Privacy Policy

1. What this Privacy Policy covers

This Privacy Policy covers how we treat personal data we collect through the RetroBase website at retrobase.co and when you create and use a store workspace in the RetroBase app at app.retrobase.co. “Personal data” means any information that identifies or relates to an identifiable individual.

RetroBase is an early-access product working with a small group of founding stores. We collect personal data when you sign up for a store workspace, when you email us, and (in the limited technical form described below) when you visit the website. This policy does not cover the practices of companies we do not own or control.

2. Who we are and how to contact us

The data controller responsible for your personal data is Burak Esen, trading as RetroBase (a sole proprietorship), Ingolstädter Straße 9a, 85309 Pörnbach, Germany. See our Imprint. For any privacy question or to exercise your rights, email us at hello@retrobase.co.

3. Personal data we collect

We do not buy personal data or collect it from third-party data brokers. We collect:

• Account data: the details you provide when you create your store workspace at app.retrobase.co, such as your email address, your sign-in credentials and your store or workspace name
• Workspace content: the trade-in, pricing and inventory records you and your team add to your workspace, which we store and process only to provide RetroBase to you
• Correspondence: when you email us at hello@retrobase.co, your email address and the contents of your message, so we can respond

Please do not include sensitive personal data (for example, health or other special-category data) in emails or free-text fields. We neither need nor want it.

When you visit the website, our hosting infrastructure processes standard server information such as your IP address and basic request metadata, solely to deliver the site securely and detect abuse. We do not use this to build a profile of you.

4. How and why we use your personal data

We use the personal data you submit only for the purposes below, each with a lawful basis under the EU/UK General Data Protection Regulation (GDPR):

• Creating and running your store workspace and providing RetroBase to you: to perform our contract with you, or to take steps at your request before entering into one (Art. 6(1)(b)).
• Responding when you contact us: to take steps at your request (Art. 6(1)(b)) or in our legitimate interest in answering enquiries (Art. 6(1)(f)).
• Understanding real store workflows to improve RetroBase: in our legitimate interest in building a useful product (Art. 6(1)(f)).
• Operating the website securely and preventing abuse: in our legitimate interest in keeping the service secure (Art. 6(1)(f)).
• Meeting legal obligations and enforcing our legal rights: to comply with the law (Art. 6(1)(c)) and protect our legitimate interests (Art. 6(1)(f)).

We only use the information you submit for these purposes. We do not sell your personal data, and we do not use it for third-party advertising.

5. Cookies and analytics

We do not use cookies. The RetroBase website does not set cookies or use similar tracking technologies for advertising or cross-site tracking, and we do not load third-party advertising or social-media trackers.

We may measure aggregate, non-identifying usage of the website to understand how it performs. These measurements are not tied to your identity and do not rely on cookies. If we introduce cookies or identifying analytics in the future, we will update this policy and, where the law requires it, ask for your consent first. Because we do not track you across sites, the website does not respond differently to browser “Do Not Track” signals.

6. How we share your personal data

We keep the circle of people who can access your personal data small. We share it only in these limited circumstances:

• Hosting and infrastructure provider. We host the website and store your account data and workspace content on Amazon Web Services (AWS). AWS processes the data on our behalf as a data processor under a data processing agreement, only to provide hosting, storage and security to us. AWS is the only external service provider that processes your personal data.
• Legal obligations. We may disclose personal data where required by law, regulation, legal process or an enforceable governmental request, or where necessary to protect the rights, property or safety of you, RetroBase or others, or to enforce our agreements.
• Business transfers. If RetroBase is involved in a merger, acquisition, financing or sale of assets, your personal data may be transferred as part of that transaction. We will make reasonable efforts to notify you and to ensure the recipient honors this Privacy Policy.

We may also create and use aggregated or anonymized data that can no longer identify you for any lawful business purpose.

7. International data transfers

We operate using AWS infrastructure. Depending on the AWS region used, your personal data may be stored or processed in a country outside your own, including outside the European Economic Area (EEA) or the United Kingdom.

Where personal data is transferred outside the EEA or the UK, we rely on appropriate safeguards under GDPR Art. 46, in particular the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), as incorporated into the AWS GDPR Data Processing Addendum. You can request a copy of the relevant safeguard by emailing hello@retrobase.co.

8. Data security

We use appropriate technical and organizational measures to protect your personal data (GDPR Art. 32), including encryption of data in transit using HTTPS/TLS, encryption of stored application data at rest, and access controls that limit access to people who need it.

No method of transmitting or storing data is completely secure, so we cannot guarantee absolute security. If we ever become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, affected individuals (GDPR Arts. 33–34).

9. Data retention

We keep your account data and workspace content for as long as your store workspace is active, and afterwards only as long as necessary for the purposes described in this policy (GDPR Art. 5(1)(e)).

If you close your workspace or ask us to delete your account, we delete or anonymize the personal data associated with it without undue delay, unless a longer period is required to comply with a legal obligation or to establish, exercise or defend legal claims. Server and CDN access logs used for security are kept for a short period (at most 90 days) and then deleted or aggregated. You can ask us to delete your data sooner at any time.

10. Your privacy rights

Subject to applicable law, you have rights over your personal data. For individuals in the EEA and the UK, these are set out in GDPR Arts. 15–22:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure: ask us to delete your personal data.
• Restriction: ask us to restrict processing in certain cases.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email hello@retrobase.co. We will respond within one month (GDPR Art. 12(3)) and will not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity first.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concerns directly first.

11. Personal data of children

RetroBase is a business tool intended for store owners and operators. It is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact us at hello@retrobase.co and we will delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you by email or by a notice on the website. Your continued use of the website after an update means you accept the revised policy.

13. Contact information

If you have any questions or comments about this Privacy Policy or how we handle your personal data, contact us at hello@retrobase.co.