Privacy Policy

Philmarket Oy (business ID 3636423-6), Finland, is the controller for the processing of personal data on philmarket.eu — yours as a user, and data about other people who appear on items sold here, such as a name and address on a letter. Contact: the data protection form or privacy@philmarket.eu.

Our Facebook Page. We have a Page on Facebook where we post about the marketplace. When you visit or react to the Page, Meta Platforms Ireland Ltd produces statistics about how the Page is used (Page Insights). For those statistics, Philmarket and Meta are joint controllers (Art. 26 GDPR). Under our agreement with Meta, the Page Insights Controller Addendum, Meta has primary responsibility for the processing, for informing you about it and for handling your rights. You can contact Meta or us, and we pass on what belongs to Meta. We receive the statistics only in aggregate, and they don't show who visited the Page. Comments and reactions on the Page are visible to us and to others, like anything you post on Facebook. For our part, the legal basis is our legitimate interest in knowing how our posts reach people (Art. 6(1)(f)). We don't use the Meta Pixel or any other Meta tool on philmarket.eu, and we don't pass any data about you from Philmarket to Meta. How Meta itself processes the data is set out in Meta's privacy policy.

Account data: Email address and name (optional). If you sell as a private individual, you also choose a display name before your first listing is published (see below). If you change your email address, we keep the new address and a checksum of the code until the code is used or expires, and your previous address for seven days after the change, so that the change can be undone.

Transaction data: Bids, purchases, payment status, amounts.

Review of high-value sales: If a purchase amounts to €10,000 or more, or we grant a listing an exception from the value cap, we record it for manual review. The record names the buyer and the seller, the amount and our assessment. We keep it for six years from the record.

Delivery address: The addresses you save on your account, one of them the default. When you buy, the default is copied to the order, and you can choose another on the order until you pay – once the seller has issued the invoice, only one in the same country, because how the invoice treats VAT depends on the country the item is sent to; after that the address is fixed. The seller in the deal sees only the address for that purchase, and only once the contract has been concluded – never your other saved addresses. If you pay by card, we send the address to Stripe with the payment, so that it is on record if the purchase is disputed. Your saved addresses stay until you remove them or delete your account. We keep the address on an order for 540 days from payment, because a card payment can be disputed for that long; if a dispute is open, we keep it until it has been decided and for 90 days more. This applies even if you delete your account. An order that was never paid keeps no address once it has ended.

Payment account with Stripe: When you connect an account as a seller, Stripe checks your identity for payments under its own obligations. We store the connected account's id and whether the account can take payments. We do not carry out our own identity check with an ID document or a face image.

Where you sell from: As a seller you must live or be established in the EU and ship from there (Terms §5). To see that this holds, we read two details our payment provider holds about you: the country in the address it has checked, and the country of the bank account your payouts go to. We read only the country and whether the postcode belongs to an area outside the EU VAT area — never the address itself or the account number — and keep only the country, that answer and when we saw it. If either is outside the EU, or the address is in such an area or in a different country from the one you gave us, we ask you to confirm where you live and ship from, and a person at Philmarket looks at the matter. If the address is outside the EU or in such an area, your selling is also paused (Terms §10(o)); otherwise the detail does not by itself pause it. We keep only the latest detail, and delete it when you delete your account.

Bank account for a refund: If a refund to your card does not go through, we ask for a bank account (IBAN) to pay it back to, and the account holder's name if the account is not in your name. We use these details only to pay the refund. They are stored encrypted and read only by the person making the payment. The recipient is our bank, which carries out the transfer; our payment provider does not receive them. The account number and the name are kept until the refund has been paid and are then deleted, and in any event kept for no more than twelve months. Only the last four characters of the account number stay on the order, as a record of where the money went, for as long as the order is kept.

Payment method for return postage: If you claim return postage from a seller after withdrawing from a purchase (Terms §7), you give the way the seller is to pay you, for example an account number (IBAN). It is stored encrypted and shown only to the seller, and only while the claim is unpaid. It is deleted when you confirm that the claim has been paid, when we close the case or when you remove it yourself, and in any event no later than twelve months after you gave it. Only its last four characters and when you gave it stay on the claim, as a record of where the money was to go, for as long as the order is kept.

Listing content: Title, description, images, catalogue numbers. A listing that has sold is shown to everyone for 60 days after the sale and after that only to the buyer and the seller. Three years after the sale we delete its images and text. The price, category and date are kept for price statistics.

