GDPR Policy — Toveria

Version 2.0 — June 2026
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
European BtoC, CtoC, CtoB and BtoB Marketplace — Sales from Europe to the world

1. Identity and contact details of the data controller

2. Data Protection Officer (DPO)

Toveria has appointed a Data Protection Officer (DPO) in accordance with Article 37 of the GDPR.

DPO contact:
📧 dpo@toveria.com
📮 Toveria — DPO (Kamel DOURA), 12 Rue de la Part-Dieu, 69003 Lyon, France

The DPO is your primary contact for any questions relating to the protection of your personal data. The DPO is also the contact point for the CNIL.

3. Record of processing activities (art. 30 GDPR)

3.1 User account management

3.2 Telephone identity verification (OTP)

3.3 Multi-factor authentication (2FA/TOTP)

3.4 Listing publication and management

3.5 Transaction and payment processing

3.6 Seller KYC verification (Stripe Connect)

3.7 Messaging and conversations

3.8 Transactional email notifications

3.9 Push notifications

3.10 DAC7 compliance — Tax declarations

3.11 VAT verification (VIES)

3.12 Reviews and ratings management

3.13 Referral programme

3.14 Dispute system

3.15 International sanctions verification

3.16 Security logs and fraud prevention

3.17 Cookies and trackers

3.18 Marketing communications (optional)

4. Sub-processors (art. 28 GDPR)

All sub-processors have signed a data processing agreement compliant with art. 28.

5. Transfers outside the European Union (art. 44-49 GDPR)

Transfers to the United States are governed by:

1. Standard Contractual Clauses (SCCs) — Commission Implementing Decision (EU) 2021/914
2. EU-US Data Privacy Framework — Adequacy decision of 10 July 2023

For each transfer, Toveria ensures that the sub-processor provides sufficient data protection guarantees.

6. Rights of data subjects

6.1 Rights table

6.2 How to exercise your rights

By email: dpo@toveria.com
Suggested subject: [GDPR Right] Your name — Type of request

By post:
Toveria — GDPR Service
12 Rue de la Part-Dieu, 69003 Lyon, France

Identity document: a copy may be requested to verify your identity (scanned, without document number if preferred).

Response deadline: 30 calendar days. Extendable by 60 additional days for complex requests, with prior notice.

6.3 Right to lodge a complaint with the CNIL

If you believe your rights are not being respected:

CNIL — National Commission for Computing and Freedoms
🌐 cnil.fr/en/complaints
📮 3 place de Fontenoy — TSA 80715 — 75334 Paris Cedex 07
📞 +33 (0)1 53 73 22 22

7. Retention periods

Intermediate archiving (CNIL): after their active phase, conversations move to restricted access archive (reserved for legal obligations / disputes) before final deletion. Legal hold: any data linked to an open dispute, legal obligation or authority request is retained until the end of that obligation, by derogation from the periods above.

8. Data security (art. 32 GDPR)

8.1 Technical measures

8.2 Organisational measures

8.3 Data breach notification procedure

In accordance with art. 33 GDPR, Toveria commits to notify the CNIL within 72 hours of discovering a data breach likely to result in a risk to the rights and freedoms of individuals.

If the breach is likely to result in a high risk, data subjects are also informed without undue delay (art. 34 GDPR).

Internal procedure:

1. Detection → immediate DPO alert
2. Risk assessment (< 4h)
3. CNIL notification if necessary (< 72h)
4. Data subject notification if high risk (< 72h)
5. Incident documentation (breach register)

9. Impact Assessment (DPIA — art. 35 GDPR)

A Data Protection Impact Assessment is required for processing presenting a high risk.

10. Minors' data

The Toveria platform is strictly reserved for persons aged 18 and over.

Date of birth is collected at registration to verify majority. Any registration of a minor results in immediate account deletion and associated data deletion.

Report: dpo@toveria.com — Subject: [Minor]

11. Cookies and trackers

Strictly necessary cookies (no consent required)

Analytics cookies (with prior consent)

To be enabled only after implementation of a CNIL-compliant cookie banner (CNIL recommendation of 1 October 2020).

12. Modifications to this policy

Substantial modifications are notified by email with 30 days notice.

The date of last update appears in the header. Continued use of the platform after entry into force constitutes acceptance.

13. Contacts

European BtoC, CtoC, CtoB and BtoB Marketplace — Sales from Europe to the world
Sales from Europe to the world
CNIL registration number: [To be completed after declaration]
Last updated: June 2026

English version — in case of discrepancy with a translation, the French version prevails.