Privacy & Data Protection

1. Controller

Interim controller during the closed beta: Biroul Administratorului autorizat Muntean Oleg (authorized-administrator office, Republic of Moldova). Contact: hello@eulots.eu; data-protection matters: privacy@eulots.eu. Because this interim operator is established outside the EU, before any processing of live personal data an EU operating company will be established (or, if the interim operator continues, an EU representative under Art. 27 GDPR appointed and appropriate safeguards such as SCCs put in place). The operating entity, its registered details and, where required, its DPO will be published here before any public launch with live data.

2. Personal data of platform users

We process account and usage data (email, locale, saved searches, subscription and payment metadata) to provide the service, on the basis of contract performance (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)). Payment is handled by Stripe as processor. Users have rights of access, rectification, erasure, restriction, portability and objection.

3. Source notices and debtor data

Listings are compiled from public official notices. For business assets the data subject is usually a legal entity (whose name and registration data are not personal data under GDPR). Where a natural person is the debtor, special rules apply (Section 4).

4. Data minimization rules (enforced in the pipeline)

National identifiers (CNP, PESEL, NIF/DNI, codice fiscale, AFM, OIB, etc.) are never stored or displayed.

For natural-person debtors, the person's name is not displayed; the listing shows only the asset and the link to the official source.

For legal entities, the company name and registration data may be displayed.

Outcome snapshots store derived fields only (price, deadline, status), are PII-minimized, retained for a limited period, and are internal.

Different handling for public persons, legal entities and private individuals.

5. Legitimate interest assessment (LIA)

Purpose: informing the market of assets lawfully offered for public sale, improving market transparency and liquidity (aligned with the goals of the underlying procedures). Necessity: only minimized listing metadata is processed; identity of private debtors is removed. Balancing: data is already public via official notices; we further minimize and provide opt-out and rectification, so the impact on data subjects is low and outweighed by the legitimate interest. Reviewed periodically.

6. Your rights & requests

Any person may request access, rectification, erasure (including de-referencing of a listing relating to them), restriction, or objection via the removal form. We respond within statutory deadlines. Removal/correction form: /legal/remove.

7. Retention, processors, transfers

User data: for the life of the account plus statutory periods. Listing metadata: while relevant, then minimized. Processors: hosting (EU region preferred), search, email/Telegram dispatch, payments (Stripe). Where transfers outside the EEA occur, SCCs are used.

8. Supervisory authority

Data subjects may lodge a complaint with their national supervisory authority (e.g., ANSPDCP, AEPD, Garante, UODO, CNIL, depending on country).