Messages between users: the content of the messages you send through the platform, and information about them — when they were sent, who the other party is and which listing they concern. We keep them for three years after the last completed deal in the conversation, because they are the record if you or the other party later has a claim against the other; after that they are deleted. A conversation that never led to a deal is kept while both accounts exist, and is deleted when either account is closed.

Messages to us: What you write in the contact form or the suggestion box. The contact form also asks for your name and email address so that we can reply. If you make a data protection request it also asks which right it concerns, and if you are signed in the message is linked to your account. The suggestion box asks for nothing about you and is not linked to your account. We delete suggestions once we have dealt with them, and no later than twelve months after we received them. Messages and suggestions that are spam we delete after 30 days. We delete other messages twelve months after the matter was closed. How long a data protection request is kept is set out in section 6. To stop spam we use your IP address, or your account if you are signed in, for no more than one hour. It is not stored in our database.

Protection against overload and abuse: When you use the service, for example when you sign in, upload images or write to us, we keep your IP address for no more than one hour, so that we can limit the number of requests from the same address. The address is deleted automatically when that time has passed and is not used for any other purpose. A copy may remain in the server's working file on disk for up to one day before it is overwritten. We do this on the basis of our legitimate interest in protecting the service (Art. 6(1)(f) GDPR).

Server logs: Our web servers write a line in a server log for every request to philmarket.eu, including to the analytics tool on stats.philmarket.eu. The line contains your IP address, the time, the address you requested and your browser. We use the log to detect and investigate faults and attacks, and delete the line with your IP address after no more than 7 days. We do this on the basis of our legitimate interest in protecting and operating the service (Art. 6(1)(f) GDPR).

Return receipt: If you withdraw from a purchase and the seller wants the item back, you can upload a receipt showing that you sent it, such as the postal receipt. It normally carries the sender's and the recipient's name and address. We keep it encrypted, and it can be read by you, the seller and whoever handles the case at our end. It is the record if the refund or the return is later disputed, so we keep it for three years after the return was closed, even if you delete your account; after that it is deleted.

Seller statistics: For sellers, we derive figures from your own orders — including how often an order did not complete — and publish some of them on your public profile under the rule in § 5 of the Terms.

Tax details for sellers: the details the law requires us to report are collected at different points depending on your tier: on tiers above Start when you publish your first listing; on Start we ask for them at your first listing and require them as your sales for the year approach the DAC7 thresholds (30 sales or €2,000). The details are: name, address, date and place of birth, your tax identification number (TIN, the number that identifies you for tax in your country of residence — for many individuals the same as their national ID number) and the state that issued it, for companies also the registration number and the states in which you have a permanent establishment, and, if you choose to give it, the account the payout goes to together with the account holder’s name — the law asks for the account only to the extent it is available. We do so because we are obliged to: the reporting duty on platform operators under Act 1267/2022 and Council Directive (EU) 2021/514. The tax identification number, the date of birth and the account number are stored encrypted and are read only when the report is compiled and when its format is checked against the European Commission's service. We also store the outcome of the format check and, if your tax number was issued in a different EU country from yours, that you confirmed both countries. The details are submitted annually to the Finnish Tax Administration, which in turn shares them with the tax authority in your state of residence. We keep your tax details for six years after the end of the last calendar year in which we applied the tax due-diligence checks to you. This applies even if you never became reportable, because we must be able to show the Finnish Tax Administration why we did not report you.

Review of your tax number: If the European Commission's service says that your tax number is not valid although it passes our own check of how the number is built, or says so of a number we accepted earlier, a person at Philmarket reviews the number. If a rejected number stops your listing from being published, you can ask for a review yourself. We keep why the review was opened and when, who reviewed it and what was decided, and what the decision was based on: the kind of evidence (a register extract showing only the name and the number, a trade register extract, a personal identity code from strong electronic identification, or another ground, which we then write down), a description of the document, its year and whether the number matched character by character. We do not keep a copy of the document. The decision and what it was based on are kept for as long as your tax details (see above). To keep to the time limits for the review we also keep a case log: when the case was opened, when a person looked at it and when it was closed, and who at Philmarket did so. The log is deleted twelve months after the case was closed. If you delete your account, the log is deleted at once.

