Privacy Policy
Controller: INTERHUB s.r.o. · Last updated: 24 June 2026
1. Controller and contact
The controller of your personal data is INTERHUB s.r.o., Spojovací 192/17, Vysočany, 190 00 Praha 9, Czech Republic, IČO 24335363. Privacy contact: privacy@bilzeo.com. Having assessed GDPR Art. 37(1) and Czech Act No. 110/2019 Coll., we have not appointed a Data Protection Officer — we are not a public authority and our core activities do not involve large-scale special-category processing or large-scale systematic monitoring. A privacy contact handles all data-protection matters at privacy@bilzeo.com, and we review this assessment whenever our processing materially changes.
2. What we collect and why (and our lawful basis)
| Data | Purpose | Lawful basis |
|---|---|---|
| Account data (e-mail, password hash, handle) | Create and run your account | Contract — Art. 6(1)(b) |
| Listing data (event, section, price, face value, delivery) | Operate the marketplace | Contract — 6(1)(b) |
| Order data (price/qty/currency snapshot, reference, status, timestamps) | Process and record your order | Contract — 6(1)(b) |
| Seller payment details (IBAN, account-holder name) | Show them only to the committed Buyer of one order so they can pay the Seller directly | Contract — 6(1)(b) |
| Seller identity & tax data (TIN, address, date of birth/registration no.) | KYC and DAC7 tax reporting (at the real-payment phase) | Legal obligation — 6(1)(c) |
| Commission & invoicing records | Charge our fee; keep accounting records | Legal obligation — 6(1)(c) |
| Guarantee claims & evidence (transfer proof, ticket files) | Operate the Buyer Guarantee; prevent fraud; recover seller debt | Contract 6(1)(b) / Legitimate interests 6(1)(f) |
| Security, fraud-prevention, audit logs | Keep the Platform safe | Legitimate interests — 6(1)(f) |
| Non-essential cookies, analytics, ads measurement, marketing e-mail | Improve and promote the service | Consent — 6(1)(a) |
3. How we protect payment details (and what we never do)
Seller payment details (IBAN, account-holder name) are personal data. We store them in a restricted, access-controlled location, never in publicly readable profiles, never in URLs or logs, and we reveal them only to the one Buyer who has committed to that specific order. The values shown are snapshotted onto that order so a later change cannot rewrite what was paid. Uploaded files (transfer proof, ticket files, claim evidence) are kept in restricted storage with no public links. We never hold your money — payment is made by you directly to the Seller's bank.
4. Who we share data with
Our processors (acting on our instructions under GDPR Art. 28 data-processing agreements):
- Supabase — database, authentication, file storage and transactional e-mail, hosted in the EU (eu-north-1);
- Lovable — hosting and build of the web application.
Independent controllers (used only with your consent, for advertising and measurement — they determine their own processing, so they are not our Art. 28 processors):
- Google — advertising measurement and analytics;
- Meta — advertising measurement (pixel).
We share an order's details between its Buyer and its Seller only to the extent the order requires (e.g. the Seller's payment details with the committed Buyer; the order reference with the Seller). We disclose data to authorities where legally required (including DAC7 tax reporting to the Czech Specialised Tax Office).
5. International transfers
We keep our own processing within the EU/EEA (Supabase runs in the EU). Where data reaches the United States — for example through Google or Meta advertising used with your consent — we rely first on the EU-US Data Privacy Framework adequacy decision and, as a fallback, the EU Standard Contractual Clauses (GDPR Art. 46).
6. Retention
We keep data only as long as needed for the purpose, then delete or anonymise it. Accounting and tax records (incl. DAC7) are kept for the periods required by Czech law (generally up to 10 years for certain tax/accounting documents). Account data is kept while your account is active and for up to 3 years after it is closed, for legal claims and fraud prevention, unless a longer statutory retention applies.
7. Your rights
You have the right to access, rectification, erasure, restriction, portability, and objection, and to withdraw consent at any time (without affecting prior processing). You can exercise these via privacy@bilzeo.com. Erasure may be limited where we must retain data by law (e.g. tax/accounting, DAC7) or to defend legal claims. You also have the right to lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz.
8. Cookies and similar technologies
We use essential cookies needed to run the site (e.g. your login session) — these require no consent but are described in our cookie banner. We use non-essential cookies/technologies (analytics, advertising measurement) only after you consent, and no such script runs before you accept. You can change or withdraw your choices at any time via the cookie settings.
9. Children
The Platform is not directed at children under 18 and we do not knowingly process their data.
10. Security and breaches
We use technical and organisational measures appropriate to the risk (access control, encryption in transit, least-privilege data access). If a breach is likely to affect your rights, we will notify the ÚOOÚ within 72 hours where required and inform you where the law requires.
11. Changes
We will post updates here and, for material changes, notify you. Last updated: 24 June 2026.