Privacy Policy
This Privacy Policy explains how DMarketplace collects, uses, stores, and shares personal data when you use our website, mobile web experience, checkout, merchant tools, and related services (together, the Services). It should be read together with our Terms of Use and Return Policy. Last updated: October 2026.
Who we are and scope
The data controller for personal data processed through the Services is Weissstein e.K. (owner: Abbas Aktas), Marktplatz 15, 86558 Hohenwart, Germany (we, us, our). You can contact us about privacy at support@dmarketplace.ai. Merchants who sell on DMarketplace act as independent controllers for data they need to fulfil your orders (for example shipping details and support messages). Where we process data on behalf of merchants (for example hosting order records), we act as a processor according to agreed terms.
This policy applies to shoppers, visitors, and merchants using DMarketplace interfaces. Third-party websites, wallet apps, blockchain networks, card issuers, and payment rails have their own policies; when you leave our Services or sign transactions in an external wallet, their terms govern those interactions.
Personal data we collect
Identifiers and contact data: name, email address, phone number, delivery and invoice addresses, country or region selection, and language or currency preferences you set in the product.
Account, commerce, and support data: order history, basket contents, product views where logged, messages you send to support, dispute notes, ratings or reviews you submit, and merchant onboarding documents you upload.
Technical and usage data: IP address, device type, browser type and version, approximate location derived from IP, diagnostic logs, timestamps, referring URLs, and security signals (for example failed logins or bot detection scores).
Payment-related metadata: payment method type, transaction identifiers, settlement status, risk flags, and chargeback or fraud investigation records. We do not store full private keys for your wallet; your wallet app controls signing secrets.
Wallet addresses, on-chain data, and public ledgers
When you connect a wallet, we process the public wallet address, chain identifiers, and transaction hashes needed to link your session to checkout, anti-abuse controls, and reconciliation. Blockchains are public: once broadcast, transaction details may be permanently visible and outside our ability to erase.
We may analyse on-chain activity that relates to our contracts or labelled addresses as part of fraud prevention, compliance, and product analytics, including comparing your address to public sanctions or abuse lists where permitted by law.
How and why we use personal data
To provide the Services: display catalogues, calculate taxes or regional eligibility (for example gift card regions), operate carts and checkout, communicate order updates, and enable merchant fulfilment.
To secure the platform and comply with law: detect and prevent fraud, abuse, and policy violations; authenticate sessions; enforce transaction limits; respond to lawful requests from authorities; and maintain audit trails required for regulated activities.
To improve DMarketplace: measure feature usage, diagnose errors, run A/B tests where appropriate, and develop recommendations. The optional usage analytics and session recordings described below run only with your consent.
Legal bases (EEA, UK, and similar jurisdictions)
Depending on the processing activity, we rely on performance of a contract, legitimate interests (such as fraud prevention and network security), legal obligation, or consent where we expressly request it. Optional analytics, session recordings and advertising are subject to the choices described below. You may withdraw consent at any time without affecting prior processing that was lawful.
Cookies, local storage, and similar technologies
Necessary storage operates sessions, remembers locale and currency, keeps your basket, saves your cookie choices and protects the shop against abuse. A separate local record shares an analytics refusal across this shop’s browser tabs and prevents older choices from restarting analytics. It contains a withdrawal marker and, after renewed consent, Google’s consent string, but no recordings of browsing activity. It has no automatic expiry and remains until you clear this site’s data; a fresh consent choice updates it. You can block storage in your browser, but doing so may affect checkout or wallet connections.
Google provides our cookie consent message. Use the Cookie settings link in the page footer to reopen Google’s choices. Optional services stay off until the required current consent is confirmed. Earlier choices in the retired shop panel do not enable analytics or session recordings.
Analytics: Google Analytics 4 and our own usage analytics measure page visits and interactions to improve the shop. They require an explicit analytics-storage grant from Google’s consent message and your consent to our own-use purposes ‘Store and/or access information on a device’ (purpose 1) and ‘Measure content performance’ (purpose 8). You can review these choices in the own-use section of Google’s Manage options screen, opened through Cookie settings. If the required consent is unavailable, not configured or refused, analytics stays off. Advertising consent alone does not enable analytics.
Microsoft Clarity: in addition to the analytics choices above, session recording requires your consent to our own-use purpose ‘Develop and improve services’ (purpose 10) and a fresh choice in Google’s message covering this recording disclosure. You can refuse our purpose 10 to stop Clarity recordings while keeping analytics enabled through the required analytics choices. With the required consent, we and Microsoft use heatmaps and masked session recordings of clicks, scrolling and page interactions on selected public shop pages to improve the shopping experience. Microsoft receives interaction and technical data and may use cookies to connect page visits. Everything you type into forms, customer reviews and the content of cart and checkout pages are masked; public shop content such as navigation, product names, prices, banners and buttons on product, category and information pages is recorded unmasked; account, sign-in, order and payment-result pages, URLs with query strings or fragments (except the product, quantity and amount values of a buy-now checkout link), and unsafe referring URLs are excluded. We do not send account, order, payment or wallet identifiers as custom Clarity tracking identifiers. Clarity stays unloaded without the required consent and stops when it is withdrawn. Advertising consent alone does not enable recording.
Advertising: Google AdSense can display and measure advertisements. Google and its advertising partners may process usage and technical data and use cookies or similar identifiers for the purposes you allow. Advertising is enabled only when Google’s consent platform provides a valid consent signal. Cookie settings opens Google’s consent controls. Without a valid signal, advertising remains off.