Information that prevents a new registration: If your seller account has been closed because the tax details were not provided (Terms §10(k)), we compare new seller accounts against the information about you that we and our payment provider already hold, in order to prevent a registration the law requires us to prevent. The comparison uses one-way codes of the bank account your payouts go to and of your phone number. The code of the phone number is computed only when the account is closed, from the checksum we already hold (see "Data we check without storing"), and is used only for the comparison. This comparison happens only in that situation and only for seller accounts; what we keep when an account is closed for other reasons is set out under "Data from an account we closed". It ends when you provide the information, and in any event six years after the closure.

Data that links accounts: When you pay, our payment provider stores a code that is the same for every payment made with the same card, and when you sell it does the same for the bank account your payouts go to. We receive each code in one-way computed form and use it only to see whether several accounts pay with the same card or are paid out to the same bank account, because you may not hold several accounts in the same capacity with us (Terms §2). Neither code says it is the same person, only that it is the same card or the same bank account. The card code and the payout code are also used to check that the free month is given only to new sellers: before you take out the subscription, and once more when it has started, against the card you gave. What happens on a match is set out in Terms §5. We never receive the card number, and the payout code is neither the account number nor taken from the tax details you give us. The card code is kept for 24 months from the card's last use, or for 12 months after your last purchase if that falls earlier. The payout code is kept for as long as your account exists (see section 6 for what happens when you delete it). A flag nobody has decided is closed after 90 days, and the evidence is deleted then under the same rule.

Data from an account we closed: If we suspend or close an account under Terms §10, we keep one-way codes of the account's phone number and of the cards that paid on it, together with the ground and the date — no name and no link to the account. We compare new accounts against them to see whether the same person is returning; what happens on a match is set out in Terms §2. The codes are kept for six years if the ground is (a), (b), (d), (e), (f) or (k) in §10, and otherwise for 24 months. If the suspension is lifted, they are deleted.

Warnings and restrictions under Terms §10: the ground, the circumstances, your answer and our decision. They are kept for 42 months after the last event in the matter, also if you close your account, so that a claim concerning the measure can be made or answered (Art. 17.3 e).

Review of a decision about your account: If you ask us to review a decision about your account or your listings, for example a suspension, we keep your request, what you write in it, the documents you upload and our note on the decision. The documents are stored encrypted, only you and the person deciding the review can see them, and they are deleted 30 days after the review has been decided. The request, your text and our note are kept for 42 months after the decision, also if you close your account, so that a claim concerning the decision can be made or answered (Art. 17(3)(e)). If the review is never decided, the time runs from the last event in the case, or from when you closed your account if that was later.

Checks against sanctions lists: We compare names with the EU sanctions lists and the National Bureau of Investigation's register of freezing decisions: for a company its name, invoice name and trade name; for a seller the name in the tax details and the date of birth, or otherwise the account name; for a buyer the account name and the cardholder's name our payment provider gives us, and the recipient's name on each order not yet sent. We keep the cardholder's name only if it differs from the account name and the recipients' names, and only the latest one; it is deleted with the account. Your display name is never compared. The comparison runs on our own servers when a name is saved or changed and when the lists are updated. If one of the names resembles someone on the lists, we keep which entry on the list it concerns, which of your names resembled it and a one-way code of the name, but not the name itself and nothing from the list about the person. If the match concerns the recipient on an order, we keep it on the order and not as your name; if it is confirmed, we use the one-way code so that you cannot give the same recipient in a new order, for as long as the hit is kept. If the match is judged likely, we may ask for your date of birth. Your date of birth is stored encrypted, used only for this check and deleted with the account; you can remove it yourself at any time. A match awaiting review is kept until it has been reviewed, and a match set aside on the date of birth is deleted with the account. A match that proved false is kept for as long as the account exists and twelve months after, so that the same name is not checked again every time the lists are updated. A confirmed hit is kept for five years from the decision or from the day the matter was closed, whichever is later, and for ten years if an authority has contacted us about the matter or there are signs of serious crime.

If the law prevents a refund: If we may not refund you because the seller is confirmed on a sanctions list or in the National Bureau of Investigation's register of freezing decisions, we open a case for the order. It contains the amount, when the refund was held, when we applied for permission and the authority's reference, when permission was given and when we notified you. The case does not contain your name or your contact details. We keep it until the refund has been made or the case has been closed in another way, and then for five years, or for ten years if an authority has contacted us about the case.

