Data Protection Notice

Document date: 08.08.2026

Scope

This Data Protection Notice describes how Tradornet collects, uses, stores, discloses and protects personal data when you access or use the Tradornet B2B marketplace platform, including our websites, mobile applications, APIs, messaging tools and related services. It applies to individual customers who purchase or enquire about products, authorised dealer accounts including retail and wholesale partners, and manufacturer accounts that publish catalogues, receive orders and manage commercial relationships through the platform.

Tradornet operates a multi-sided marketplace connecting manufacturers, dealers and end customers across borders. Depending on your role, different categories of data and processing activities may apply. Where a separate agreement such as dealer terms, manufacturer onboarding terms or customer terms contains additional privacy provisions, those provisions apply together with this notice to the extent they relate to personal data processing. This notice is intended for users worldwide regardless of where they are located or from where they access the service.

Mandatory local law

Although this notice sets out our global approach to data protection, mandatory provisions of the law applicable in your country or region always prevail where they grant you stronger rights or impose stricter obligations on us. If you are located in the European Economic Area, the United Kingdom, Switzerland, Turkey, California or another jurisdiction with dedicated privacy legislation, the relevant sections below and any mandatory local requirements apply in addition to this notice.

Where local law requires a separate disclosure, registration, consent mechanism, language-specific notice or data localisation, we comply with those requirements for users in that jurisdiction. Nothing in this notice limits rights that cannot be waived under applicable law. If any provision of this notice conflicts with mandatory local law, the mandatory local provision governs for users in that jurisdiction.

Data controller

Tradornet is the data controller for personal data processed through the platform in connection with account registration, marketplace operations, customer support, billing, security and compliance, unless we expressly state that another entity acts as controller for a specific service. Contact details for privacy requests and complaints are set out in the Contact and complaints section at the end of this notice.

When dealers or manufacturers process personal data of their own customers, employees or contacts through Tradornet tools, they may act as independent controllers or joint controllers for those processing activities. In such cases, the respective party is responsible for providing appropriate notices to its own data subjects and for responding to requests within its control.

Categories of personal data

All account types

We process identity and contact information such as name, email address, telephone number, preferred language, account credentials and authentication data. We also process technical and usage data including IP address, device identifiers, browser type, session logs, security logs, audit trails, cookie identifiers where applicable, and records of actions performed on the platform.

Individual customers

For individual customer accounts we process delivery and billing addresses, order history, payment status references, product preferences, support tickets, correspondence, returns and warranty records, and marketing preferences where permitted by law.

Dealers

For dealer accounts we process company name, trade registration details, tax and VAT numbers, authorised representative names and contact details, territory and pricing authorisations, quotes, purchase orders, invoices, credit checks where applicable, contractual documents and communication records relating to commercial operations on the platform.

Manufacturers

For manufacturer accounts we process company and production information, product catalogues, inventory and availability data, order fulfilment records, logistics and shipping details, quality documentation where required, messaging between commercial parties, and onboarding and compliance documentation.

Purposes of processing

We process personal data to create and administer accounts, authenticate users, enable product discovery, quoting, ordering and fulfilment, facilitate communication between marketplace participants, process payments and invoicing through payment partners, provide customer and technical support, maintain platform security, detect and prevent fraud and abuse, enforce our terms, comply with legal obligations, improve platform performance and user experience, and send service-related and, where permitted, marketing communications.

We may also process data for dispute resolution, chargeback handling, regulatory reporting, sanctions screening, export control checks where relevant, and internal reporting and analytics using aggregated or pseudonymised data where possible.

Legal bases

Depending on your location and the processing activity, we rely on one or more of the following legal bases: performance of a contract or steps prior to entering a contract; compliance with legal obligations; legitimate interests such as securing the platform, preventing fraud, improving services and managing business relationships, balanced against your rights; and consent where required by law, for example for certain marketing or non-essential cookies.

You may withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, you have the right to object in accordance with applicable law.

Sharing and recipients

We share personal data only where necessary and subject to appropriate safeguards. Recipients may include other marketplace participants to the extent required to complete a transaction, payment service providers, hosting and cloud infrastructure providers, email and notification services, analytics providers where configured and permitted, logistics partners, professional advisers, auditors, insurers, and public authorities or courts where required by law.

We require processors and service providers to process personal data only on our documented instructions and to implement appropriate security measures. We do not sell personal data in exchange for monetary consideration. Where US state law defines sale or sharing differently, we describe any applicable opt-out mechanisms in the section on US state privacy rights.

