We take the utmost care and apply the highest security standards to protect your personal data from unauthorised access. The processing of personal data on our website https://schmoozle.com and in the Schmoozle apps (for the sake of simplicity, reference will only be made to the “website” apart from exceptional cases) is carried out in accordance with the provisions of the General Data Protection Regulation (GDPR).
In recognising the diverse legal landscapes of the UK data law, Schmoozle wishes to highlight that our privacy practices are aligned with these laws of the UK. This dedication ensures that additional region-specific terms may only apply to individuals in those locales, conforming strictly to the requirements of UK laws.
1. Responsible party
Responsible party in the sense of the GDPR:
Schmoozle.com
If you have any questions regarding the collection, processing or use of your personal data, or if you wish to provide information, correct, block or delete data, please contact: admin@schmoozle.com
2. Data processing on our website
When you visit our website, our web server stores each registration only in the back-end database. The following data is collected and stored until it is manually deleted on request or via process in Schmoozle.com:
- Schmoozle ID
- Date and time of access
- Notification of whether the registration was successful and activation of account thereof after user clicks on activation email link
- The only user information that is stored is alias (which can be a nickname or real name at the user’s discretion), email address (as username) and a password. Also, Date of Birth is stored but this is only used to restrict any content that may not be returned if user is under 18 years of age, that is not appropriate.
This data is processed for the purposes of enabling the use of the website (establishing a connection), system security, technical administration, network infrastructure and the optimisation of the online offer. This data cannot be attributed to specific persons, and will not be merged with other data sources without consent. The data will also be deleted after a statistical evaluation.
The legal basis for the data processing is art. 6 (1) (f) GDPR.
3. Collection, processing and use of personal data
During data processing, your interests that require protection are always taken into account in accordance with the legal provisions. Personal data (such as your name or email address) is only collected if you provide it to us voluntarily. This may be the case, for example:
- when you make a contact request
- when you register for a Schmoozle account
- when you leave feedback via our forms or collaborative forums or service request/incident support cases
- when you take part in a survey
- or when you tell us your postcode and address for the purposes of swapsies area of website, which only the person swapping with will see
We use the data you provide without your specific consent exclusively to process your request and delete it when the process is complete and legal regulations do not prevent deletion.
The legal basis for the data processing is art. 6 (1) (f) GDPR.
3.1 Gemini AI
We use the “Gemini AI” from Google purely for performing AI lookups when users type in a vault or team collection item search item. The data is purely read only and stored against the item in their vault if they choose to save the item and/or customise any of the returned values for description, or any key item values returned.
For more information about Gemini Apps Privacy Hub’s processing and security measures, please see the following: Gemini Privacy Hub
3.2 Ebay
For the items for any category in a user’s watchlist there is the option when hover over item to go into ‘Ebay Registry’. If clicked the user is taken to screen where it performs a look up using the Asset name using Ebay API to return results from Ebay, which if user decides can click on ‘View on Ebay’ button to take them to Ebay specific page for that item. No transactions are performed within Schmoozle website or app it is purely a mechanism to present user with price and details of each ebay item that is related.
For more information about Ebay API processing and security measures Schmoozle complies with: eBay API License Agreement
Also, here is the eBay User Privacy Notice: eBay Privacy Notice
3.3 Stripe
When concluding a Schmoozle Collector Plus or Pro subscription, the payment process is handled by the payment service provider Stripe Inc. 510, Townsend St., San Francisco, CA 94103, "Stripe". This is in line with our legitimate interest in offering an efficient and secure payment method (art. 6 (1) (f) GDPR). In this context, we share data with Stripe to the extent necessary for the performance of the contract (art. 6 (1) (b) GDPR). This involves transaction data. This data includes, for example, the payment method (i.e. credit card, debit card or account number), bank code, currency, amount and date of payment. During a transaction, your name, email address, billing or shipping address, and sometimes your transaction history may be transmitted. This data is necessary for authentication. In addition, Stripe may also collect technical data (such as IP address), name, address, phone number and your country for fraud prevention, financial reporting and to fully provide its own services.
The processing of the data provided under this section is not required by law or contract. We cannot process a payment via Stripe without the submission of your personal data. Your data will be stored by us until the payment processing is completed. This includes the period necessary for processing refunds, claims management and fraud prevention.
Stripe has a dual role in data processing activities as a Controller and Processor. As a Controller, Stripe uses your data to comply with regulatory obligations. This is in accordance with Stripe's legitimate interest (pursuant to art. 6 (1) (f) GDPR) and serves the performance of the contract (pursuant to art. 6 (1) (b) GDPR). We have no influence on this process. Stripe acts as a Processor in order to be able to complete transactions within the payment networks. Within the scope of the processing relationship, Stripe acts exclusively according to our instructions and has been contractually obligated within the meaning of art. 28 GDPR to comply with the provisions of data protection law.
