Privacy Policy

1. Who We Are

Spocnet (spocnet.com) is a global social commerce network that enables individuals and businesses to list products, communicate in real time, and conduct commercial transactions. Spocnet is operated by its founder as an independent sole trader.

For the purposes of the EU General Data Protection Regulation (GDPR) and equivalent data protection laws worldwide, Spocnet is the Data Controller of the personal data you provide to us. This means we determine the purposes and means of processing your personal data.

2. Personal Data We Collect

We collect personal data in the following categories:

2.1 Data You Provide Directly

• Account registration: Full name, email address, username, date of birth, country of residence, and password (secured via industry-standard hashing by our authentication provider).
• Profile information: Profile photo, business name, business category, bio, products or services offered, business address (sellers only), social media links, payment preferences.
• Listings: Product titles, descriptions, prices, photos, and category information you submit.
• Communications: Messages sent through the platform's built-in chat system between buyers and sellers.
• Transactions: Order details, delivery addresses, transaction history. Payment credentials are processed exclusively by PayPal and are never stored by Spocnet.
• Business verification documents: Company registration certificates, business licenses, or government-issued identification submitted for commercial plan verification.
• Support requests: Content of messages you send us via the contact form or email.
• Posts and social content: Posts, comments, replies, ratings, and other content you publish on the platform.

2.2 Data Collected Automatically

• Device and browser data: Browser type and version, operating system, device type, screen resolution, and language settings.
• Usage data: Pages visited, features used, time spent on pages, clicks, and navigation paths — collected in aggregated and anonymized form.
• Log data: IP address, access timestamps, and error logs, retained for security and fraud prevention purposes.
• Cookies and similar technologies: As described in Section 9 and our Cookie Policy.

2.3 Data We Do Not Collect

• We do not collect precise GPS or device location data.
• We do not store card numbers, bank account details, or any sensitive payment credentials.
• Spocnet is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.
• We do not collect special category data (health, biometric, racial or ethnic origin, political opinions, religious beliefs) unless you voluntarily include such information in your public profile content.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

4. Legal Basis for Processing (GDPR)

For users in the European Union and United Kingdom, we process your personal data under the following legal bases as defined in GDPR Article 6:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the services you have signed up for, including account management, commerce features, messaging, and subscription billing.
• Legal obligation (Article 6(1)(c)): Processing required to comply with applicable laws, including financial record-keeping, tax obligations, and responses to lawful government requests.
• Legitimate interests (Article 6(1)(f)): Processing for fraud prevention, platform security, abuse detection, and improving our services, where these interests are not overridden by your fundamental rights.
• Consent (Article 6(1)(a)): Processing for non-essential cookies, analytics, and future marketing communications, where you have given explicit opt-in consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing and Third-Party Processors

Spocnet does not sell, rent, or trade your personal data to any third party. We share data only with trusted service providers acting as data processors on our behalf, and only to the extent necessary to deliver the platform's services.

5.1 Payment Processing & Escrow

All financial transactions on Spocnet are processed exclusively through PayPal, operating under Spocnet's PayPal Commerce Platform account. When a buyer completes a purchase, transaction data — including the transaction amount, buyer and seller identifiers, and order reference — is shared with PayPal to process the payment and hold funds in escrow on behalf of the marketplace.

When a payout is released to a seller following delivery confirmation, the seller's registered PayPal email address and the payout amount are shared with PayPal solely to execute the disbursement. Spocnet does not store to card numbers, bank account details, or any other sensitive payment credentials at any point. All financial data handling by PayPal is governed by their own Privacy Policy and their obligations as a regulated payment institution.

In the event of a transaction dispute, relevant order information — including transaction records, delivery status, and correspondence between buyer and seller — may be shared with PayPal as part of their Buyer Protection or dispute resolution process.

5.2 Shipping and Logistics

Sellers who connect a shipping account for label generation share relevant delivery information with our logistics integration partner. This data is managed directly by that provider and is not stored by Spocnet beyond what is necessary to display order status. See the Shippo Privacy Policy.

5.3 Cloud Infrastructure

Spocnet's platform is hosted on enterprise-grade cloud infrastructure provided by Google Cloud. This includes authentication, data storage, file management, and real-time communication features. All data is stored within secure, certified data centres in compliance with GDPR and applicable international standards. Google Cloud operates as a data processor under a Data Processing Agreement with Spocnet. See Google's Privacy Policy.

5.4 Mapping and Security Services

Location-based features and automated bot prevention are powered by Google services (Google Maps and reCAPTCHA). Data shared with these services is limited to what is technically necessary and is governed by Google's Privacy Policy.

5.5 Analytics

Spocnet uses Google Analytics (via Firebase) to collect aggregated, anonymized usage data about how users interact with the platform. This data is used solely to improve performance and features. Analytics data is not linked to individual identities and is not used for advertising purposes. You may opt out of analytics data collection via the privacy consent panel. See Firebase Privacy.

5.6 Legal Disclosures

We may disclose your personal data to law enforcement authorities, regulators, or courts where we are legally required to do so, or where necessary to protect the rights, property, or safety of Spocnet, its users, or the public. We will notify affected users of any such disclosure unless prohibited by law.

5.7 Data Processing Agreements

All third-party service providers who process personal data on our behalf are bound by Data Processing Agreements (DPAs) that require them to process data only on our documented instructions, maintain appropriate security measures, and comply with applicable data protection law.

6. International Data Transfers

Spocnet is a global platform. Your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Where personal data of EU or UK users is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Binding corporate rules or equivalent mechanisms where SCCs are not applicable

Our primary cloud infrastructure provider (Google Cloud) operates under approved SCCs and maintains EU data residency options where required.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. For most user-generated content, we employ an immediate deletion policy upon account termination.

