Pitswap Privacy Policy

PitSwap Marketplace Ltd. ("Pitswap", "we", "us", or "our"), operating from Vancouver, British Columbia, Canada, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website, applications, and services (collectively, the "Platform"). This Policy applies to all users worldwide, including residents of the European Union, the United Kingdom, California, and Canada.

This Policy is designed to comply with applicable privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), British Columbia's Personal Information Protection Act (PIPA), the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

1. Information We Collect

We collect the following categories of personal information depending on your interactions with the Platform:

• Account Information: Your name, email address, phone number, mailing address, username, and password
• Transactional Information: Payment method details (processed securely via PayPal — Pitswap does not store your full payment card or bank details directly), purchase history, item listings, sale records, and transaction communications
• Identity Verification Data: Government-issued identification or other verification documents where required for seller verification
• Device and Technical Information: IP address, browser type, device type, operating system, and unique device identifiers
• Usage Data: Search history, browsing behavior, clicks, pages visited, session duration, and user engagement data
• Communications Data: Messages, reviews, ratings, photos, and other content you submit through the Platform
• Cookie and Tracking Data: Information collected through cookies, pixels, and similar technologies as described in Section 9 below

2. How We Use Your Information

We use your personal information for the following purposes:

• To operate, maintain, and improve the Platform and user experience
• To facilitate and process transactions, payments, and shipping between users
• To authenticate users and verify seller identities
• To detect, investigate, and prevent fraud, unauthorized access, and other prohibited activities
• To communicate with you about your account, transactions, support requests, and service updates
• To send marketing and promotional communications (where you have opted in or where permitted by applicable law)
• To comply with our legal obligations and enforce our Terms and Conditions
• To resolve disputes and administer our Pitswap Protection Policy

3. Legal Basis for Processing (GDPR / UK GDPR)

If you are located in the European Union or United Kingdom, we process your personal data on the following legal bases:

• Contract Performance: Processing necessary to perform a contract with you (e.g., processing transactions, managing your account)
• Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, security, and platform improvement, where those interests are not overridden by your rights
• Legal Obligation: Processing required to comply with applicable laws and regulations
• Consent: Where you have given explicit consent, such as for marketing communications

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

4. How We Share Your Information

We do not sell your personal information. We may share your data in the following circumstances:

• Service Providers: With trusted third-party vendors who assist with payment processing, shipping logistics, identity verification, customer support, IT infrastructure, and analytics. This includes PayPal (payment processing) and Shippo (shipping label generation and logistics). These providers operate under their own privacy policies and are contractually required to handle your data securely and only for the purposes we specify. We encourage you to review the privacy policies of PayPal (paypal.com/privacy) and Shippo (goshippo.com/privacy) for information on how they handle your data
• Transaction Counterparties: Sharing necessary contact and shipping information between buyers and sellers to complete a transaction
• Legal Compliance: When required to comply with applicable laws, regulations, subpoenas, court orders, or lawful requests from public authorities
• Corporate Transactions: In connection with a merger, acquisition, financing, or sale of assets, provided that the acquiring entity agrees to be bound by this Policy
• Safety and Security: Where disclosure is necessary to protect the rights, property, or safety of Pitswap, our users, or the public

5. International Data Transfers

Pitswap operates from Canada and may transfer your personal data to service providers and partners in other countries, including the United States and other jurisdictions that may have different data protection standards than your home country. When we transfer personal data from the EEA or UK to third countries, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms. By using the Platform, you consent to the transfer of your information to Canada and other countries as described in this Policy.

6. Data Security

We implement industry-standard administrative, technical, and physical safeguards to protect your personal information, including encryption of data in transit (TLS) and at rest, access controls, and regular security reviews. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant regulatory authorities as required by applicable law (including within 72 hours under GDPR where required). However, no method of transmission or electronic storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Account data is generally retained for the duration of your account and for a reasonable period thereafter. Transaction records may be retained for longer periods as required by applicable tax or commercial laws. When data is no longer required, we securely delete or anonymize it.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that inaccurate or incomplete information be corrected
• Deletion: Request deletion of your personal data, subject to legal or contractual limitations
• Portability: Receive your personal data in a structured, machine-readable format (EEA/UK users)
• Objection: Object to processing based on legitimate interests or for direct marketing purposes
• Restriction: Request that we restrict processing of your data in certain circumstances
• Withdrawal of Consent: Withdraw consent at any time where processing is based on consent
• Complaint: File a complaint with your local data protection authority

California residents have additional rights under the CCPA/CPRA, including the right to know what personal information is collected and shared, the right to opt out of the sale or sharing of personal information (Pitswap does not sell personal information), and the right to non-discrimination for exercising your rights.

To exercise any of these rights, please contact us at info@usepitswap.com. We will respond within the timeframe required by applicable law (generally 30 days). We may need to verify your identity before processing your request.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies (such as pixels and local storage) to operate and improve the Platform. Cookies we use include:

• Essential Cookies: Necessary for the Platform to function, including session management and security
• Functional Cookies: Used to remember your preferences and settings
• Analytics Cookies: Used to understand how users interact with the Platform (e.g., pages visited, session duration)
• Marketing Cookies: Used to deliver relevant advertising and track campaign performance (where applicable)

Users in the EEA, UK, and other jurisdictions with cookie consent requirements will be presented with a cookie consent banner and may manage their cookie preferences at any time. You may also control cookies through your browser settings, though disabling certain cookies may affect Platform functionality.

10. Children's Privacy

The Platform is not intended for, and we do not knowingly collect personal information from, individuals under the age of 18. If we become aware that we have collected personal data from a minor without verifiable parental consent, we will take prompt steps to delete such information. If you believe we may have collected information from a minor, please contact us at info@usepitswap.com.

11. Third-Party Services and Links

The Platform may contain links to or integrations with third-party websites, services, or applications. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access through our Platform.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. For material changes, we will provide at least 14 days' notice by email to the address associated with your account or by a prominent notice on the Platform, prior to the changes taking effect. We encourage you to review this Policy periodically.

13. Contact Us and Data Controller Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

EU/UK residents may also contact their local data protection authority if they believe their rights have not been adequately addressed.