Privacy policy

Last updated: 2026-06-15

§1. Data controller

The controller of your personal data is Technalab, VAT ID 5372176985, registered at Elizy Orzeszkowej 11, 21-500 Janów Podlaski, Poland (the „Controller"). Data protection contact: rodo@bidbil.com.

§2. What data we collect

• Account data: e-mail address, password (stored as a BCrypt hash), display name, first and last name, optionally phone number and address.
• Business data (optional): VAT ID and invoicing data — only for business accounts using Integrations.
• Your listing content: descriptions, photos, attributes (cue length, brand, table size, etc.), location (accurate to city level).
• Messages: chat history with other Users and BidBil support — retained as evidence in case of disputes.
• Activity: listings, bids, sales, reviews, tournament participation, match results.
• Technical data: IP address, browser type, operating system, login times, signed-in devices.
• OAuth login (optional): if you sign in via Facebook, we receive your e-mail address and Facebook profile ID from Meta. We never have access to your Facebook password.

§3. Purpose and legal basis

Purpose	Legal basis (GDPR)
Account creation and service delivery	Art. 6(1)(b) — contract performance
Publishing and browsing listings, contact between Users	Art. 6(1)(b) — contract performance
Review system, seller verification	Art. 6(1)(f) — legitimate interest (community safety)
Security (rate limiting, proof-of-work phone challenge, abuse detection)	Art. 6(1)(f) — legitimate interest
Analytics (Google Analytics 4) and traffic measurement	Art. 6(1)(a) — consent (via cookie banner)
Partner advertising / shop integrations	Art. 6(1)(a) — consent (separate contract)
Accounting and tax for Integrations	Art. 6(1)(c) — legal obligation

§4. Phone number — anti-scraping protection

If a seller chooses to publish a phone number, it is hidden behind a proof-of-work challenge requiring a one-time, unpredictable computation in the buyer's browser. This prevents bulk harvesting of numbers by commercial bots (SMS spam). The endpoint is also rate-limited to a small number of reveals per minute from a single IP address.

§5. Cookies and similar technologies

We use the following cookie categories:

• Strictly necessary (always on): login session (HttpOnly cookie), language and theme preferences, cookie consent. Without them the Service won't work.
• Analytics (consent required): Google Analytics 4 — measures traffic and helps us understand how you use the Service. Data is anonymised.
• Marketing (consent required): currently not used. If we introduce them, we will update the banner and this policy.

You may change your consent at any time by clicking the cookie banner (link „Cookie settings" in the footer).

§6. Who we share your data with

Your data may be processed by the following categories of recipients (as processors):

• Hosting and infrastructure: server provider (Poland / EU).
• Facebook (Meta): if you sign in via Facebook OAuth — token and e-mail exchange under Meta's policy.
• Google: Google Analytics (after your consent), reCAPTCHA if active.
• Shop integrations: BaseLinker, WooCommerce, PrestaShop — only for business accounts that actively configured an integration.
• Public authorities: in case of lawful requests (police, prosecutors).

§7. Transfers outside the EEA

Google (Analytics) and Meta (Facebook OAuth) may transfer data outside the European Economic Area, primarily to the US. Transfers are based on the EU-US Data Privacy Framework (Commission Decision 2023/1795) and Standard Contractual Clauses. Primary hosting takes place in the EU.

§8. Retention period

• Account data — for the lifetime of the account plus 12 months after deletion (for potential claims).
• Listings and transaction content — for 3 years from completion (matching consumer claim limitation periods).
• Chat messages — for 3 years from last activity (as dispute evidence).
• Reviews — indefinitely (as part of seller reputation), anonymised on request after account deletion.
• Technical logs (IP, login times) — 90 days from the event.
• Integration accounting data — 5 years per the Polish Accounting Act.

§9. Your rights

Regarding your personal data, you have the right to:

• access — view what data we process (profile panel);
• rectification — edit your data at any time in account settings;
• erasure („right to be forgotten") — delete your account or write to rodo@bidbil.com;
• restriction of processing, data portability and objection to processing based on legitimate interest;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• file a complaint with the Polish data protection authority (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or your local supervisory authority.

Send data protection requests to rodo@bidbil.com — we respond within 30 days.

§10. Changes to this Policy

This Privacy Policy may be updated when the Service or applicable law changes. Users are notified at least 14 days in advance via e-mail and a banner on the home page. The current version is always available on this page.