• Account and profile data: Permanently deleted immediately upon account deletion. No residual data remains in our active systems.
• Transaction and payment records: Retained for 7 years from the transaction date. This is a strict legal requirement for tax, accounting, and fraud prevention purposes. This data cannot be deleted early due to financial laws.
• Messages and communications: Permanently deleted immediately upon account deletion. Once deleted, these messages are irretrievable.
• Business verification documents: Permanently deleted immediately upon account deletion, unless specific retention is required by applicable financial regulations (e.g., for verified merchants with transaction history).
• Support and contact messages: Retained for up to 2 years to enable follow-up, dispute resolution, and service improvement.
• Consent records: Retained for 3 years. This is a secure, anonymized log proving that you agreed to our terms at a specific time. It does not contain your personal profile data, only a timestamp of your consent.

Note on Legal Retention: While we delete most data immediately, certain transactional records must be kept by law (e.g., for tax authorities). These records are securely isolated and used only for legal compliance.

8. Your Privacy Rights

Depending on your location, you have specific rights regarding your personal data. For most requests, you can exercise these rights directly through your Account Settings. We will respond to any verified requests submitted via email within 30 days.

8.1 Rights Under GDPR (EU / UK Users)

• Right of access (Article 15): You may request a copy of the personal data we hold about you. Most of this information is visible in your profile and account settings.
• Right to rectification (Article 16): You have the right to correct inaccurate or incomplete data. You can update your name, email, and profile details directly in your Account Settings.
• Right to erasure (Article 17): You have the right to request the deletion of your personal data. You can permanently delete your account and all associated data immediately via the Delete Account option in your settings. Note: Certain data may be retained where required by law (e.g., for tax or fraud prevention).
• Right to data portability (Article 20): You may request a copy of your data in a structured, machine-readable format. Please contact us at Contact Form. to request a data export.
• Right to restrict processing (Article 18): You may request that we limit how we process your data in certain circumstances. Contact us to discuss specific restrictions.
• Right to object (Article 21): You may object to processing based on legitimate interests, such as analytics. You can manage some of these preferences via the Privacy Consent Panel in the footer.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time via the Privacy Consent Panel in the footer. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with your national data protection authority. EU users may also use the EU ODR platform.

8.2 Rights Under CCPA / CPRA (California Users)

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected. Most of this information is available in your Account Settings.
• Right to delete: You may request deletion of your personal information. You can exercise this right immediately by using the Delete Account feature in your settings.
• Right to correct: You may request correction of inaccurate personal information. You can update your details directly in your Account Settings.
• Right to opt-out of sale/sharing: Spocnet does not sell or share personal information with third parties for cross-context behavioral advertising. Therefore, no opt-out is required.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

8.3 Rights Under Other Applicable Laws

Users in Brazil (LGPD), Canada (PIPEDA), UAE (PDPL), China (PIPL), India (DPDP Act), and other jurisdictions retain all rights granted to them under their applicable local data protection laws. These rights are substantially equivalent to those listed above.

8.4 How to Exercise Your Rights

For account deletion and data corrections, use your account settings page directly — this is the fastest method.
For data export, restriction, or any other request, contact us at Contact Form. We will verify your identity before processing the request and respond within shortest period possible .

9. Cookies and Tracking Technologies

Spocnet uses cookies and similar technologies to operate the platform, remember your preferences, and improve your experience. We use five categories of cookies:

• Essential: Required for authentication, sessions, and security. Always active.
• Functional: Remember your language and display preferences. Optional.
• Commerce: Support order tracking, delivery preferences, and transaction features. Optional.
• Social: Power messaging, connections, and community features. Optional.
• Analytics: Collect aggregated, anonymized usage data to improve the platform. Optional, requires consent.

You can manage your cookie preferences at any time via the Privacy button in the footer. For full details, see our Cookie Policy.

10. Children's Privacy

Spocnet is not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. By using our services, you represent that you are at least 18 years old or have the consent of a parent or legal guardian.

11. Data Security

We implement industry-standard technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• All data transmitted between your device and our platform is encrypted using TLS (HTTPS).
• Passwords are stored in hashed form using secure cryptographic algorithms and are never stored in plain text.
• Access to personal data is restricted to authorized personnel only, on a strict need-to-know basis.
• Our cloud infrastructure operates within certified, enterprise-grade data centres with physical and logical access controls.
• Business verification documents are stored in encrypted form and accessible only by authorized administrators.

Despite these measures, no system is completely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

12. Marketing Communications

Spocnet currently sends only transactional emails — including order confirmations, payment receipts, account alerts, and platform notifications. These are necessary for the operation of the service and do not require separate consent.

In the future, Spocnet may introduce optional marketing and promotional communications (newsletters, feature updates, offers). When we do, we will request your explicit opt-in consent before sending any such communications. You will always be able to unsubscribe at any time via an unsubscribe link in the email or from your account notification settings. We will never send marketing emails without your prior consent.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When material changes are made, we will notify registered users via their account dashboard or registered email address at least 14 days before the changes take effect.

The current version of this Privacy Policy is always available at spocnet.com/privacy. The "Last Updated" date at the top of this page indicates when it was last revised. Continued use of Spocnet after the effective date of any update constitutes acceptance of the revised Privacy Policy.

14. Contact and Data Protection Requests

For any questions about this Privacy Policy, to exercise your data rights, or to report a privacy concern, please contact us:

• Contact form: spocnet.com/terms
• Response time: We aim to respond in the shortest time possible.

If you are an EU user and are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.

For Algerian users, complaints may be directed to the National Authority for the Protection of Personal Data (ANPDP) established under Algeria Law 18-07.