Privacy notice (draft)

DRAFT. A lawyer must review this notice before it is used. It is not legal advice. It describes the intended handling of personal data for BM-Price, operated by Amon Music OÜ, Estonia. Registry code: [registry code]. Registered address: [registered address].

This notice is written for the EU General Data Protection Regulation (GDPR) and the Estonian Personal Data Protection Act.

Who is the controller

Amon Music OÜ (Estonia) is the controller for personal data about accounts, sign-in, security, support, and the anonymised benchmarking described below.

Contact for privacy requests: [privacy contact email]. Postal address: [registered address].

When a seller organisation uses BM-Price, that organisation is the controller of the seller data it asks us to process (listings, prices, settings, and the membership list it manages). For that data, Amon Music OÜ is the processor and acts on the organisation's instructions, which are these terms, the product settings the organisation saves, and a written instruction from an owner or admin. This notice is also the short processing record for that relationship. A separate data-processing agreement can be signed on request; until then, Article 28 terms are the ones in the "Processor terms" section.

People this notice covers

• Users who create an account or are invited to an organisation (name, email, role, sign-in events).
• People whose data appears inside a seller's Back Market catalogue or listings, if the seller's payload contains any. Listing titles and SKUs are usually not personal data. If they are, the seller is the controller.

BM-Price is offered to businesses. It is not directed at children.

Data we process

Account and security data:

• Email address, display name, authentication identifiers from email, Google, or Microsoft.
• Password hashes, email confirmation, password reset, and optional TOTP secrets, stored by Supabase Auth. The BM-Price application database does not store passwords.
• Sign-in successes and failures, including IP address, for rate limiting.
• Audit events for credential and settings changes. The audit record does not contain the API key.

Seller organisation data, processed for the seller:

• Company name, VAT country, plan, status, members, and invitations.
• Margin rule, VAT rate, cost lines, and markets in scope.
• Back Market API user and API key, encrypted at rest, plus a short hint and the contact email used in the User-Agent. The key is write-only and is not returned to the browser.
• Listings (SKU, product ids, grade, new battery, market) and price snapshots (own price, price to win, winner price, winning flag, currency, fetch time), saved when the price changes. Buybox changes are stored with that history.
• Quality ratings entered by a platform admin (rating, date, who entered it).

Platform operation:

• Anonymised or aggregated statistics derived from saved listing and price data, for benchmarking by Amon Music OÜ. Aggregates are built so they do not name a seller, a user, or a listing.

Why we process it, and the lawful basis

As controller, Amon Music OÜ relies on:

• Article 6(1)(b) GDPR (contract): creating and running the user account, sending confirmation and reset emails, and providing the application the user signed up to.
• Article 6(1)(c) GDPR (legal obligation): keeping accounting and tax records if we bill the organisation. Estonian accounting law can require retention for up to 7 years.
• Article 6(1)(f) GDPR (legitimate interests): securing the service, limiting abusive sign-in, keeping an audit trail, and producing anonymised benchmarks from saved listing and price data. The interest is running a safe multi-seller tool and understanding the market without identifying a seller. Users can object as described below. We do not use this basis for a decision that produces legal effects about a person.

As processor, Amon Music OÜ processes seller organisation data only to provide BM-Price, to secure it, and to create the anonymised aggregates the seller is told about in the terms. We do not sell seller price rows. We do not show one seller's prices to another seller.

Saved listing and price data is stored. Amon Music OÜ may aggregate and analyse it. The result used for benchmarking is anonymised or aggregated. A seller's own screens show only that seller's rows.

Where it is processed

Amon Music OÜ hosts the service in the EU.

• Supabase (database, authentication, and related infrastructure) in the EU, Frankfurt, AWS region eu-central-1.
• Vercel (web application hosting) in the EU, region fra1 (Frankfurt).

These companies are sub-processors. A current list is this section. We will update this notice before adding a sub-processor that changes the processing in a material way, and we will tell organisation owners by email.

If a sub-processor transfers personal data outside the European Economic Area, the transfer uses the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914): Module 2 where Amon Music OÜ is controller and the recipient is processor, and Module 3 where Amon Music OÜ is processor and the recipient is a further processor, plus supplementary measures where a transfer assessment shows they are needed. The intended regions above are inside the EU, so a transfer is not the normal path.

Google and Microsoft process the sign-in if you choose those buttons, under their own notices, and then Supabase Auth stores the resulting identity.

Retention

• API credentials: deleted when the owner disconnects Back Market, and deleted with the organisation.
• Seller organisation data (listings, prices, settings, memberships): deleted within 30 days after the organisation is closed.
• Anonymised aggregates that no longer identify a person or a seller: may be kept.
• Login attempts: 30 days.
• Audit log: about 24 months.
• Accounting records, if we bill: up to 7 years.
• Backups: about 7 to 30 days, then overwritten.

Your rights

Under the GDPR you can ask to access, rectify, erase, or restrict personal data, to object to legitimate-interest processing, and to receive portable data you provided, where those rights apply. You can withdraw consent where processing is based on consent. Sign-in with Google or Microsoft can be stopped by disconnecting that identity; email and password does not rely on consent.

Where Amon Music OÜ is processor, we will forward a request that belongs to the seller organisation, or help that organisation answer it. Where we are controller, write to [privacy contact email]. We may need to confirm that the request comes from you. We answer within one month, unless the GDPR allows an extension.

You can lodge a complaint with the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon, https://www.aki.ee, or with the supervisory authority of your habitual residence or place of work in the EU.

Security

Access to tenant tables is restricted by row-level security so a seller sees only its organisations. Platform administrators can read stored prices across organisations for support and operations. They do not receive the Back Market API key. The key is encrypted with an application envelope key. It is not written to URLs or logs.

Processor terms (Article 28)

For seller organisation data, Amon Music OÜ will:

• process it only on the documented instructions of the seller, including these terms, unless EU or Estonian law requires otherwise, in which case we tell the seller unless the law forbids it;
• ensure that people who process it are bound to confidentiality;
• apply the security measures described above;
• use the sub-processors named in this notice, and impose data-protection terms on them;
• assist the seller with data-subject requests, security incidents, and impact assessments, taking into account the nature of the processing;
• at the seller's choice, delete or return the data at the end of the service, subject to the retention section;
• make available the information needed to show compliance, and allow an audit on reasonable notice, not more than once a year unless a regulator or an incident requires it.

The seller's instructions include the production of anonymised aggregates for benchmarking, as disclosed in the terms and in this notice.

Changes

We will replace this draft with a lawyer-reviewed notice before production use. The date of the reviewed notice will be shown at the top.