Privacy policy

Who is responsible for your data

[LEGAL NAME], registered office [REGISTERED ADDRESS], is responsible for the personal data described in this policy. You can contact us about your data at contact@elbay.online.

Our processing of personal data has been declared to Algeria's National Authority for the Protection of Personal Data (ANPDP) under reference [ANPDP DECLARATION REFERENCE]. Our representative in the European Union is [EU REPRESENTATIVE, IF APPOINTED].

Who this policy covers

This policy covers customers who receive an ElBay payment link, sellers who use ElBay and the people who work for them, people who visit our website, and anyone who writes to us.

The data we collect

Depending on how you deal with us, we collect:

• Customers: your name, email address, telephone number and delivery address; the contents and amounts of your order; whether it was paid; and its shipment and tracking. Your card details are entered on Stripe's page and never reach ElBay.
• Sellers: the name, email address and telephone number of each user; the business's name, registration details and pickup address; its products, orders and payment records; and sign-in records.
• Everyone: technical data such as your IP address, browser and the pages you request, which our hosting provider processes to deliver the site and protect it from abuse; and the messages you send us.

Where it comes from

As a customer, your details are first entered by the merchant who prepares your order, and you can complete or correct them on the payment page. Our payment provider tells us whether your payment succeeded, and DHL tells us where your parcel is.

Why we use it

We use personal data:

• to process, deliver and support orders, and to run sellers' accounts, because this is necessary to perform our contract with you;
• to keep accounting, tax and customs records and to prevent fraud, because the law requires it;
• to keep the service secure, to defend legal claims and to improve the service, because we have a legitimate interest in doing so.

What we do not do

We do not sell personal data, do not send customers marketing emails, do not use advertising or analytics cookies, and do not make decisions with legal effects about you by automated means alone.

Who receives it

We share personal data only as far as each recipient needs it:

• the merchant who fulfils your order, who sees your name, delivery details and order;
• DHL Express and the customs authorities of the countries your parcel passes through, to transport and clear it;
• Stripe, which processes payments;
• our service providers, who process data on our instructions: Vercel (hosting), Supabase (database), Clerk (sign-in for sellers and Admins), Resend (email) and Cloudflare (storage of product images);
• public authorities, where the law requires us to.

International transfers

ElBay is based in Algeria, and some of our providers process data in other countries, including the United States and the European Union. Where the law requires it, these transfers are made with the authorisation of the Algerian authority and with the safeguards the law provides for, such as the European Commission's standard contractual clauses.

How long we keep it

A payment parcel that a seller never confirms is deleted 30 days after it was last changed. Orders, payments and shipments, with the customer details they contain, are kept for [STATUTORY RETENTION PERIOD], as accounting and customs law requires. A seller's account data is kept while the account exists and then for the same period. Messages you send us are kept for as long as needed to deal with them.

Security

Data is encrypted in transit, access is limited to the people who need it, and each seller can see only their own orders and customers. Card data is handled only by Stripe.

Your rights

You can ask to access your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable form. Some data cannot be deleted while the law requires us to keep it. Write to contact@elbay.online; we may ask you to confirm your identity, and we answer within the time the law allows.

You can also complain to a supervisory authority: in Algeria the ANPDP, in the European Union the data protection authority of your country, and in the United Kingdom the Information Commissioner's Office.

Children

ElBay is not intended for anyone under 18.

Changes to this policy

We may update this policy. The date at the top of this page shows when it last changed. Our cookie policy explains the cookies and browser storage we use.