MASANETO

MASANETO

Privacy policy

Effective from: 28 September 2026.

1. Controller

1.1. The controller of personal data is SIA "Hunter", registration number 40203656593, registered office „Meirēnu Stūrīši”, Vecpiebalgas pag., Cēsu nov., LV-4122, Latvija, e-mail info@masaneto.com (hereinafter: we), which operates the online auction platform MASANETO at https://masaneto.com.

1.2. This policy explains which personal data we process, why, on what basis, for how long, to whom we transfer them and what your rights are under the General Data Protection Regulation (EU) 2016/679 (GDPR).

2. Which data we process and why

2.1. Account data: e-mail, first name, surname, telephone, country, region, language, password (in encrypted form). Purpose: account creation, login, communication. Basis: performance of a contract (Article 6(1)(b) GDPR).

2.2. Identity verification data: first name, surname, personal identity number or date of birth, means of identification and result, which we receive from eID Easy; for verification by bank transfer, from our bank account statement: the payer's name, IBAN, bank, payment amount and date, and the result of the comparison with the profile. Purpose: establishing the identity of bidders and sellers, preventing fake bids, legal validity of transactions, prevention of money laundering. Basis: performance of a contract and our legitimate interests (Article 6(1)(b) and (f) GDPR); for the personal identity number: the provisions of the Personal Data Processing Law.

2.3. Company data: name, registration number, VAT number and the result of its VIES verification, address, data of authorised persons. Purpose: transaction documents, application of VAT, verification of the right of representation. Basis: performance of a contract and a legal obligation (Article 6(1)(b) and (c) GDPR).

2.4. Auction and transaction data: published auctions, photographs, video, bids, sale confirmations, settlement account records, invoices, receipts, handover marks, evidence, objections and decisions, communication between the parties and with the support service. Purpose: organising auctions, managing the settlement account, issuing documents, handling disputes. Basis: performance of a contract and a legal obligation (accounting, taxes).

2.5. Payment data: payment status, method, amount, Stripe identifiers, the seller's Stripe account status and the last digits of the payout bank account. Full bank account and card data are stored by Stripe. Basis: performance of a contract.

2.6. Technical data: IP address, device and browser data, login times, activity log, cookies. Purpose: security, fraud prevention, error correction, improvement of the Platform, visit statistics. Basis: our legitimate interests; for statistics and marketing cookies: your consent.

2.7. Marketing data: e-mail and language for sending news and offers. Basis: consent, which can be withdrawn at any time via the link in the e-mail or in the account.

2.8. Freight carrier applications. If you apply as a freight carrier, we process your name, company name, registration or VAT number, telephone, e-mail and the information about your transport services given in the application. Purpose: to contact you about cooperation and, if a user of the Platform needs transport, to pass your contact details to them. Basis: your consent (Article 6(1)(a) GDPR). We keep the data while the cooperation is relevant, but no longer than 3 years after the last contact. You can withdraw your consent at any time by writing to info@masaneto.com; after that we no longer pass your contact details to customers.

3. Data transfers

3.1. To the other party to the transaction: after receipt of the payment, the buyer and the seller receive the other party's name or company name, telephone, e-mail and the location or delivery address of the goods, solely for the performance of the transaction. The seller's details are visible on the invoice issued in their name. The parties may use these data solely for the performance of the transaction.

3.2. To processors and partners acting on our behalf or as independent controllers:

  • Stripe Payments Europe, Ltd. (Ireland): payment processing, settlement account, payouts to sellers, verification of sellers' identity for the Stripe account. Stripe is an independent controller for its own processing; Stripe privacy policy: stripe.com/privacy.
  • eID Easy OÜ (Estonia): electronic identification; technical data are deleted from eID Easy servers within 2 hours after identification.
  • Swedbank AS (Latvia): the Operator's bank account to which the verification check fee is transferred. The bank is an independent controller for its own processing.
  • Supabase (database and file storage, EU data centre), Vercel (hosting), Bunny.net (video), Resend (e-mail delivery), DeepL (translation of descriptions), Nominatim/OpenStreetMap (geocoding of locations without personal data).
  • Queries to company registers and VIES for verification of the right of representation and the VAT number.
  • Analytics and advertising services (Google Analytics, Meta), only with your consent to cookies.

3.3. To public authorities: to the tax administration under the platform operators' reporting obligation (DAC7), and to law enforcement authorities and courts where required by law.

3.4. Transfers of data outside the EU/EEA take place only with the safeguards provided for in the GDPR (a European Commission adequacy decision or standard contractual clauses).

4. Retention periods

  • Account data: while the account is active, and for 3 years after its closure (limitation period for claims).
  • Identity verification data: while the account is active, and for 5 years after the last transaction (anti-money laundering requirements).
  • Transaction data, invoices, receipts and settlement account records: 5 years after the end of the year of the transaction (accounting and tax laws); DAC7 reporting data: 10 years.
  • Objection, dispute and blocking data: 3 years after the decision, or until the expiry of the limitation period for claims.
  • Technical logs: up to 12 months.
  • Marketing data: until withdrawal of consent.

5. Cookies

5.1. Necessary cookies (session, login, security, language) are used without consent. Statistics and marketing cookies are used only with consent, which can be changed in the "Cookie settings" section at the bottom of the page.

6. Your rights

6.1. You have the right to access your data, to rectify or erase them, to restrict processing, to object to processing based on legitimate interests, to receive your data in a portable format and to withdraw consent. Send requests to info@masaneto.com; we respond within 30 days. Data that we are legally obliged to retain (invoices, transaction records, identity data) cannot be erased on request before the end of the retention period.

6.2. You have the right to lodge a complaint with the Data State Inspectorate of Latvia (dvi.gov.lv) or with the supervisory authority of your country of residence.

7. Security

7.1. Data are transmitted over an encrypted connection, passwords are stored in encrypted form, access to data is restricted by role, card data are processed only by Stripe, and verification payment data are visible only to the Operator's administrators; the user's profile shows only the last four digits of the IBAN. Contact details are disclosed only after receipt of the payment. In a direct settlement auction, contact details are disclosed once the buyer's commission has been paid.

8. Changes

8.1. We may update this policy; we give notice of material changes on the Platform or by e-mail. The version published on the Platform is the one in force.