Privacy Policy

1. Controller

• The controller within the meaning of the General Data Protection Regulation (GDPR) is:
• Milesmarket Ltd Suite RA01 195-197 Wood Street London E17 3NU United Kingdom Company No. 17488924 Email: support@milesmarket.de

2. General

• Protecting your personal data is a high priority for MilesMarket.
• We process personal data under applicable data protection laws, in particular the UK GDPR, the Data Protection Act 2018 and, where it applies to individuals in the European Economic Area, the EU GDPR.

3. What data we process

4. Purposes of processing

• Provision of the platform
• Registration
• Identity verification
• Payment processing
• Fraud prevention
• Communication
• Handling of disputes
• Improvement of the platform
• Fulfillment of legal obligations
• Enforcement of our terms of use

5. Legal bases

• Art. 6 (1) (b) GDPR (contract)
• Art. 6 (1) (c) GDPR (legal obligation)
• Art. 6 (1) (f) GDPR (legitimate interest)
• Where required, processing is based on consent pursuant to Art. 6 (1) (a) GDPR.

6. Registration

• Registration is required to use the platform.
• The data collected during registration is processed solely for the performance of the user relationship.

7. Payment processing

• Payment processing is handled via Stripe Connect.
• In particular, the following data may be processed: name, address, payment information, bank details, card details, payout information and tax data.
• Processing is carried out directly by Stripe in accordance with their privacy terms.
• MilesMarket does not store full credit card details.

8. Communication

• When you contact us, we store the information you send.
• This concerns, for example, support inquiries, emails, chat messages and disputes.

9. Resolution Center

• Additional information may be processed as part of a dispute.
• This includes, for example, screenshots, documents, payment receipts, messages and proofs of identity.
• This processing takes place exclusively for handling the respective dispute.

10. Fraud prevention

• Automated systems may be used to safeguard our platform.
• In particular, the following may be considered: unusual login events, multiple accounts, suspicious transactions, technical anomalies and abuse patterns.

11. Cookies

• Our platform uses strictly necessary cookies.
• Where analytics or marketing cookies are used, this only takes place after appropriate consent, as far as required by law.

12. Storage period

• We store personal data only for as long as required to perform the contract, comply with statutory retention obligations or serve legitimate interests.
• After the respective periods have expired, the data is deleted or anonymized.

13. Recipients of personal data

• Any transfer takes place only to the extent required.
• Recipients may in particular include: Stripe, hosting providers, email service providers, authorities, courts, tax advisors, lawyers and IT service providers.

14. International data transfers

• Where personal data is processed outside the European Economic Area, this only takes place in compliance with statutory requirements.
• In particular, standard contractual clauses or other suitable guarantees may be used.

15. Your rights

• You have in particular the following rights: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent.
• You also have the right to lodge a complaint with a data protection supervisory authority.

16. Data security

• We use appropriate technical and organizational measures to protect personal data against loss, misuse, manipulation, unauthorized access and unauthorized disclosure.

17. Minors

• Our platform is aimed exclusively at persons aged 18 and over.

18. Amendments to this Privacy Policy

• We reserve the right to adapt this Privacy Policy where required due to legal or technical changes.
• The current version is available on our website.

19. Identity verification (KYC)

• Before a first purchase and before any payout, we carry out an identity verification, technically handled via Stripe Identity.
• This processes in particular: name, date of birth, ID document data, selfie/photo comparison and the verification result.
• ID documents and biometric verification data are processed by Stripe; MilesMarket itself does not store ID documents, only the verification status and the time of verification.
• Legal bases are Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligations, in particular anti-money-laundering) and Art. 6(1)(f) GDPR (fraud prevention). Where biometric data is processed, this is based on your explicit consent given to Stripe (Art. 9(2)(a) GDPR).

20. Email notifications

• We send transactional emails (e.g. order confirmations, reminders for open transactions, dispute notifications, payout information) as well as a short onboarding series after registration covering identity verification, profile completion and your first listing.
• Legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in effective user guidance).
• Newsletters and market information without a contractual link are sent solely on the basis of your consent (Art. 6(1)(a) GDPR). You can unsubscribe from any email category at any time via the unsubscribe link or by contacting us; strictly necessary transactional emails remain unaffected.
• We use email service providers as processors for delivery. Sending, delivery and error logs are stored to ensure deliverability.

21. Performance measurement (Core Web Vitals)

• To optimise loading times we collect anonymous performance measurements from your browser (largest contentful paint, layout shift, interaction latency, server response time) together with the page path visited and a coarse device category (mobile or desktop).
• No IP addresses, user identifiers, cookies or other personal attributes are stored, and we cannot link these measurements to an individual.
• The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a fast and stable service).

22. Measurement of entry buttons

• To understand which entry points are used (e.g. from our Instagram profile), we record anonymously when a key button is clicked: the button label, the page path, a campaign identifier from the URL (e.g. utm_source) and a coarse device category.
• No IP addresses, user identifiers or cookies are stored; the campaign identifier is kept only in your device's session storage for the duration of the browser session.
• The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our service).

23. Push notifications

• If you enable push notifications, we process the push endpoint generated by your browser together with its encryption keys in order to inform you about new messages, offers and order events.
• Delivery runs through the push service of your browser vendor. Processing is based on your consent (Art. 6(1)(a) GDPR) and can be withdrawn at any time in your browser settings or your profile.

24. Review invitations (Trustpilot)

• After completed transactions we invite buyers and sellers by email to leave a review; if no review is submitted, we send a single reminder after around seven days.
• For invitations via the Trustpilot invitation service, name, email address and an order reference are transmitted to Trustpilot A/S.
• The legal basis is Art. 6(1)(f) GDPR (legitimate interest in transparent reviews). You may object to these emails at any time.

25. Partner and referral programme

• Within our partner programme we process referral codes, attributed sign-ups, commissions and payout data via Stripe Connect.
• To prevent abuse, referrals are checked automatically for patterns such as self-referrals or multiple accounts.
• The legal bases are Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (fraud prevention).