Back

Privacy Policy

Version 2.0·Effective August 15, 2026

BM-PRIVACY-v2.0

1. INTRODUCTION

1.1 About This Policy

This Privacy Policy explains how Berry Marketplace ("we," "us," "our"), operated by Nuvagra S.R.L., collects, uses, stores, and protects your personal data when you use our platform.

This Privacy Policy is a standalone legal document that you must accept separately during registration.

Your acceptance of this policy is recorded with your typed name, timestamp, and IP address.

1.2 Data Controller

Nuvagra S.R.L. is the data controller for personal data processed through Berry Marketplace.

Contact Details:

We process personal data in accordance with:

  • EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679)
  • Romanian Law No. 190/2018 on GDPR implementation
  • ePrivacy Directive (2002/58/EC)
  • Romanian Law 506/2004 on electronic communications privacy

2. DATA WE COLLECT

2.1 Account Registration Data

Data Type Examples Purpose
Personal Information Name, email, phone number Account creation, communication
Company Information Legal name, registration number, VAT number Verification, invoicing
Address Information Registered address, delivery addresses Verification, logistics
Role Information Job title, department Authorization levels

2.2 Verification Data

Data Type Examples Purpose
Identity Documents Passport, ID card (uploaded directly to Berry Marketplace) Signatory identity check during onboarding review
Representative & Ownership Data Names of legal representatives and declared owners Onboarding review and sanctions screening
Company Documents Registration certificates, VAT certificates Company verification
Certifications Food safety certificates, organic certifications Product compliance

2.3 Transaction Data

Data Type Examples Purpose
Listings LOTs, RFQs, Tender Requests Platform functionality
Offers Prices, quantities, terms Trade execution
Contracts Signed contracts, amendments Legal record-keeping
Communications Messages between parties Transaction support

2.4 Technical Data

Data Type Examples Purpose
Device Information IP address, browser type, device type Security, analytics
Usage Data Pages visited, features used, timestamps Service improvement
Log Data Login times, actions performed Security, audit trails
Signature Metadata Signing timestamps, IP addresses, typed names Legal validity

2.5 Financial Data

Data Type Examples Purpose
Billing Information Company billing details Commission invoicing
Payment Methods Card details (processed by Stripe) Commission payment
Transaction History Invoices, payments Financial records
Data Type Examples Purpose
T&C Acceptance Typed name, timestamp, IP, checkboxes Legal compliance
Privacy Policy Acceptance Typed name, timestamp, IP GDPR compliance
Marketing Consent Opt-in/opt-out status, timestamp Marketing compliance
Cookie Preferences Category selections, timestamp ePrivacy compliance

3. HOW WE USE YOUR DATA

Purpose Legal Basis (GDPR Art. 6) Details
Account operation Contract performance (Art. 6(1)(b)) Required to provide services
Transaction processing Contract performance (Art. 6(1)(b)) Required to facilitate trades
Commission billing Contract performance (Art. 6(1)(b)) Required to collect fees
Onboarding review Contract performance (Art. 6(1)(b)) Reviewing company documents and identifiers before granting access
Sanctions screening Legal obligation (Art. 6(1)(c)) EU restrictive measures (Council Regulations)
Security monitoring Legitimate interest (Art. 6(1)(f)) Platform and user protection
Service improvement Legitimate interest (Art. 6(1)(f)) Better user experience
Risk profiling Legitimate interest (Art. 6(1)(f)) Platform integrity
Marketing communications Consent (Art. 6(1)(a)) Only with explicit opt-in
Legal compliance Legal obligation (Art. 6(1)(c)) Regulatory requirements

3.2 Specific Uses

Platform Operation:

  • Creating and managing your account
  • Processing listings, offers, and contracts
  • Facilitating communication between trading parties
  • Providing quality control workflows
  • Generating and storing contracts

Verification & Security:

  • Verifying company and user identity
  • Preventing fraud and unauthorized access
  • Maintaining audit trails
  • Ensuring platform integrity

Risk Profiling & Platform Integrity:

  • Assessing counterparty risk
  • Detecting fraud and abuse patterns
  • Calculating reputation scores
  • Identifying suspicious activities
  • Protecting the platform ecosystem

Commercial Purposes:

  • Calculating and collecting Commission
  • Generating invoices and receipts
  • Managing subscription and premium features

Communication:

  • Sending transaction notifications (required)
  • Providing customer support (required)
  • Sending service updates (required)
  • Sending marketing communications (consent-based, optional)

Analytics & Improvement:

  • Analyzing platform usage patterns
  • Improving user experience
  • Developing new features
  • Market research (anonymized)

Verification and security. We review the company documents and identifiers you submit, check them against official or public sources where such sources exist for your jurisdiction and entity type, and screen company names, aliases, legal representatives and declared owners against the consolidated list of persons, groups and entities subject to European Union financial sanctions. Screening is performed in-house against a list published by the European Commission. No personal data is transmitted to any third party for this purpose.

