Privacy Policy

1. Controller

• The controller within the meaning of the General Data Protection Regulation (GDPR) is:
• MilesMarket Owner: Selcuk Akarsu Melissenweg 18 51061 Cologne Germany Email: info@selcuk-osman.com

2. General

• Protecting your personal data is a high priority for MilesMarket.
• We process personal data exclusively within the framework of the applicable data protection laws, in particular the GDPR, the German Federal Data Protection Act (BDSG) and other applicable data protection regulations.

3. What data we process

4. Purposes of processing

• Provision of the platform
• Registration
• Identity verification
• Payment processing
• Fraud prevention
• Communication
• Handling of disputes
• Improvement of the platform
• Fulfillment of legal obligations
• Enforcement of our terms of use

5. Legal bases

• Art. 6 (1) (b) GDPR (contract)
• Art. 6 (1) (c) GDPR (legal obligation)
• Art. 6 (1) (f) GDPR (legitimate interest)
• Where required, processing is based on consent pursuant to Art. 6 (1) (a) GDPR.

6. Registration

• Registration is required to use the platform.
• The data collected during registration is processed solely for the performance of the user relationship.

7. Payment processing

• Payment processing is handled via Stripe Connect.
• In particular, the following data may be processed: name, address, payment information, bank details, card details, payout information and tax data.
• Processing is carried out directly by Stripe in accordance with their privacy terms.
• MilesMarket does not store full credit card details.

8. Communication

• When you contact us, we store the information you send.
• This concerns, for example, support inquiries, emails, chat messages and disputes.

9. Resolution Center

• Additional information may be processed as part of a dispute.
• This includes, for example, screenshots, documents, payment receipts, messages and proofs of identity.
• This processing takes place exclusively for handling the respective dispute.

10. Fraud prevention

• Automated systems may be used to safeguard our platform.
• In particular, the following may be considered: unusual login events, multiple accounts, suspicious transactions, technical anomalies and abuse patterns.

11. Cookies

• Our platform uses strictly necessary cookies.
• Where analytics or marketing cookies are used, this only takes place after appropriate consent, as far as required by law.

12. Storage period

• We store personal data only for as long as required to perform the contract, comply with statutory retention obligations or serve legitimate interests.
• After the respective periods have expired, the data is deleted or anonymized.

13. Recipients of personal data

• Any transfer takes place only to the extent required.
• Recipients may in particular include: Stripe, hosting providers, email service providers, authorities, courts, tax advisors, lawyers and IT service providers.

14. International data transfers

• Where personal data is processed outside the European Economic Area, this only takes place in compliance with statutory requirements.
• In particular, standard contractual clauses or other suitable guarantees may be used.

15. Your rights

• You have in particular the following rights: access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent.
• You also have the right to lodge a complaint with a data protection supervisory authority.

16. Data security

• We use appropriate technical and organizational measures to protect personal data against loss, misuse, manipulation, unauthorized access and unauthorized disclosure.

17. Minors

• Our platform is aimed exclusively at persons aged 18 and over.

18. Amendments to this Privacy Policy

• We reserve the right to adapt this Privacy Policy where required due to legal or technical changes.
• The current version is available on our website.

19. Identity verification (KYC)

• Before a first purchase and before any payout, we carry out an identity verification, technically handled via Stripe Identity.
• This processes in particular: name, date of birth, ID document data, selfie/photo comparison and the verification result.
• ID documents and biometric verification data are processed by Stripe; MilesMarket itself does not store ID documents, only the verification status and the time of verification.
• Legal bases are Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligations, in particular anti-money-laundering) and Art. 6(1)(f) GDPR (fraud prevention). Where biometric data is processed, this is based on your explicit consent given to Stripe (Art. 9(2)(a) GDPR).

20. Email notifications

• We send transactional emails (e.g. order confirmations, reminders for open transactions, dispute notifications, payout information) as well as a short onboarding series after registration covering identity verification, profile completion and your first listing.
• Legal bases are Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in effective user guidance).
• Newsletters and market information without a contractual link are sent solely on the basis of your consent (Art. 6(1)(a) GDPR). You can unsubscribe from any email category at any time via the unsubscribe link or by contacting us; strictly necessary transactional emails remain unaffected.
• We use email service providers as processors for delivery. Sending, delivery and error logs are stored to ensure deliverability.