As part of processing via Stripe, data may be transferred to the USA. In the USA, there is no equivalent to the general adequacy decision of the European Commission certifying an adequate level of data protection. By transmitting your personal data, there is a risk that US authorities will access and process it for their own purposes. To protect your personal data, we have concluded so-called standard contractual clauses (“SCCs”). SCCs are data protection regulations issued by the European Commission, the conclusion of which imposes legal obligations on the data importer and the implementation of which guarantees compliance with European data protection standards. Stripe has implemented compliance measures for international data transfers. These apply to all global activities where Stripe processes personal data of individuals in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs). For more information, please see Stripe's privacy policy.
3.4 Google Books
We use Google Books API, a books data platform provided by Google, to deliver and manage data that can be associated with specific search criteria performed by Schmoozle user for a Vault or Team Collection, with a category of ‘Books’ or ‘Comics & Graphic Novels’. The data that is sent to Google Books API is purely what was sent via any of the search input boxes on search screen and this does not persist. The results from that Google Books API search are purely displayed either as one single result or a summary of results where user can choose one of those records to populate into their vault collection item, if they choose.
No personal or user data is sent to Google Books API, purely the Book or Comics & Graphic Novels search criteria.
More information about Google Books API and its privacy practices is available at: Google Books Privacy
3.5 Ideal Postcodes
We use Ideal Postcodes API, a PAF address lookup platform provided by Ideal Postcodes, purely to provide a mechanism for users to look-up the address they wish to provide as part of a ‘Swapsies’ transaction. They can also do so manually by filling in each of the address input boxes but this is provided for ease of use for a user as an alternative. This is specifically for when a Swapsies transaction has been approved by the swap originator and when choosing Exchange Method of Standard Mailing, Archival Collection or Secure Meetup, the user can perform an address lookup via Postcode. The data that is sent to Ideal Postcodes API is purely what was sent via the search input box, namely Postcode of the user’s address or a postcode where to meet up and this does not persist. The results from that Ideal Postcodes API search are purely displayed either as one single result or a summary of Address Street or area house/flat numbers, where user can choose one of those records to populate into the address field, for proposing that logistical address.
No personal or user data is sent to Ideal Postcodes API, purely the Postcode search criteria.
More information about Ideal Postcodes API and its privacy practices is available at: Ideal Postcodes Privacy Notice
4. Use of functional cookies
We use so-called cookies to make your visit to our website comfortable and to enable the use of certain functions. Cookies are small text files that are used as identifiers. We transfer them to the hard drive of your computer via your web browser and can read them during your current visit (so-called session cookies). Please note that certain cookies are already stored as soon as you enter our website. Our cookies are protected against being read by third parties by means of your browser’s security standards. You have the option of preventing cookies from being stored on your computer via the appropriate settings in your browser. However, this may limit the functionality of our website or prevent you from accessing it.
The legal basis for the data processing is art. 6 (1) (f) GDPR.
5. Affiliate links
On our website, we include so-called affiliate links or other references (which may include, for example, search masks or widgets) to offers and services from third-party providers. If you click on the affiliate links or subsequently take advantage of the offers, we may receive a commission or other benefits from these third parties. Currently this is purely for when watchlist items are clicked for ebay api results and clicking on any of those links and making a purchase in Ebay website.
To be able to track whether you have taken advantage of the offers of an affiliate link that we have included, it is necessary for the respective third-party provider to learn that you have clicked on an affiliate link on our website. The assignment of the affiliate link is for commission accounting purposes only and will be deleted as soon as it is no longer necessary.
In order to assign affiliate links, these can be supplemented by certain values that comprise a component of the link or that can be stored elsewhere, e.g. in a cookie. These values may include, in particular, the source website (referrer), the time, an online identifier of the operator of the website where the affiliate link was located, an online identifier of the respective offer, the type of link used, the type of offer and an online identifier of the user.
If you have given us your consent to use a third-party provider, the legal basis for the data processing is art. 6 (1) (a) GDPR. However, the use of a third-party provider may also form part of our (pre)contractual services, in which case the legal basis for the data processing is Art. 6 (1) (b) GDPR. Otherwise, your data will be processed on the basis of our legitimate interests (i.e. interest in efficient, economical and recipient-friendly services) and the legal basis for the data processing is Art. 6 (1) (f) GDPR.
6. Google Firebase
Our website uses “Firebase”, an analysis and monitoring tool from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).
Firebase supports our login process by processing so-called “instance IDs”, which include a time stamp. These IDs are assigned to a specific user and allow the linking of different events or processes. This data does not allow us to draw any conclusions about the specific user. We do not carry out any personalisation. We process this aggregated data in order to analyse and optimise user behaviour, for example by evaluating crash reports. We further use Firebase Remote Config on our website and in the Schmoozle mobile app. The service allows us to configure app settings so that we can change the app you have installed on your device without you having to install a new version from the Google Play Store or Apple App Store, for example. For this purpose, your device information, your language settings and your country settings are processed.