International transfers

Tradornet and its service providers may process and store personal data in countries other than your country of residence, including countries that may not provide the same level of data protection as your jurisdiction. Where required, we implement appropriate safeguards such as Standard Contractual Clauses approved by relevant authorities, supplementary measures, binding corporate rules, adequacy decisions or other lawful transfer mechanisms recognised under applicable law.

You may request further information about transfer safeguards applicable to your data by contacting us using the details below. Where local law prohibits certain transfers unless specific conditions are met, we apply those conditions for affected users.

Retention

We retain personal data only for as long as necessary for the purposes described in this notice, including to satisfy legal, accounting, tax, audit and dispute resolution requirements. Retention periods vary depending on data category, account type and applicable law. Account and transaction records are typically retained for the duration of the relationship and for a defined period thereafter. Security logs may be retained for a shorter or longer period depending on operational and legal needs.

When data is no longer required, we delete, anonymise or securely destroy it in accordance with our retention schedule and technical capabilities. Backups may persist for a limited additional period before being overwritten.

Security measures

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, role-based permissions, encryption in transit and, where appropriate, at rest, logging and monitoring, vulnerability management, secure development practices, staff training and contractual security requirements for processors.

No method of transmission or storage is completely secure. If we become aware of a personal data breach likely to affect your rights, we will notify you and relevant authorities as required by applicable law.

Your rights under EU and UK GDPR

If you are in the European Economic Area or the United Kingdom, you may have the following rights subject to conditions and exceptions under the GDPR: right of access; right to rectification; right to erasure; right to restriction of processing; right to data portability; right to object to processing based on legitimate interests or for direct marketing; and right not to be subject to a decision based solely on automated processing with legal or similarly significant effects where applicable.

You also have the right to lodge a complaint with your local supervisory authority. To exercise your rights, contact us using the details below. We may need to verify your identity before responding. We aim to respond within one month, extendable where permitted by law.

Your rights under US state privacy laws and CCPA

Residents of certain US states, including California under the CCPA as amended by the CPRA, may have additional rights such as the right to know categories and specific pieces of personal information collected, the right to delete personal information subject to exceptions, the right to correct inaccurate personal information, the right to opt out of sale or sharing of personal information as defined by applicable law, the right to limit use of sensitive personal information where applicable, and the right not to receive discriminatory treatment for exercising privacy rights.

We provide applicable notices at collection and honour verified requests in accordance with state law. Authorised agents may submit requests where permitted. We do not knowingly sell personal information of minors under sixteen without affirmative authorisation where required.

Your rights under Turkish KVKK

If you are in Turkey, your personal data is processed in accordance with Law No. 6698 on the Protection of Personal Data. You may have the right to learn whether data is processed, request information, learn the purpose of processing and whether data is used accordingly, know third parties to whom data is transferred domestically or abroad, request correction of incomplete or inaccurate data, request deletion or destruction under conditions set out in the law, request notification to third parties to whom data was transferred, object to adverse results from automated analysis, and claim compensation for damage arising from unlawful processing.

Applications under KVKK may be submitted by methods specified in our contact section. We respond within the time limits prescribed by law. You may also lodge a complaint with the Personal Data Protection Authority of Turkey.

Children

The Tradornet platform is intended for business use and for individual customers who are at least eighteen years old or the age of legal majority in their jurisdiction. We do not knowingly collect personal data from children below this age. If you believe we have collected data from a minor without appropriate authorisation, please contact us and we will take steps to delete such data where required by law.

Changes to this notice

We may update this notice from time to time to reflect changes in our processing activities, legal requirements or platform features. The current version will be published on the platform with an updated effective date. Where required by law, we will provide additional notice or request your consent before material changes take effect. Continued use of the platform after the effective date may constitute acknowledgement of the updated notice where permitted by applicable law.

Contact and complaints

For privacy requests, questions about this notice or complaints about our handling of personal data, contact us through the official support channels listed in your Tradornet account or on the platform contact page. Please include sufficient detail for us to identify your account and understand your request.

If you are not satisfied with our response, you may contact the relevant data protection authority or regulator in your jurisdiction. Contact details for EU and UK supervisory authorities, the Turkish Personal Data Protection Authority and US state regulators are available on their official websites.

Printable counterpart of the Tradornet platform agreement. Electronic acceptance is recorded at registration; wet-ink counterpart may be requested separately.