Privacy

Privacy Policy

This Privacy Policy describes the processing of personal data when visiting and using SecretUndies.com. The current operator and data controller is Sebastian Rosenboom personally. A company named SecretUndies Ltd. is in the process of being formed and is not currently the operator of the platform.

Last updated: 7 October 2026

1. Data controller

Sebastian Rosenboom
SecretUndies
Pentadaktilou Street 35
7081 Larnaca, Republic of Cyprus
Phone: +357 94 049233
Email: info@secretundies.com

For data protection enquiries and to exercise your rights, please write to the email address above with the subject Data protection. No user account is required.

2. Scope of application

This Privacy Policy applies to all SecretUndies.com online services, including associated domains, subpages, mobile applications, communication features and payment functions. It describes how we process the personal data of visitors, registered users (sellers and buyers), affiliates and other contractual partners.

3. Legal bases

The processing of personal data is governed by the GDPR and other applicable data protection law. Legal obligations under the Digital Services Act may require particular processing activities; they do not replace the assessment of a lawful basis under data protection law. Depending on the processing activity, the following legal bases may apply in particular:

• Article 6(1)(a) GDPR (consent)
• Article 6(1)(b) GDPR (performance of a contract or steps taken prior to entering into a contract)
• Article 6(1)(c) GDPR (legal obligation)
• Article 6(1)(f) GDPR (legitimate interests, such as platform operation, IT security and fraud prevention)

4. Categories of personal data processed

Depending on the use of the platform, we process the following categories of personal data in particular:

• Master data (Name or pseudonym, contact details, proof of age)
• Account data (Login, password hashes, account ID, rank status, coin balances)
• Transaction data (Item information, sales prices, order history, fee statements, refund/chargeback information)
• Communication data (chat content, support requests, DSA reports including metadata)
• Payment and accounting data (generally only pseudonymised references/tokens, payment status, booking and billing information)
• Seller payout/verification information (e.g. account holder, IBAN/BIC or other payout data, address, date of birth, tax/identification data, verification status; depending on the payout model, also ID/selfie checks), insofar as this is necessary for payouts/KYC/AML
• Technical data (IP address, time stamp, device information, cookies, log files)

5. Purposes of processing

We process personal data for the following purposes:

1. Provision and personalisation of platform functions
2. Registration, account management and operation of the ranking system
3. Processing of C2C transactions including coins services and fees
4. Moderation, detection of abuse and enforcement of the Terms and Conditions
5. Compliance with legal obligations (tax, commercial, DSA and consumer protection law)
6. Ensuring IT security, error analysis and product improvement
7. Communicating with users, support and dispute resolution
8. Marketing communications to the extent permitted (e.g. newsletters, if permitted)

6. Hosting and operation

Our platform is hosted on servers operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. We have entered into a data processing agreement with IONOS in accordance with Article 28 GDPR. IONOS processes server log files (IP address, access time, user agent and referrer) to ensure the operation and security of the platform.

7. Registration and age verification

You must be at least 18 years old to use SecretUndies.com. Where necessary, we process proof of age and identity to comply with legal obligations and protect minors. The legal bases are Article 6(1)(b) and (c) GDPR.

8. Coins system and additional digital services

When you purchase Coins, we process order information, payment references and usage data relating to the activated functions. Payment data is generally processed by the integrated payment service provider. We receive only transaction-related tokens or references, status notifications and information required for billing, but not full card details.

9. Payment processing (in particular Stripe)

9.1 Payment service provider used

We use Stripe as our payment service provider to process buyer payments and, where applicable, payouts to sellers. Depending on the payment method, country and product, data may be processed by companies within the Stripe group.

9.2. Allocation of roles under the GDPR

Stripe processes personal data both as a processor on our behalf and as an independent controller. The respective role depends on the service used and the processing purpose. Stripe acts as a processor when technically carrying out payment transactions on our instructions. For its own legal obligations, fraud prevention and other processing purposes of its own, Stripe acts as a controller. Further information is available in Stripe's Privacy Policy.

9.3 Buyer data: processing by Stripe

In particular, when making a payment, Stripe processes:

• Payment details (e.g. card details, bank/wallet details, expiry date, CVC, tokenised payment identifiers)
• Billing data (e.g. name, billing address, email/phone if applicable)
• Transaction data (amount, currency, time, payment status, refunds/chargebacks if applicable)
• Technical data for security and fraud prevention (e.g. device/browser information, IP address, risk signals)

We do not store full card details. We typically store only references or tokens, payment status, transaction records and information required for support, reconciliation and billing.

9.4 Seller data: transfer to Stripe for payouts

To enable payouts to sellers, we either transfer the required seller data to Stripe or, depending on the payout model, arrange for sellers to enter this data directly through an onboarding or verification process provided by Stripe. This data may include:

• Identity and contact details (e.g. name, address, date of birth, email, telephone)
• Payout details (such as the account holder, IBAN/BIC or local bank details)
• Tax/verification data and evidence (e.g. tax ID, ID documents, selfie/verification status if applicable), where required by regulation
• Account status/payout information (e.g., Stripe account ID, verification status, payout status)

The purposes are to process payouts, comply with regulatory requirements (in particular KYC and AML requirements), prevent abuse and protect against fraud.

