Privacy Policy

1. Who we are

The data controller for personal data processing pursuant to the EU Regulation 2016/679 ("GDPR") and the UK GDPR is yattapick. For any request you can write to us at [email protected].

2. Data collected

We only collect the data necessary to provide you with the service:

• Account: username, email, password (stored only as a bcrypt hash).
• Profile: optional avatar, city, approximate zone (within about 300 m from the actual location, randomized for privacy).
• Listings: title, description, photos, category, individual listing location (also randomised).
• Messages: content exchanged between users, stored on our systems.
• Reviews and reports: ratings, comments and reports you submit.
• Technical logs: IP address, user agent, date/time and pages visited, retained for security and anti-fraud purposes.

3. Purpose of processing

We process your data for the following purposes and legal bases (Art. 6 GDPR):

• Service provision (account creation, listing publication, messaging) - basis: performance of a contract (Art. 6.1.b).
• Security, anti-fraud, moderation, access logs - basis: legitimate interest (Art. 6.1.f).
• Legal obligations (e.g. responses to authorities) - basis: legal obligation (Art. 6.1.c).
• Aggregate usage statistics via analytics cookies - basis: consent (Art. 6.1.a), revocable at any time.

4. Data retention

• Active accounts: until deletion is requested by the user.
• Deleted accounts: removed within 30 days; we only retain anonymised registration logs for legal obligations (maximum 2 years).
• Delivered listings: visible for 10 days, then archived and permanently deleted within 90 days.
• Messages: retained for the duration of the conversation; deleted on user request or upon account closure.
• Technical logs: maximum 12 months.

5. Data recipients and transfers

We share personal data exclusively with providers that help us operate the service, acting as data processors:

• Hosting and infrastructure: servers located in the EEA.
• Google Analytics (Google Ireland Ltd) - only if you accepted analytics cookies. Anonymised IP. Privacy: policies.google.com/privacy.
• Meta Platforms Ireland Ltd - only if you accepted cookies. Facebook Pixel to measure ads and build similar audiences. Privacy: facebook.com/privacy/policy.
• Nominatim/Photon (OpenStreetMap): External APIs used only to suggest neighborhood names while you type - we don't send account data, only the partial string you typed and your city's approximate location.

Any transfers outside the EEA (e.g. analytics backups to the USA by Google) take place under the Standard Contractual Clauses (SCC) approved by the European Commission pursuant to Art. 46 GDPR.

6. Your rights

At any time you can exercise the following rights (Art. 15-22 GDPR and UK GDPR):

• access your data and obtain a copy;
• rectify inaccurate data;
• delete your account and related data ("right to be forgotten");
• restrict or object to processing;
• data portability in a structured format;
• withdraw consent to analytics cookies (see the cookie section below);
• lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or, for the United Kingdom, with the Information Commissioner's Office (ico.org.uk).

You can delete your account directly from your Profile Settings. For other requests, write to us at [email protected]: we will reply within 30 days as required by the GDPR.

7. Minors

yattapick is not intended for users under 16 (14 in Italy pursuant to Legislative Decree 101/2018). If we become aware of a minor's account, we will promptly remove it.

8. Security

Passwords are stored encrypted with bcrypt; the site runs entirely on HTTPS; sessions use HttpOnly and SameSite=Lax cookies. We implement rate limiting and monitoring of anomalous access.

9. Changes to this policy

We reserve the right to update this policy. Significant changes will be communicated with a notice on the site; the date of the latest update is shown at the top of the page.