If someone has given you as the recipient of a delivery: When a buyer on Philmarket gives you as the recipient, we receive your name and address from the buyer, not from you. We use them so that the seller can send the item to you (Art. 6(1)(f), the buyer's and the seller's interest in completing the transaction) and for the check against the EU sanctions lists and the National Bureau of Investigation's register of freezing decisions that the law requires of us (Art. 6(1)(c), see section 3). The address is kept on the order for as long as the point on delivery addresses states, and only the seller in that transaction sees it. If your name resembles someone on the lists, we keep a one-way code of the name and which entry it concerns, but not the name, for as long as stated above. If the match is confirmed, the order is not sent to you, and we write to you within one month. You have the same rights as others whose data we process (section 6), and you can object to the processing for the delivery (Art. 21).

Saved searches: If you save a search, we keep its name, the search text and the filters you chose, together with when we last told you about new matches, so that we can email you when new listings match it. We keep it until you remove it or delete your account.

Technical data: Session token (session cookie, strictly necessary).

Visitor statistics: When you visit philmarket.eu we count visits with an analytics tool (Umami) that runs on our own server, without cookies and without anyone else receiving the data. For each visit we store the page you visited and where you came from, browser, operating system, device type, screen size, language and country. The country is derived from your IP address. The analytics tool does not store the address, and we do not store a city or region. The address does appear in the server log, as for every request (see »Server logs«). Visits within a short time are linked by a code calculated from the IP address and the browser. The data on individual visits is deleted after 6 months; after that we keep only totals per month, which cannot be linked to any visitor.

*This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.*

Two-step verification (required for sellers and administrators, optional for buyers): the secret key your authenticator app uses, stored encrypted, and your recovery codes, stored only as one-way checksums that cannot be turned back into the codes. We also record when a code was used or entered wrongly, for security, and keep that record for twelve months. If you choose a second channel, we store your secondary email address; a phone number we do not store, but compare it with the checksum we already hold. If you use a passkey, we store its ID and public key, its signature counter, how it connects (for example built in or via USB), whether it is synced across your devices, the name you gave the device, and when the passkey was added and last used. Your fingerprint, face or PIN never leaves your device, and we never receive it. If you remove a passkey, we delete it at once, and the log records only that a passkey was added or removed, never the key itself. That you turned two-step verification on or off, or added or removed a passkey, is kept for 24 months, so that it can be seen when the account was protected. If you turn it off as a buyer, we delete the key and your unused recovery codes.

Details you publish as a private seller: If you sell as a private individual, you choose a display name before your first listing is published. The display name and your country are shown on your listings and to the buyer as the other party. The name on your account is never published.

How you appear as a buyer and in the forum: In the public bid history you are shown as "Bidder 1", "Bidder 2" and so on, in the order the bidders first bid on the listing. A review you leave as a buyer is shown with your display name, or as "Buyer" if you have not chosen one. Your name is never shown publicly. The person you deal with sees your name, and the seller sees the address the item is to be sent to, because the deal needs it. Before you post in the forum or ask an appraisal question, you choose a display name, which is published with what you write. If you delete your account, what you wrote remains without a name (section 6).

Details you publish as a trader: If you declare that you sell as a trader, you give us your business name, a geographical address, a telephone number and a contact e-mail address, and we show them to buyers. Your business name and your country also appear on your listings. We suggest the name from your invoices, but it is published only once you have confirmed it yourself. The contact e-mail is one you give for the purpose; the e-mail address you log in with is never published.

Data we check without storing: The phone number we use to verify you is never stored — we keep a one-way checksum and the time, not the number. This is a different number from the one a trader publishes for buyers, which is stored and shown (see above).

Performance of a contract (Art. 6(1)(b)): Account management, auctions, purchases, payments and messages between users.

Legal obligation (Art. 6(1)(c)): Philmarket's own accounting vouchers, such as invoices and receipts for our services, are retained for at least six years from the end of the year in which the accounting period ended, and the financial statements and accounting books for at least ten years from the end of the accounting period (Accounting Act 1336/1997, ch. 2 s. 10). When a seller who is a trader sells to a consumer through Philmarket, we retain details of the sale for ten years from the end of the year of the sale: the seller's name, address and email address, the seller's VAT number if there is one, the goods, the price, the delivery country and postcode, the time and the order number (Value Added Tax Act 1501/1993, s. 209 u). Reportable sellers are reported to the Finnish Tax Administration under DAC7 (Directive (EU) 2021/514; Act 1267/2022).

Legal obligation (Art. 6(1)(c)) — the bar on registering again: Section 15 of Act 1267/2022 provides that a seller who does not provide the requested information after two reminders and at least 60 days must have their account closed and be prevented from registering again. The comparison described in Terms §2 therefore rests on that obligation, not on an interest of ours. It can require you to provide the details before you publish a listing, before any person has read the case; you can ask for the decision to be reviewed by a person under Terms §10, and you then receive a reasoned reply.

