Privacy Policy

ScrapTradeMarket is committed to protecting your personal data. This Privacy Policy explains how [Legal entity name] ("we", "us" or "ScrapTradeMarket"), as data controller, collects, uses and protects information provided by users of the platform located at scraptrademarket.com (the "Platform").

This Policy applies in accordance with EU Regulation 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). By registering on the Platform, you acknowledge that you have read and understood this Policy.

Legal entity name: [Legal entity name]

Registered address: [Domicilio social / Registered address]

VAT / Tax ID: [NIF / VAT]

Commercial registry: [Registro Mercantil]

General contact: info@scraptrademarket.com

Privacy contact: privacy@scraptrademarket.com [to be confirmed]

No Data Protection Officer (DPO) has been designated, as the processing activities do not meet the thresholds requiring mandatory appointment under Article 37 GDPR.

We collect and process the following categories of personal and company data:

Identification and contact data: name, email address, telephone number and job title of the individual registering on behalf of a company.

Company and commercial data: company name, company type (supplier or foundry), country of incorporation, website, VAT / tax identification number, trading activity description.

Verification and KYB documents: information and documentation submitted as part of the company verification process, including incorporation certificates, representative identity documents, waste-management licences and bank account proof.

Usage data: IP address, browser type, pages visited, session duration and other technical data collected automatically when you access the Platform.

Communications: messages sent through inquiry forms, contact requests and any correspondence with our team.

A — Account creation and pre-contractual relations: to enable registration and access to the Platform. Legal basis: execution of a contract or pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR).

B — Provision of the marketplace service: to enable verified members to publish, browse and respond to listings, and to facilitate direct contact between buyers and sellers. Legal basis: legitimate interest of ScrapTradeMarket in operating the Platform (Article 6(1)(f) GDPR).

C — Company verification (KYB): to verify the legal identity, authorisation and compliance of companies seeking access to the marketplace. Legal basis: legitimate interest and, where applicable, compliance with legal obligations (Article 6(1)(c) and (f) GDPR).

D — Legal compliance: to meet obligations imposed by applicable law, including fiscal, anti-money-laundering and waste-management regulations. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

E — Communications and support: to respond to inquiries and send service-related communications. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

F — Future features: if on-platform payment processing, escrow or logistics services are enabled in the future, the relevant processing activities and legal bases will be described in an updated version of this Policy.

We may share your data with the following categories of recipients, strictly for the purposes described above:

Verification providers: identity and company-verification services used to carry out KYB checks on companies applying for marketplace access.

IT and infrastructure providers: hosting, database and security service providers acting as data processors under appropriate data processing agreements.

Logistics operators and payment service providers: if and when transport management or on-platform payment features are enabled, the relevant providers will process data necessary to deliver those services.

Public authorities: data may be disclosed to competent authorities (tax, customs, law enforcement) where required by applicable law.

International transfers: some providers may be located outside the European Economic Area. Where this occurs, transfers are subject to appropriate safeguards (Standard Contractual Clauses or an adequacy decision), in accordance with Article 46 or Article 49 GDPR.

Personal data is retained for as long as the contractual relationship between the user and ScrapTradeMarket remains active.

Upon termination of the account, data will be blocked and retained for a period necessary to meet applicable legal obligations, typically up to five years to cover the civil limitation period under Spanish law, unless a longer period is required by specific regulation (e.g. fiscal or anti-money-laundering rules).

KYB documents are retained for the period required by applicable law and no longer.

Under the GDPR and LOPDGDD, you have the right to: access your personal data; rectify inaccurate data; request erasure ("right to be forgotten") where data is no longer necessary; restrict processing in certain circumstances; obtain data portability; object to processing based on legitimate interest; and withdraw consent where processing is consent-based.

To exercise any of these rights, please send a written request by email to privacy@scraptrademarket.com [to be confirmed], attaching a copy of your identity document. We will respond within one month.

If you believe your rights have not been respected, you have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD, www.aepd.es).

The Platform uses cookies to ensure its correct technical operation (essential cookies) and to collect anonymous analytics data that help us improve the service (analytics cookies).

Essential cookies are strictly necessary for the Platform to function and cannot be disabled. Analytics cookies are only placed with your consent.

For full details on the cookies used and how to manage them, please refer to our Cookie Policy [link to be added].

We apply technical and organisational measures appropriate to the risk involved in processing personal data, including encryption in transit, access controls and regular security reviews.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform or by email at least fifteen (15) days before they take effect. Continued use of the Platform after that date constitutes acceptance of the updated Policy.