed for data processing (see item 1.);
• logistics companies, which ship products purchased by you to you (e.g. DHL);
• payment service providers, which process your payments (e.g. PayPal, Stripe, Klarna);
• insurance companies, which provide you with additional protection for the products you purchase (e.g. our insurance partners Bolttech and Evy);
• web analytics providers, which help us collect information on how our Services are used and provide us with tools for this purpose (e.g. Google Analytics, Microsoft Clarity);
• business process outsourcers, which help us provide you with first-class customer service (e.g. call centres);
• authorities, meaning public bodies, including courts, that have the right to access or grant access to the personal data stored by us;
• advertising partners, meaning companies, including social networks, that help us create and improve effective communication with our customers on the basis of your personal data (if you have consented to this).

We may disclose your personal data to other third parties if you permit us to do so. Where we disclose your personal data to our Partner Companies providing services to us, these recipients are legally and contractually obliged to keep your personal data secure and to use it only for the purposes required by us or by law. We serve customers in various markets and countries. Our Partner Companies providing services to us and our Sellers from whom you can purchase products are also located in various countries. As a result, your personal data may be transferred to parties within and outside the European Union.

Where is your data transferred to?

At refurbed, we are aware of your digital footprint and your expectations regarding data protection and therefore select our Partner Companies carefully. Your personal data will primarily be transferred to recipients within the European Union.

Some of our Partner Companies may also be located outside the European Union, and we may disclose your personal data to them when providing our Services to you. This may also include the Seller from which you purchase a product on our Platform.

Where your personal data is transferred outside the European Union, this shall take place on the basis of an adequacy decision of the European Commission, or appropriate safeguards such as Standard Contractual Clauses.

Wherever your personal data is sent, refurbed requires its Sellers and Partner Companies to adhere to high standards of data security and data protection in order to meet your expectations regarding data protection.

We will only retain your personal data for as long as required by the purpose of our processing (including our legitimate interests as a company), the nature of the information and the nature of the data subject (e.g. prospect, former purchaser) that you are in this context. We will delete all of your personal data once this is no longer the case. You should be aware that this may mean that we anonymise your personal data or aggregate it in such a way that the resulting information can no longer be associated with you.

You have the right to request the erasure of your personal data. You should be aware that, in some cases, we are obliged to retain information even if you ask us to erase it. As long as we process your personal data, your data is secure with us. We take all necessary measures and precautions to protect your personal data, including all appropriate technical and organisational security measures.

When it comes to your personal data, you are in control. Under the law, as a data subject you have rights in relation to your personal data that we process.

What rights do you have as a data subject?

Right to erasure of your data: 

You may request the erasure of your personal data. Please understand that we may be legally obliged to retain certain personal data; in that case, we will restrict the processing of your personal data to the legally required minimum.

Right to restriction of processing of your data:

You may request that we restrict the processing of your personal data if you do not want your personal data to be erased. Please understand that refurbed may in any case decide to erase your personal data in accordance with our General Terms and Conditions.

Right to rectification of your data: 

You may request the rectification of personal data that is inaccurate or incomplete.

Right to object to processing on the basis of refurbed’s legitimate interests: 

In cases where we rely on our legitimate interests, you may object to such processing and we will cease it unless we can demonstrate compelling legitimate grounds that override your prevailing interest.

Right to information about the personal data we process: 

You may request information about your rights and our data processing operations, including a copy of your personal data that we process. We will provide you with this information in electronic form. You should know that, if you have given us consent to process your personal data, you may withdraw it at any time.

You may exercise your rights by contacting us directly via dataprotection@refurbed.com or through one of our other channels. You should know that, in many cases, you can also take steps directly; for example, you can withdraw your consent for direct marketing messages via the corresponding link in our emails, you can change your personal data in your user account and you can change your choice regarding cookies on our Cookie Policy website. (Cookies are files on your computer and you can delete them yourself at any time).

What complaint options do you have?

We want to ensure that your use of our Services meets your high expectations and we welcome any feedback. We encourage you to contact us at dataprotection@refurbed.com or via one of our other channels through which you communicate with us. You have the right to lodge a complaint with a data protection authority if you believe that we are not complying with our data protection obligations. refurbed is an Austrian company and the competent data protection authority is the following body:

Austrian Data Protection Authority (DSB)

Barichgasse 40-42 1030 Vienna

Telephone: +43 1 52 152-0

E-mail: dsb@dsb.gv.at

You should know that you can lodge a complaint with any data protection authority competent for your place of residence, which will then be forwarded accordingly. If you have any questions regarding this, the data protection authorities can provide additional assistance.

We use AI-assisted tools to support our customer-facing services. This includes, but is not limited to, automated processing of customer support interactions (such as summarisation, classification, prioritisation, and order identification), AI-powered chat and voice assistants, quality assurance and interaction analysis, and AI-assisted translation and communication tools.

The legal basis for AI-related processing of your personal data is contract performance (Art. 6(1)(b) GDPR) where the processing is necessary to handle your enquiry or fulfil your order, or our legitimate interest in providing efficient, high-quality, and personalised customer service (Art. 6(1)(f) GDPR). We do not use AI to make solely automated decisions.

AI features are powered in part by third-party processors. Where processors are located outside the EEA, transfers are made under EU Standard Contractual Clauses or other appropriate safeguards.

If you have any questions or wish to exercise your rights in relation to your personal data, you may contact us using the contact details below:

Refurbed Marketplace GmbH

Jakov-Lind-Straße 7 1020 Vienna Austria

E-mail: dataprotection@refurbed.com

We may update this Privacy Policy from time to time so that it appropriately reflects how we process your personal data. If this happens, we will publish the updated version on our website. We recommend that you read this Privacy Policy regularly.