Legitimate interest (Art. 6(1)(f)): Fraud prevention, platform security, and measuring and improving AI-assisted Stamp Analysis — when you correct an analysis, the correction is used to measure whether it judges correctly. A correction is used for as long as it can be compared against the AI model that made the assessment, and for twelve months after that model is replaced. You may object to this (Art. 21), and the tool works the same if you do.

Legitimate interest (Art. 6(1)(f)) — review of high-value sales: The record in section 2 is kept voluntarily, as a risk control against money laundering and fraud in unusually large deals. Recipients: no one outside Philmarket.

Legitimate interest (Art. 6(1)(f)) — accounts that belong together: The card code and the payout code in section 2 are processed to uphold the rule of one account per capacity (Terms §2) and to give the free month only to new sellers. You may object (Art. 21).

Legitimate interest (Art. 6(1)(f)) — where you sell from: The country in section 2 is processed to uphold the requirement in Terms §5, because Philmarket could otherwise become liable to account for VAT on sellers' sales (Finnish VAT Act (1501/1993) section 19 b). You may object (Art. 21).

Legitimate interest (Art. 6(1)(f)), and for ground (k) legal obligation (Art. 6(1)(c)) — accounts we closed: The codes from an account we closed (section 2) are processed to prevent fraud and circumvention, and for ground (k) to prevent the re-registration that section 15 of Act 1267/2022 requires us to prevent. A match can pause trading on the new account before any person has read the case; a person reviews it within 5 working days. You can object to the legitimate interest (Art. 21).

Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) — checks against sanctions lists: The law prohibits us from making money or goods available to persons and companies on the EU sanctions lists or in the National Bureau of Investigation's register of freezing decisions, and the comparison in section 2 is made to comply with that prohibition. If one of the account holder's own names resembles someone on the lists, payouts to the account are held automatically, without a person having read the case first, and a person reviews the match the same working day. If the match concerns the buyer in an order, the order is also held, so that the item is not sent, until the match has been reviewed. If the match concerns the recipient on an order, only that order is held; the account and the buyer's other orders are not affected. If such a match is confirmed, the order is cancelled at no cost to the buyer, and the same recipient cannot be given in a new order (terms of use §8). If the match is judged likely, new transactions are also paused (terms of use §10 (p)), and we tell you why. The check is completed within five working days of the match arising or of your providing what we asked for (terms of use §8). If the match is false, the hold is lifted at once, and if you noticed anything, we tell you so. Where a list is based on terrorist offences, we treat a confirmed hit as data on offences (Art. 10), on the basis of section 7 of the Finnish Data Protection Act (1050/2018); access is restricted to the person reviewing it and is logged. Recipients: in the case of a confirmed hit, our payment provider Stripe the same day, so that the money can be frozen, and the Ministry for Foreign Affairs of Finland within two weeks, as the law requires, and, in the case of a hit against the National Bureau of Investigation's register, the Enforcement Authority of Finland, with a copy to the National Bureau of Investigation; otherwise no one outside Philmarket. Telling Stripe, and keeping a confirmed hit so that we can show the prohibition was observed and defend ourselves, rest on our legitimate interest; the comparison itself and the report to the Ministry for Foreign Affairs rest on the legal obligation. You can object to the legitimate interest (Art. 21). If a refund to a buyer is prevented because the seller is confirmed, we hold it to comply with the prohibition (Art. 6(1)(c)). We apply for permission and notify the buyer under the Terms §8 (Art. 6(1)(b)). If the item is to be handed over to the Enforcement Authority, we give the information needed for that, because the law requires it (Art. 6(1)(c); section 5). Keeping the case afterwards so that we can show the prohibition was complied with rests on our legitimate interest (Art. 6(1)(f)).

Legal obligation (Art. 6(1)(c)) — trader sellers: If you declare that you sell as a trader, your business name, geographical address, telephone number and contact e-mail address are shown publicly to buyers and appear in the withdrawal information for each sale, as required by Directive 2011/83/EU Art. 6(1)(b)–(c) and Art. 6a, as amended by Directive (EU) 2019/2161. Recipients: all visitors to the site. They are published for as long as your account sells as a trader; if you stop, they are no longer published but stay on your account until you change them or close the account. What a buyer was given with a concluded sale is kept with that sale for the term of the contract plus the limitation period. For private sellers, see the next point.