You can refuse optional categories or withdraw consent in Cookie settings at any time. Withdrawal stops future collection for the disabled category and removes its first-party analytics cookies and browser identifiers that this shop can access. It does not automatically delete data already collected by us or a provider. Browser settings let you remove additional cookies and site data, including storage belonging to other domains.
Google’s consent platform manages its saved choices and when to ask again. In browser storage on this shop domain, we keep a versioned record of a fresh consent decision covering the Clarity disclosure, linked to the current Google consent choice. This record is valid for no more than 180 days and never grants permission on its own. Expiry does not itself erase browser storage: the shop removes an expired record when it next reads it, and you can clear it through your browser’s site-data settings. An older shop-panel choice or Google advertising choice cannot enable recordings. Provider cookie and data-retention periods depend on the cookie, service and settings; see the retention section and provider links below.
Sharing and categories of recipients
We share data with infrastructure and security vendors (hosting, CDN, logging), payment and crypto settlement partners, customer messaging providers, identity or KYC vendors when you complete verification, and professional advisers (lawyers, auditors) bound by confidentiality.
We share the order data needed to fulfil gift card orders with our gift card supplier, and the order data needed to provide eSIMs with our eSIM provider. If you buy from a merchant, we share order fulfilment data with that merchant and their logistics partners. We do not sell personal data for money. We may share aggregated or de-identified statistics that cannot reasonably identify you.
We may disclose information if required by law, court order, or governmental request, or to protect the rights, property, or safety of DMarketplace, users, or the public. We may also disclose data to enforce our Terms or investigate fraud.
International transfers
We may process and store data in the European Economic Area and other countries where we or our suppliers operate. When we transfer personal data from the EEA, UK, or Switzerland to countries not deemed adequate, we use appropriate safeguards such as Standard Contractual Clauses and supplementary measures where required.
You may request a copy of relevant transfer mechanisms by contacting us using the details below.
Retention
We retain personal data only as long as necessary for the purposes described, including statutory retention periods for tax, accounting, and anti-fraud obligations. Order and payment records are typically kept for several years after the last activity unless a longer period is required by law.
Google Analytics 4 is configured for 2 months of event-data retention and 14 months of user-data retention. Google also applies the user-data retention period to key-event data. Reset on new activity is enabled: each new event from a user renews the 14-month retention period for that user’s identifier, so regularly active users’ identifiers can be retained for longer than 14 months. Google deletes data that has reached its retention limit during a monthly process. These retention settings do not limit standard aggregated reports.
Microsoft Clarity retains ordinary session playback for 30 days. Heatmap and click data, and recordings that are labeled or saved as favorites, are retained for 9 months.
Marketing consents, cookie logs, and support tickets are kept for shorter periods defined by operational need and policy. Blockchain-derived identifiers may persist on-chain regardless of our deletion practices.
Security
We implement technical and organisational measures appropriate to the risk, including encryption in transit, access controls, monitoring, and vendor due diligence. No online service is perfectly secure; you should protect your devices, enable wallet protections, and report suspected compromise promptly.
Your privacy rights
Depending on your location, you may have the right to access, rectify, erase, restrict processing, object to certain processing, data portability, and to lodge a complaint with a supervisory authority. You may also have rights relating to automated decision-making where applicable.
To exercise your rights, email support@dmarketplace.ai or write to Weissstein e.K. at the address in the Contact and questions section below. For general questions you can also use our Telegram community (t.me/+aqh8dTzYmMhiYjg6); do not post personal data or order details there, because community messages are visible to its members. We may need to verify your identity before responding and may decline requests that are manifestly unfounded or excessive.
If you are in the EEA or UK and believe we lack a lawful basis for processing, you may contact your local supervisory authority. We will cooperate in good faith with regulators.
Children
The Services are not directed to children under the age where they can lawfully consent to data processing in their country (often 16 or 13 with parental permission). If you believe we have collected data from a child, contact us and we will take appropriate steps to delete it.
Third-party sites, issuers, and wallet software
Product pages may link to brand or issuer websites. Gift cards and digital goods remain subject to the issuer’s own terms, privacy notices, and redemption rules. Wallet providers (for example browser extensions or hardware vendors) process data under their policies.
We are not responsible for third-party practices, though we select partners with reasonable care for critical payment and infrastructure functions.
Automated decision-making and profiling
We may use automated tools to score fraud risk, enforce velocity limits, or tailor offers. These processes may produce legal or similarly significant effects only where permitted by law and, where required, with human review or consent. You may contact us for meaningful information about logic and consequences.
Changes to this Privacy Policy
We may update this policy to reflect product, legal, or regulatory changes. We will post the new version with an updated date and, where appropriate, provide additional notice (for example by email or banner). Continuing to use the shop does not grant consent to optional analytics, session recordings or advertising.
Contact and questions
For privacy requests or questions about this policy, contact Weissstein e.K. by email at support@dmarketplace.ai or by post at Marktplatz 15, 86558 Hohenwart, Germany. Send privacy requests only by email or post, not in our Telegram community (t.me/+aqh8dTzYmMhiYjg6), because community messages are visible to its members. Please include a description of your request and any order identifiers that help us locate your data.
If we appoint a data protection officer or EU representative, their contact details will be added to this section. Nothing in this policy limits mandatory rights you have under applicable consumer or data protection laws.
