Privacy Policy
Last updated: 4 November 2026
Trotmark is an online marketplace where sellers list European sport horses and buyers contact them. Trotmark does not take part in the sale and never handles the price of a horse. This policy explains which personal data we process, why, for how long and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The controller is Andrėja Daranda, operator of Trotmark, Lithuania. Contact for all privacy matters: our contact form (topic “Privacy”). The operator’s registered business details will be added here once the business registration is completed.
2. What we process, why, and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Sellers: name, email; optional business name, country, city, bio, seller type (private / professional) | Provide your account and listings; show buyers whether a seller is a private person or a trader | Contract, Art. 6(1)(b); consumer-law transparency | Until you delete your account |
| Listing content and photos | Publish your listings | Contract | Until you remove them or delete your account |
| Buyers (also without an account): name, email, message, offer amount; replies in the conversation | Deliver your enquiry to the seller and let both of you continue the conversation | Steps prior to a contract / contract, Art. 6(1)(b) | 24 months after the last message, or earlier on request |
| Transactional email log (recipient, subject, delivery status) | Deliver and retry service emails; troubleshooting | Legitimate interest, Art. 6(1)(f) | 90 days |
| Founding-seller applications | Review your application and contact you | Consent, Art. 6(1)(a) — withdraw any time | 12 months or until withdrawal |
| One-way hashed IP address (not reversible) | Abuse and spam prevention on forms | Legitimate interest | 30 days |
| Content reports and moderation decisions | Notice-and-action under the EU Digital Services Act; evidence of decisions | Legal obligation (DSA) and legitimate interest | 3 years |
| Paid services (when offered): Stripe customer id, billing name, country, address, VAT number, invoices and payment status — never card numbers | Provide paid plans and featured listings; invoicing; tax and accounting | Contract; legal obligation (accounting), Art. 6(1)(c) | Accounting records for the period required by Lithuanian law (up to 10 years), also after account deletion |
| Listing statistics: daily counts of views and saves per listing, with the visitor’s country derived from the network request | Show sellers how their listings perform; understand demand by country | Legitimate interest | Aggregates only — no IP address, cookie or identifier is stored, so no person can be identified |
We do not use advertising trackers, we do not sell personal data and we do not send marketing emails without separate consent.
3. Who receives your data
- Other users: your listing and public seller profile (name or business name, country, city, bio, seller type). Your email address is never shown publicly. A buyer’s contact details are visible only to the seller they contact.
- Service providers acting on our instructions: Supabase (database, authentication, file storage — EU, Frankfurt), Vercel (hosting), Resend (transactional email). For paid services, Stripe Payments Europe Ltd. processes payments; for some processing (e.g. fraud prevention) Stripe acts as an independent controller under its own privacy policy.
- Where a provider may access data from outside the EEA, transfers rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the European Commission’s Standard Contractual Clauses.
- Authorities, where we are legally required to disclose data.
4. Deleting your account
You can delete your account in your seller dashboard. We then delete your profile, listings, photos and the enquiries addressed to you, and we cancel any active paid plan. Records we must keep by law (invoices and payment records) are retained without being linked to an account. A buyer can ask us to delete a conversation at any time.
5. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and you may withdraw consent at any time. Use the contact form (topic “Privacy”); we answer within one month. Signed-in sellers can also delete their account directly in the dashboard. You may lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or the authority in your country.
6. Storage on your device
See our Cookie Policy. We only use storage that is strictly necessary for features you use.
7. Security
Encryption in transit, row-level access controls in the database, least-privilege server access and rate limiting. Private conversation links work like keys — please do not share them.
8. Changes
We will announce material changes on this page and, where appropriate, by email.