Review of trader status: If your account is registered for a company, or your VAT number has been confirmed in the EU VAT register (VIES), and you ask to sell as a private individual (Terms of Use §5), we keep your request, any explanation you choose to write and our decision with its reasons. If, as a private seller, you reach the tax-reporting threshold in a calendar year (30 sales or more than EUR 2,000), we ask you at most once a year how you sell, and keep your answer. Your answer does not change your status by itself. The purpose is to let buyers know whether you sell as a trader or as a private individual (legal obligation, Art. 6(1)(c)), and to review your request under the Terms of Use (contract, Art. 6(1)(b)). The data are not shared with anyone outside Philmarket. Your request, your explanation, the decision and your answers are deleted when you close your account. That a decision was made, and when, is kept in our audit log for three years and six months, without your explanation and without the reasons.

Performance of a contract (Art. 6(1)(b)) — private sellers: If you sell as a private individual, your display name and your country are shown on your listings and to the buyer as the other party, so that the buyer knows who the contract is with. Recipients: all visitors to the site. The display name a buyer was given with a concluded sale is kept with that sale for the term of the contract plus the limitation period. The name on your account is never published.

Performance of a contract (Art. 6(1)(b)) — forum, appraisal questions and reviews: What you write in the forum, in an appraisal question or in a review is published with your display name — for a review, "Buyer" if you have not chosen one — because that is how the service works under the Terms. Recipients: all visitors to the site. If you delete your account, it remains without a name.

Performance of a contract (Art. 6(1)(b)) — refund to a bank account: The account number in section 2 is processed so that we can pay back what we owe when the refund to the card did not go through. Where we ourselves are required by law to make the refund, for example when you have withdrawn from a purchase of our own services, the ground is also legal obligation (Art. 6(1)(c)).

Performance of a contract (Art. 6(1)(b)) — return postage: When you withdraw from a purchase and claim return postage from the seller, the payment method you give, for example your account number, is processed so that the seller can pay you. Recipient: the seller, and only for that claim.

Legitimate interest (Art. 6(1)(f)) — messages and suggestions: We read and answer messages, use suggestions to improve the service and the translations, and protect the forms against abuse. Where your question concerns your contract with us, the basis is performance of the contract (Art. 6(1)(b)). We handle a data protection request to fulfil our obligations under the GDPR (Art. 6(1)(c)).

Legitimate interest (Art. 6(1)(f)) — visitor statistics: The visitor statistics in section 2 are processed to understand how the website is used and to improve it. You can object to the processing (section 6).

We use a single strictly necessary session cookie (__Secure-next-auth.session-token) required for sign-in. It is exempt from consent requirements under the ePrivacy Directive. At checkout (Stripe), Stripe's own fraud-prevention cookies may be set — these are governed by Stripe's privacy policy.

Stripe Payments Europe Ltd (Ireland): Payment processing and payouts and, when you pay for an order by card, the delivery address, as evidence if the payment is disputed. In the case of a confirmed hit against a sanctions list, Stripe is told of the hit the same day, so that the money can be frozen (section 3). When you connect an account as a seller, Stripe checks your identity under its own obligations; this happens at Stripe, not with us. We also receive the country and postcode of the address Stripe has checked and the country of your payout account, but keep only the countries and whether the postcode belongs to an area outside the EU VAT area (section 2). Stripe transfers data to Stripe, LLC in the USA, which processes part of it for Stripe Payments Europe. Safeguard: EU–US Data Privacy Framework.

DeepL SE: Automatic translation of user-generated text — listing titles and descriptions, addenda to listings, messages between users, forum posts and appraisal estimates — and of the circumstances in our decisions on advertising under Terms §12. EU.

Anthropic Ireland, Limited (Ireland): AI-based condition assessment of stamp images, and AI support when we develop, troubleshoot and operate Philmarket. Data you have given us may be visible in that work and is then processed by Anthropic on our behalf. The data is also processed by Anthropic, PBC in the USA — safeguard: standard contractual clauses (SCC).

Mistral AI SAS (France): AI support when we develop, troubleshoot and operate Philmarket. Data you have given us may be visible in that work and is then processed by Mistral on our behalf. EU. Some of Mistral's subcontractors are outside the EU, including in the USA — safeguards: standard contractual clauses (SCC), or an adequacy decision where one exists.

