Privacy Policy

01Who Is Responsible for Your Data

The controller of your personal data is:

Thrift Kosova L.L.C.
Business Registration Number: 812450542
Registered Address: Shaqir Igrishta 38, Matiçan, Prishtina, Republic of Kosovo
Email: support@thriftkosova.shop
Website: thriftkosova.shop

For privacy-related questions, requests or complaints, you may contact us using the email address above.

If Thrift Kosova appoints a Data Protection Officer, their contact details will be added to this Policy where applicable.

02Personal Data We May Collect

Depending on how you use Thrift Kosova, we may process the following categories of personal data.

2.1. Account Data

This may include your:

• first and last name;
• username;
• email address;
• telephone number;
• protected password or authentication information;
• profile photograph;
• profile information and preferences;
• account status.

2.2. Listing Data

When you list an item, we may process:

• photographs;
• descriptions;
• category;
• brand;
• size;
• condition;
• seller price;
• information about defects;
• other information you choose to include in the listing.

Some listing information will be publicly visible to other users.

2.3. Transaction Data

Where transaction functionality is available, we may process:

• items bought or sold;
• prices;
• fees;
• order status;
• dates and times;
• order identifiers;
• payment status;
• refunds or cancellations;
• dispute information;
• purchase and sales history.

2.4. Payment Data

Electronic payments may be processed by an authorized third-party payment service provider.

Thrift Kosova may receive information such as:

• confirmation of payment;
• payment status;
• amount;
• transaction identifier;
• limited information regarding the payment method;
• information required for refunds or seller payouts.

Thrift Kosova does not intend to store full card numbers, CVVs or similar sensitive card credentials where these are handled directly by the payment provider.

The payment provider will be identified once the relevant service is finalized.

2.5. Wallet and Payout Data

Where Wallet or payout functionality is used, we may process:

• Wallet balances;
• Wallet transactions;
• payout records;
• payout status;
• IBAN or other banking information necessary to complete a transfer;
• information required for financial or legal verification.

The final Wallet structure and payment provider will be confirmed before this functionality is activated.

2.6. Delivery Data

Where delivery functionality is available, we may process:

• recipient name;
• telephone number;
• delivery address;
• city and postal information where applicable;
• delivery status;
• parcel or tracking identifier;
• information required to coordinate delivery.

Delivery information may be shared with the relevant courier only to the extent necessary to complete the delivery.

2.7. Identity Verification Data

Seller verification is optional, unless a specific legal requirement requires otherwise.

Where a user voluntarily applies for verification, we may process:

• full name;
• date of birth;
• identification document;
• document number;
• photograph or selfie where required;
• other information reasonably necessary to verify identity.

Verification data is used only for identity verification, security, fraud prevention and applicable legal compliance.

Identity documents will not be used for marketing purposes.

2.8. Support and Dispute Data

Where you contact us or open a dispute, we may process:

• messages;
• photographs or documents submitted;
• order information;
• details of the issue;
• communications with support;
• dispute history and outcome.

2.9. Technical and Device Data

We may automatically process technical data such as:

• IP address;
• device type;
• operating system;
• application version;
• browser;
• device or session identifiers;
• access dates and times;
• crash logs;
• security logs;
• technical activity within the Platform.

This information may be used for security, Platform operation, debugging, abuse prevention and technical improvement.

2.10. Cookies and Analytics

Our website and application may use technologies that are necessary to operate the Platform.

Where we use non-essential analytics, advertising pixels, marketing cookies or similar SDKs, we will provide the relevant information and request consent where legally required.

Further details may be provided through a separate Cookie Notice.

03How We Obtain Personal Data

We may obtain personal data:

• directly from you;
• when you create or update your profile;
• when you create a listing;
• when you buy or sell;
• when you apply for verification;
• when you contact support;
• automatically through use of the Platform;
• from payment providers;
• from courier providers;
• from authentication providers;
• from another party involved in a transaction or dispute.

04Why We Process Personal Data

We may process personal data to:

• create and manage accounts;
• provide listing functionality;
• enable purchases and sales;
• manage payments and payouts;
• provide Wallet functionality;
• arrange delivery;
• perform voluntary identity verification;
• secure the Platform;
• detect and prevent fraud;
• handle disputes and complaints;
• provide customer support;
• send operational communications;
• maintain and improve the Platform;
• investigate technical issues;
• comply with legal obligations;
• establish, exercise or defend legal claims;
• conduct marketing where we have a lawful basis.

05Legal Bases

Depending on the processing activity, we may rely on:

• Contract — where processing is necessary to provide a service requested by you.
• Legal obligation — where processing is necessary to comply with applicable law.
• Legitimate interests — including security, fraud prevention, abuse prevention, technical improvement and protection of legal claims, where those interests are not overridden by your rights.
• Consent — where consent is required, including for certain marketing or non-essential tracking activities.