In order to continuously improve Schmoozle, we conduct tests - for example, to find out more about an optimal design or the greatest possible clarity of Schmoozle. For such testing purposes, we also collect statistical data and use the Firebase A/B Testing web analysis system (https://firebase.google.com/docs/ab-testing/) for this purpose. Firebase does not collect any personal data. The information about your use of this website is transmitted anonymously to a Firebase server and stored there.
The legal basis for the data processing by Firebase is art. 6 (1) (a) GDPR and art. 6 (1) (f) GDPR.00. As part of processing via Firebase, data may be transferred to the USA. In the USA, there is no equivalent to the general adequacy decision of the European Commission certifying an adequate level of data protection. By transmitting your personal data, there is a risk that US authorities will access and process it for their own purposes. To protect your personal data, we have concluded so-called standard contractual clauses (“SCCs”). SCCs are data protection regulations issued by the European Commission, the conclusion of which imposes legal obligations on the data importer and the implementation of which guarantees compliance with European data protection standards. Google has implemented compliance measures for international data transfers. These apply to all global activities where Stripe processes personal data of individuals in the EU. These measures are based on the EU Standard Contractual Clauses (SCCs).
You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of this website. You can also prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link (https://tools.google.com/dlpage/gaoptout?hl=de). You can find more information about the processing of your data by Google here. You have the right to object to the processing of your personal data pursuant to art. 21 GDPR, insofar as there are grounds for doing so that arise from your particular situation. If you wish to exercise your right to object, you can send us an email at: admin@schmoozle.com.
7. Data processing when cooperating with our customers and partners
We collect and process the personal data of our customers and partners for the initiation and implementation of the contractual relationship in question. The legal basis for the data processing is art. 6 (1) (b) GDPR.
Furthermore, we have a legitimate interest in processing the personal data of our customers and partners for the purpose of direct mail advertising. The legal basis for the data processing is art. 6 (1) (f) GDPR.
The following categories of data are affected: Name (or alias), address, e-mail address and date of birth. In principle, the personal data is collected directly, unless it is provided by another body, in particular by public authorities or - if third parties are named as a reference to us - by these third parties. The personal data will be stored for as long as is necessary for the processing of the order, including invoicing, and/or insofar as statutory retention obligations prevent the deletion of the data.
The personal data is processed by service providers that we use for order processing.
8. How we store and protect your data
We process and store your data in highly secure data centers within the EU, operated by Google Cloud Platform. These data centers are secured and certified to the highest standards (at least ISO 27001, 27017, 27018 and EU Standard Contractual Clauses (SCCs)) and protected by signed data processing addenda.
All information provided is encrypted both during transmission (TLS) and at rest. Access to personalised information by employees is limited and audited.
The processing and storage of information that may be personally identifiable is kept to the minimum necessary for the operation of the service. Where necessary, this type of information is subject to access control, strict retention, and pseudonymisation.
9. Your rights and options
9.1 Managing tracking technologies and deleting cookies
Depending on whether the processing is based on consent or legal permission, you have the option at any time to withdraw your consent or to object to the processing of your data via cookies. You can initially declare your objection by means of your browser settings, e.g. by deactivating the use of cookies (which may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared by means of a variety of services, especially in the case of tracking, e.g. via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.
You can also control certain tracking tools on your mobile devices. For your convenience, here are instructions that may work for your mobile device; however, please note that the setting features may vary from device to device.
Devices running Google Play Services 4.0 and later use the Google Android Advertising ID (AAID). Learn more about restricting ad tracking using this ID:
- Go to Settings on your device
- Select Ads
- Select Disable interest-based ads
Devices running iOS 6 and later use the Apple Advertising Identifier (IDFA). For more information about restricting ad tracking using this ID:
- Go to Settings on your device
- Select Privacy
- Select Tracking
- De-select Allow Apps to Request to Track
9.2 Data subject rights under the GDPR
Under the GDPR, you are entitled to the following statutory data subject rights, provided that the preconditions are met:
- Right to information about your data stored by us under art. 15 GDPR.
- Right to correction of inaccurate data under art. 16 GDPR.
- Right to deletion of data stored by us under art. 17 GDPR.
- Right to restriction of the processing of data stored by us under art. 18 GDPR.
- Right to data portability under art. 20 GDPR.
- Right to withdraw at any time pursuant to art. 7 (3) GDPR any consent granted to us (Consent Manager); this has the consequence that we may no longer continue the data processing based on this consent in the future.
- Right to lodge a complaint with a competent supervisory authority under art. 77 GDPR if you believe that the processing of personal data concerning you violates the provisions of the GDPR.
Right of objection
Insofar as your personal data is processed on the basis of legitimate interests pursuant to art. 6 (1) (f) GDPR, you have the right to object to the processing of your personal data pursuant to art. 21 GDPR, insofar as there are grounds for doing so that arise from your particular situation.
If you wish to exercise your right to object, you can send us an email at: admin@schmoozle.com.
You can contact us with any questions regarding data protection via admin@schmoozle.com.