Hetzner Online GmbH: Server operations, image storage and backups. EU (Helsinki, Finland).

Sweego (Mindbaz SAS): Transactional email and SMS. Email: your address, the subject line and the content of the message — sign-in codes, order confirmations, decisions on notices and the receipts we are obliged to send. If you write to us in the contact form, your message, your name and your email address also pass through Sweego to whichever of us is to reply. SMS: your phone number and the text message, when you verify your phone number. EU (France).

Finnish Tax Administration: where you are a reportable seller, your identity and tax details and your gross proceeds are reported annually under DAC7. The authority shares the data with your country of residence. FI. The reporting thresholds are set by law, not by Philmarket (Directive (EU) 2021/514; Act 1267/2022).

Ministry for Foreign Affairs of Finland: in the case of a confirmed hit against a sanctions list, information identifying the person or company, the value of the money and items concerned and what kind of asset it is, within two weeks, as the law requires, and, when a refund to a buyer is held, in the application for permission the buyer's name and country, the order reference, the date of purchase and the amount (section 3). FI.

The Enforcement Authority and the National Bureau of Investigation of Finland: in the case of a confirmed hit against the National Bureau of Investigation's register of freezing decisions, information identifying the person or company and the funds held by us that are concerned, as the law requires (Act 325/2013, section 14(3)). When a refund to a buyer is held, we send the buyer's name and country, the order reference, the date of purchase and the amount, to have it confirmed that the refund may be made or to apply for a decision (section 5(1)(3) and 5(2)) (section 3). If an item you bought is to be handed over to the Enforcement Authority, in the case of such a hit or where the Ministry for Foreign Affairs has applied for it, we give the Enforcement Authority the order reference and a description of the item, and your name and your address, phone number or email address if the Enforcement Authority needs to contact you to receive or collect the item (Act 325/2013, section 14(3); Act 659/1967, section 2 b(3)) (section 3). FI.

European Commission (TIN service): when you enter your tax identification number, we send the number and the state that issued it to the Commission's free checking service, which the law requires us to use. The service checks only that the number has the right format — not that it is yours or that it exists. EU (Belgium).

European Commission and the Member States' VAT registers (VIES): when you enter a VAT number in your account settings, and every 30 days after that, we send the number to the Commission's VIES service, which asks the state that issued the number whether it is valid. EU.

Besides the routes below, you can always use the data protection form or email privacy@philmarket.eu. We reply within one month of receiving your request. If the request is complex, or we have received many requests, we may extend the time limit by up to two months. If so, we will tell you within the first month and explain why. Do not send copies of identity documents by email: if you are signed in when you use the form, that identifies you, and otherwise we confirm the request through the email address on the account.

Access (Art. 15): Request a copy with the data protection form, preferably signed in. We handle access requests by hand, because they reach more than the self-service export: that file is built for portability (Art. 20) and does not include records such as moderation decisions, dispute notes or audit-log entries. If you are a seller, you can also view the tax information you gave us for DAC7 in full yourself under Account, after entering a code from your authenticator app. We then email you that the copy was viewed, without the information itself. While a match with a sanctions list is awaiting review, we may in the individual case wait before telling you about it, if telling you could otherwise hinder the prevention or investigation of crime (section 34 of the Finnish Data Protection Act (1050/2018)). Your other data is provided, and you can ask us to give the information to the Data Protection Ombudsman.

Rectification (Art. 16): Change your name in the account settings. You also change your email address there: we send a code to the new address and a notice to the old one. If you no longer have access to your address, use the data protection form.

