This policy complements the BDPokéCards privacy policy for the use of the marketplace.
1. Data Controller
Vergasta Digital, Bruno Vergasta Paiva, Rue du Temple 5, 2610 St-Imier, Switzerland. Contact: commandes@bd-pokecards.ch.
2. Data Processed
- Account: first name, last name, email, phone number, date of birth (age verification), pseudonym and its changes, delivery addresses.
- Connection with Google or Apple (if chosen): first name, last name, email, and account ID transmitted by Google or Apple, only for login purposes. With Apple, the email may be an anonymous relay address provided by Apple. Your Google or Apple password is never transmitted to us.
- Sellers: presentation, private or professional status, company name and UID, locality for in-person handover, accepted payment methods.
- Seller Identity Verification: the ID and selfie are transmitted directly to Didit, which compares the selfie face to the document photo (biometric data) and verifies the document. BDPokéCards only receives and retains the result (verified, refused, or under review), the verification ID, and its date. By initiating the verification, the seller consents to this processing; without it, they cannot sell.
- Online Payment: Stripe customer ID, type and last 4 digits of the registered card, technical fingerprint of the card provided by Stripe (to detect the same card used on multiple accounts), Stripe account ID and status of the seller. The bank account and information required by regulations are collected and verified directly by Stripe. No complete card number is stored by BDPokéCards.
- Direct Payment: account holder, IBAN, and TWINT number provided by the seller, stored in encrypted form.
- Content: listings and photos, questions and answers, messages, reports, disputes and their photos, reviews.
- Auctions: bid amounts, including the secret maximum, and IP address of the bid.
- Logs: acceptance of terms (version, date, IP address, browser), log of important actions (IP address, browser), date of last activity.
3. What is Public
Visible to all: pseudonym, presentation, professional status and company name, listings, locality for in-person handover (postal code and locality, never the exact address), questions and answers, reviews, number of sales, rating, badges, and an approximate indication of last activity. In the auction history, pseudonyms are partially masked.
Never public: name, address, email, phone number, date of birth, identity verification result, payment details, and secret maximum of auctions.
4. Data Transmitted Between Members
After a purchase, the seller receives the buyer's name and delivery address, solely to ship the item. For a direct payment, the buyer receives the seller's account holder, IBAN, and/or TWINT number, solely to make the payment. In case of a return, the seller communicates their return address to the buyer in the dispute thread. Any other use of this data is prohibited.
5. Purposes
- execute sales, payments, refunds, and disbursements;
- verify seller identity, ensure security, and prevent fraud (commitment limits, linked account detection, moderation);
- handle issues, disputes, and chargebacks, including the transmission of evidence (tracking, address, exchanges) to Stripe and the concerned bank;
- invoice sales fees for sales paid directly or in cash;
- send notifications related to member activity, according to their preferences;
- comply with legal and accounting obligations.
6. Automated Decisions
Some measures are applied automatically: calculation of the commitment limit for auctions, sanctions after an unpaid auction (warning, 30-day suspension, exclusion on the third), and blocks related to an overdue fee invoice. The identity verification result is rendered by Didit; a refusal may be followed by a new attempt. Other risk signals are reviewed by a person. Any member can request that an automated decision concerning them be reviewed by a person.
7. Providers
- Stripe (online payments and seller accounts): some data may be processed in the United States, with appropriate safeguards.
- Didit (seller identity verification): documents, selfie, and biometric data are processed and retained by Didit according to its own privacy policy, possibly outside Switzerland, with appropriate safeguards.
- Google and Apple (connection, if chosen): they confirm your identity and transmit the data indicated above, according to their own privacy policy, possibly outside Switzerland.
- Infomaniak (hosting and emails, Switzerland).
- OpenAI (optional card recognition from a photo, when creating a listing): only the card photo is transmitted, processed in the United States. Avoid showing personal information.
- Cardmarket (reference price): no personal data is transmitted.
- Carriers chosen by the seller receive the delivery address.
No data is sold or used for advertising purposes.
8. Retention Period
Data related to sales (orders, payments, sales fees, disputes, evidence, and acceptance of terms) is retained for 10 years, in accordance with Swiss accounting obligations. Direct payment details are deleted when the seller removes them. If an account is deleted, the public profile and listings are removed; sales data is retained for the legal duration and then deleted or anonymised.
9. Your Rights
In accordance with the Federal Act on Data Protection (revFADP), you can request access to your data, its correction or deletion (within legal limits), and object to processing. Write to commandes@bd-pokecards.ch. For identity documents submitted to Didit, you can also contact Didit directly. You can also contact the Federal Data Protection and Information Commissioner (FDPIC).
10. Cookies
The marketplace does not add any tracking cookies: the marketplace cart is stored in the session cookie already used by the site. During a payment or identity verification, Stripe and Didit may use their own strictly necessary cookies on their pages. The "Remember me" box adds a strictly necessary login cookie that keeps you logged in on this device. Details are in the BDPokéCards privacy policy.
Version 2.0 — effective upon publication.