9.5 Legal bases

Depending on the circumstances, processing and disclosure are based on:

• Article 6(1)(b) GDPR (payment processing, performance of the user agreement and processing payouts)
• Article 6(1)(c) GDPR (legal obligations, such as anti-money-laundering, tax and commercial-law obligations, where applicable)
• Article 6(1)(f) GDPR (legitimate interests in secure payment processing, fraud prevention and preventing abuse)

9.6 Processing on our behalf

Where Stripe processes personal data on our behalf, an appropriate data processing agreement under Article 28 GDPR is in place, or the contractual terms provided for this purpose are incorporated.

10. Community, chat and moderation

Messages, reviews and community contributions are stored to provide the communication service. Automated moderation uses blocked-word lists and algorithmic filters to identify unlawful content. Manual reviews are conducted where there is a specific reason. Processing to provide the communication service is based on Article 6(1)(b) GDPR. Security and moderation measures are based, where necessary and after balancing the interests concerned, on Article 6(1)(f) GDPR. Where a specific legal obligation requires processing, Article 6(1)(c) GDPR applies.

11. Reports and moderation procedures

Personal data from reports of unlawful content and complaints is processed to assess, handle and document the respective matter. Reasons for moderation decisions and complaint options are governed by the applicable DSA provisions. Where Article 20 DSA applies, affected persons may submit an internal complaint free of charge for at least six months following the decision. Notices from recognised trusted flaggers are handled in accordance with the applicable legal requirements.

12. Cookies and tracking technologies

We use technically necessary cookies for login, shopping cart, rank and coin management. We only set optional cookies (e.g. for statistics or marketing) with your consent. Settings can be adjusted via the Consent Management tool. For details on the technologies used, storage periods and revocation options, please refer to the detailed cookie overview on the platform.

13. Communications and newsletters

We process contact enquiries, support cases and complaints to handle the relevant matter. We send newsletters and other marketing emails with your consent or where the law applicable to the particular case permits this without separate consent. You may withdraw consent at any time with effect for the future and object to direct marketing at any time, for example using the unsubscribe link.

14. Disclosure of data

We disclose personal data only where this is necessary to perform a contract, required by law or covered by consent. Categories of recipients include:

• Hosting and IT service providers (e.g. IONOS)
• Payment service providers (especially Stripe) and participating banks/financial institutions
• Logistics and shipping service providers (in the context of sales, if sellers use them)
• Legal advisors, tax advisors, authorities
• Trusted flaggers and out-of-court dispute settlement bodies under the DSA

15. Transfers of data to third countries

Service providers such as Stripe may process personal data in countries outside the European Economic Area. Transfers to these countries are also subject to the requirements of Chapter V GDPR. Depending on the recipient and destination country, an applicable adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses and any necessary supplementary measures, may apply in particular. Derogations under Article 49 GDPR apply only under their respective statutory conditions.

Information about transfers by Stripe and the safeguards used is available in Stripe's Privacy Policy. You may request information about the safeguards used for your data and a copy, where provided for by law, at info@secretundies.com.

16. Retention period

Personal data is stored for as long as necessary to fulfil the relevant purposes or for as long as statutory retention periods apply. Transaction data and data relevant for tax purposes are generally retained for up to 10 years. Accounts that have been permanently suspended or closed are anonymised as soon as there are no statutory obligations preventing this.

17. Security

We use technical and organizational measures to protect your data against loss, alteration and unauthorized access. These include encryption, access restrictions, security and update concepts, and regular training.

18. Rights of data subjects

Subject to the respective statutory conditions, you have the following rights under Articles 15 to 22 GDPR:

• Access to the personal data we process about you
• Rectification of inaccurate data or completion of incomplete data
• Erasure (the "right to be forgotten")
• Restriction of processing
• Data portability
• Objection to processing based on Article 6(1)(e) or (f) GDPR
• Withdrawal of consent with effect for the future

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You may object at any time to the processing of your data for direct marketing. We handle requests without undue delay and normally within one month of receipt. For complex or numerous requests, the deadline may be extended by up to two further months under the statutory conditions; we will inform you of this and the reasons within the first month. No user account is required to make a request. Write to info@secretundies.com.

19. Right to lodge a complaint

You may lodge a complaint in particular with a data protection supervisory authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement. In Cyprus, this is the Office of the Commissioner for Personal Data Protection. Further complaint rights under applicable national law remain unaffected.

20. Minors

The platform is aimed exclusively at persons of legal age. If we become aware of unauthorised use by minors, we will block the account and delete personal data, unless there is a legal reason for retention.

21. Automated assessments and your rights

Decisions about ranking status may include algorithmic assessments. Where a solely automated decision produces legal effects or similarly significantly affects you, the requirements and safeguards of Article 22 GDPR apply. These may include in particular the right to human intervention, to express your point of view and to contest the decision. You may send related requests to info@secretundies.com.

22. Changes to this Privacy Policy

We may amend this Privacy Policy to reflect changes in the law, technical developments or new services. We will notify registered users of material changes at least 14 days before they take effect, either through a notice on the platform or by email.

23. Contact for data protection and DSA enquiries

The contact person is Sebastian Rosenboom. Please send data protection enquiries, DSA enquiries from authorities, complaints and security reports to info@secretundies.com. Indicate the relevant matter in the subject line. The postal address, telephone number and further contact information are provided in the legal notice.

24. Version history

08.11.2025 - Full revision, integration of DSA procedures, Coins system, ranking mechanism and updated contact channels.
17.02.2026 - Addition and clarification of payment processing and payouts via Stripe (buyer payments, seller payouts, roles/transfers).

07.10.2026: Personal operator and data protection contact identified; legal bases, moderation procedures, third-country transfers and data subject rights clarified.