Erasure (Art. 17): Delete your account via Delete my account. The account row is not removed but de-identified: the name is replaced with a fixed placeholder and the email address with a value computed from it, and what you published remains without your name. Note: Philmarket's own accounting vouchers are retained under the Accounting Act (at least six years from the end of the accounting year). Invoices and credit notes that Philmarket issued in a seller's name do not keep your name, address or VAT number when you delete your account, and the PDF copy of an invoice that names you is deleted, so download it first if you need it. If you have sold as a trader to consumers, the details of those sales are retained for ten years (Value Added Tax Act, s. 209 u). We keep your tax details for six years after the end of the last calendar year in which we applied the tax due-diligence checks to you. This applies even if you delete your account. If your seller account has been closed under §10(k), what the bar described in Terms §2 needs is also kept even if you delete your account — otherwise the bar the law requires would have no effect — but for no longer than six years from the closure. If we have suspended or closed your account under §10, the codes under "Data from an account we closed" in section 2 are also kept even if you delete your account, for six years or 24 months depending on the ground. If you have received a warning or a restriction under §10, it is kept, with your answer and our decision, for 42 months after the last event in the matter as section 2 sets out, even if you delete your account. If a purchase in which you were the buyer or the seller, or one of your listings, has been recorded for review of high-value sales, the record is kept as section 2 states even if you delete your account. A confirmed hit against a sanctions list, and a match that proved false, are kept as section 2 states even if you delete the account. A match awaiting review, including one we have judged likely, is kept until it has been reviewed, and section 2 applies after that. If your account has had a subscription with us, the one-way code of your payout bank account is kept for 12 months after deletion. It is then used only to decide whether a new account gets the free month, never to link accounts, and is deleted afterwards. The card codes from your payments are deleted with the account, except where a flag that accounts are linked names your account and nobody has yet decided it. They are then kept until the flag is decided or has been closed after 90 days (section 2), and are deleted afterwards. A return receipt you uploaded is kept for three years after the return was closed, even if you delete your account, because it is the record if the refund or the return is disputed. The address on a paid order is kept for as long as section 2 states, even if you delete your account: 540 days from payment, and longer if the payment has been disputed. If you are waiting for a refund to a bank account you gave us, the account number, and the account holder's name if you gave one, is kept until the refund has been made, and for no more than twelve months, even if you delete your account. Otherwise we could not pay you back. Where a conversation led to a deal that is still inside those three years, its messages are kept even if you delete your account — they are also the other party's record of a deal they were part of — and are deleted when the period runs out. Conversations that never led to a deal are deleted entirely when you close your account. Images and other files we delete remain in the backups of our image storage for at most five days. If you want to know which data about you we still hold after the erasure, you can ask for access under Art. 15 (see above).

Data portability (Art. 20): Download your data via Export my data.

Objection (Art. 21): Contact privacy@philmarket.eu.

If you appear on an item: If your name, address or a message to or from you appears on an item sold here, you can ask us to hide it, even without an account. Use the form at /notice and name the listing; you do not have to show that anything is illegal. If the item already has a buyer or bids when we hide the details, we keep the unmasked image as the buyer's record of the purchase. Only the buyer and the seller can see it, and it is deleted with the rest of the listing's content three years after the deal, or once it is clear that the item will not sell.

Requests you make under Articles 15–22 (and our reply) are kept as a minimal record — the type of request and the dates we received and answered it — for 42 months from the day we received the request, so we can demonstrate we handled it correctly (Art. 5(2)); after that they are deleted. Anything we needed only to verify your identity is deleted as soon as the request is closed.

You have the right to lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) in Finland, tietosuoja.fi, or with the supervisory authority in the EU country where you reside.

Personal data is transmitted encrypted (TLS 1.2 or 1.3). Access to the data is controlled in the application layer: every request is bound to the signed-in account and to the data that account owns, and access is restricted to authorised systems. Accounts that sell or administer must use two-step verification, and buyers can turn it on voluntarily: after the sign-in code we email, a one-time code from an authenticator app or a passkey. You can also sign in with a passkey alone, without the sign-in code; it then counts as both steps. We keep a security log of sign-ins and failed sign-in attempts, for example when a wrong code is entered, to detect and stop attempts to break into accounts. For a failed attempt, neither the email address nor the code is stored. After twelve months the personal data is removed from the entries. Only the type of event and when it happened remain. The basis is our legitimate interest in platform security (section 3), and you can object (Art. 21). When the bank account your payouts go to is added or changed, we email you at your account address. Every personal data breach is documented. We report a breach to the competent supervisory authority when the law requires it, that is, unless it is unlikely to result in a risk to you, and we then do so without undue delay and, where feasible, within 72 hours. Where the risk is high, we also inform you without undue delay, except where the law exempts it, for example where the data was encrypted so that no unauthorised person can read it (GDPR Art. 33 and 34).

We never ask you to send a personal identity or tax number, identity documents, bank details, passwords, codes or health information by email. You only provide such details in the forms on philmarket.eu while signed in.

This notice is provided in the languages the service is offered in. It describes your rights rather than setting contract terms, so no language version takes precedence over another — each is meant to be correct on its own. If you find a discrepancy between versions, tell us at privacy@philmarket.eu and we will correct it.

Data protection contact: the data protection form or privacy@philmarket.eu. Do not send copies of identity documents by email; if you are signed in when you use the form, that identifies you.