Kosovo law expressly recognizes consent, contractual necessity, legal obligations and legitimate interests as lawful bases for processing.

06Marketing

We may send marketing communications only where we have an appropriate legal basis.

Where marketing is based on consent, you can withdraw your consent at any time.

You may use an unsubscribe option, account settings or contact us directly.

Opting out of marketing does not stop necessary operational messages regarding your account or transactions.

07Sharing Personal Data

We do not sell your personal data.

Where necessary, we may share data with:

• payment service providers;
• banks or financial institutions;
• couriers;
• cloud and hosting providers;
• email and notification services;
• authentication providers;
• analytics or crash-reporting providers;
• fraud-prevention and security providers;
• technical or customer-support providers;
• lawyers, accountants and auditors;
• courts, public authorities or competent bodies where legally required.

08Information Visible to Other Users

Depending on Platform functionality, other users may be able to see information such as:

• username;
• profile photograph;
• listings;
• listing photographs;
• descriptions;
• verified status where applicable;
• ratings or other information designated as public.

Full delivery addresses, identification documents, IBANs and payment credentials are not displayed publicly.

09International Transfers

Some technology providers may process data outside the Republic of Kosovo.

Where personal data is transferred outside Kosovo, Thrift Kosova will apply the safeguards required by applicable data-protection law and will provide relevant information regarding those transfers where required.

Kosovo law specifically regulates transfers to third countries and requires transparency regarding such transfers.

10Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or as required by law.

Retention criteria may include:

• the duration of the user account;
• the nature of the data;
• completion of transactions;
• disputes and chargebacks;
• tax and accounting requirements;
• fraud prevention;
• limitation periods for legal claims;
• regulatory requirements.

Data that is no longer required will be deleted, anonymised or otherwise handled in accordance with applicable law.

11Security

We use appropriate technical and organisational measures designed to protect personal data from unauthorized access, unlawful processing, loss, alteration, destruction or disclosure.

No digital system can guarantee absolute security, but we apply safeguards proportionate to the nature and risk of the processing.

12Personal Data Breaches

If a personal-data breach occurs, Thrift Kosova will take the measures required by applicable law.

Where the statutory conditions are met, the Information and Privacy Agency must be notified without undue delay and, where applicable, within 72 hours of the controller becoming aware of the breach.

Affected users will also be informed where required by law.

13Your Rights

Subject to applicable conditions, you may have the right to:

• access your personal data;
• obtain a copy;
• correct inaccurate data;
• complete incomplete data;
• request deletion;
• request restriction of processing;
• object to processing;
• object to direct marketing;
• obtain certain data in a structured and portable format;
• withdraw consent;
• lodge a complaint with the Information and Privacy Agency.

These rights are set out in Kosovo's data-protection legislation.

14Exercising Your Rights

Privacy requests may be submitted to: support@thriftkosova.shop

We may request reasonable information to verify your identity before responding.

Under Kosovo law, requests must generally be answered without undue delay and within one month, subject to a possible extension of up to two additional months for complex or numerous requests.

15Account Deletion

If you request deletion or closure of your account, data that is no longer required will be deleted or anonymised.

Some information may continue to be retained where necessary for:

• legal obligations;
• completed transactions;
• accounting or taxation;
• disputes;
• fraud prevention;
• chargebacks;
• legal claims;
• enforcement of the Terms and Conditions.

16Automated Decision-Making

Thrift Kosova may use automated systems for functions such as recommendations, content ranking, security and fraud detection.

We will not use solely automated decision-making that produces legal or similarly significant effects unless permitted by law and subject to the required safeguards.

17Users Under 18

Thrift Kosova is intended for users aged 18 and over.

We do not intend to provide accounts or transaction services to persons under 18.

Where we become aware that an underage user has created an account using inaccurate information, we may restrict or close that account and process the related data as required by law.

18Third-Party Services

The Platform may contain links to or integrations with independent third-party services.

This Privacy Policy does not govern the independent processing activities of such third parties.

Users should review the applicable third party's privacy policy.

19Supervisory Authority

You may lodge a complaint with:

Information and Privacy Agency
Str. “Zejnel Salihu” No. 22
10000 Prishtina
Republic of Kosovo
Email: info.aip@rks-gov.net
Telephone: 0800 600 10

The right to complain to the Agency is established under Law No. 06/L-082.

20Changes to This Policy

We may update this Privacy Policy to reflect changes to:

• the Platform;
• functionality;
• service providers;
• processing activities;
• applicable law.

Where a change is material, users will be notified where required.

The date of the latest update will appear at the top of this Policy.

21Contact

For privacy-related questions or requests:

Thrift Kosova L.L.C.
Shaqir Igrishta 38, Matiçan, Prishtina
Email: support@thriftkosova.shop
Business Registration Number: 812450542
Website: thriftkosova.shop