This notice explains what personal data DataStoa collects when you use datastoa.com, why, and the choices you have. It is written for buyers, providers and visitors.
Who is responsible
DataStoa is the controller of the personal data described here. Contact us about privacy at [email protected] with "Privacy" in the subject line.
DataStoa does not hold the datasets that providers list. If your question is about data a provider sells, contact that provider directly; if you cannot reach them, write to us and we will forward your request.
What we collect
- Account details: name, email address, password (stored as a one-way hash), job title, company, country and phone number if you add it.
- Organisation details: your company name, website, size, industry, billing contact and VAT number.
- Provider applications: company registration details, contact people and the checks we run to verify a business.
- What you send through DataStoa: inquiries, data requests, proposals, messages, attachments, reviews and deal records.
- Usage data: pages and listings you view, searches, saved items and clicks, recorded on our servers and linked to your account when you are signed in.
- Technical data: IP address, browser type and timestamps in server logs, used for security and troubleshooting.
Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Run your account, deliver inquiries, requests, proposals and messages | Performance of our contract with you |
| Verify providers, prevent fraud, spam and abuse, keep the service secure | Our legitimate interest in a safe marketplace |
| Attribute deals, calculate and invoice commission, keep accounting records | Contract with providers and our legal obligations |
| Show providers aggregated analytics about their listings | Our legitimate interest; individual buyers are not identified unless they contacted the provider |
| Send service emails (new lead, reply, request status) | Performance of our contract with you |
| Send the newsletter and product news | Your consent, which you can withdraw at any time |
| Improve search and the product using aggregated statistics | Our legitimate interest |
Who we share it with
- Providers you contact. When a provider accepts your inquiry, or when you shortlist or message a provider about your request, they see your name, company and contact details. Before that they see only the content of your inquiry or request, your industry, company size and country.
- Buyers you deal with. Providers' public profiles are visible to everyone. Provider staff names appear in messages they send.
- Service providers that host the site, deliver email and process payments for provider subscriptions, under contracts that limit them to our instructions.
- Authorities when the law requires it, or to protect people from harm.
We do not sell personal data and we do not share it with advertisers.
International transfers
Your data is processed in the countries where our service providers operate. Where data leaves the European Economic Area or the United Kingdom, we rely on adequacy decisions or standard contractual clauses.
How long we keep it
| Data | Retention |
|---|---|
| Accounts never verified | Deleted after 90 days |
| Active accounts | While the account exists |
| Closed accounts | Deleted or anonymised within 30 days, except the records below |
| Inquiries, messages, proposals, deals and attribution records | 6 years after the opportunity closes, for commission audits and tax |
| Invoices and billing records | As long as tax law requires, typically 6 to 10 years |
| Moderation cases | 6 years |
| Server logs | 13 months |
| Analytics events | 25 months, pseudonymised |
Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent. Most details can be changed in your account settings; for anything else write to [email protected]. We answer within one month. You can also complain to your data protection authority.
Security
We use encrypted connections, hashed passwords, access controls for staff and audit logs for sensitive actions. Sample files uploaded by providers are stored privately and personal data in previews is masked.
Cookies
We use essential cookies only. See the cookie notice.
Children
DataStoa is a business service and is not meant for anyone under 18.
Changes
We will update this notice when our practices change and tell signed-in users about material changes.