3.3 Natural Persons Acting Professionally

Some Business Users are natural persons acting in the course of an agricultural or professional activity (for example, individual agricultural producers). For those Users, information that would otherwise be company data — including legal name, address, tax identifier, farm registration number, and farm location — is personal data.

We process it on the basis of contract performance (Art. 6(1)(b)) and our legitimate interest in platform integrity and counterparty verification (Art. 6(1)(f)).

Disclosure to counterparties. This information is disclosed to a prospective or actual counterparty where necessary to enter into and perform a Trading Contract to which the data subject is a party. The counterparty processes that data as an independent controller for its own purposes, including compliance with its tax and accounting obligations.

Retention and erasure. Trading Contracts, invoices, and the evidence of checks performed are retained for the applicable statutory limitation and tax-retention periods. During those periods this data cannot be erased on request, because retention is necessary for compliance with a legal obligation (Art. 17(3)(b)) and for the establishment, exercise, or defence of legal claims (Art. 17(3)(e)). Rights of access, rectification, and portability continue to apply. Data not subject to those obligations — such as marketing preferences — is erased on request.

4. MARKETING COMMUNICATIONS

Marketing communications require your separate, explicit consent. Marketing consent is:

  • Optional – Not required for registration or platform use
  • Specific – Separate from T&C and Privacy Policy acceptance
  • Revocable – Can be withdrawn at any time
  • Recorded – Your consent decision is logged with timestamp

4.2 What Marketing Includes

With your consent, we may send:

  • Product updates and new features
  • Industry news and market insights
  • Promotional offers and discounts
  • Partner offers (only from Berry Marketplace, not third parties)
  • Invitations to events and webinars

4.3 What Marketing Does NOT Include

The following are NOT marketing and do not require consent:

  • Transaction confirmations and notifications
  • Security alerts and account notifications
  • Contract and delivery reminders
  • QC and dispute communications
  • Invoice and payment reminders
  • Required legal or regulatory notices
  • Customer support responses

4.4 Managing Marketing Preferences

You can manage marketing preferences:

  • During registration (opt-in checkbox)
  • In Account Settings at any time
  • Via unsubscribe links in any marketing email
  • By contacting support@berry-marketplace.com

You may withdraw marketing consent at any time. Withdrawal:

  • Takes effect immediately
  • Does not affect your account or platform access
  • Does not affect lawfulness of processing before withdrawal
  • Is logged for compliance records

5. DATA SHARING

5.1 Trading Counterparties

When you enter into transactions, we share relevant information with your trading counterparties:

Data Shared Purpose
Company name and details Contract formation
Contact information Transaction coordination
Delivery addresses Logistics
Quality certifications Compliance verification
Reputation scores Trust and transparency

5.2 Service Providers

Provider Category Provider Purpose Data Shared
Payments Stripe Commission processing Billing information, payment methods
Database Supabase Data hosting All platform data (encrypted)
Email Resend Email delivery Email addresses, notification content
Hosting Vercel Application hosting Technical data, logs

We may disclose data when required by:

  • Court orders or legal process
  • Regulatory authorities (e.g., ANSPDCP, financial regulators)
  • Law enforcement agencies
  • Tax authorities (for Commission invoicing)

5.4 Sanctions Screening and Lawful Requests

Berry Marketplace is not a financial institution and is not an entity obliged under anti-money-laundering legislation. We do not file suspicious-activity reports and we have no reporting relationship with any anti-money-laundering authority.

Sanctions screening is performed in-house against the consolidated list of persons, groups and entities subject to European Union financial sanctions, as published by the European Commission. We do not use a third-party sanctions screening service, and no personal data is transmitted to any third party for this purpose.

We may disclose personal data to a competent authority, court, or law-enforcement body where we are required to do so by law or where disclosure is necessary for the establishment, exercise, or defence of legal claims.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of assets:

  • Personal data may be transferred to the successor entity
  • We will notify you before your data is transferred
  • The successor must honor existing privacy commitments
  • You may object to the transfer

5.6 Market Development Partners

Some companies are introduced to the Platform by independent Market Development Partners who help us grow the marketplace. Where your company was introduced by such a partner, we share a limited set of data with that partner to administer our partner programme: confirmation that your company is active on the Platform; your company name, country, and onboarding status; and aggregated commission figures used to calculate the partner's remuneration. We do not disclose your trading counterparties, the terms or value of individual trades, or financial figures tied to your company's identity — financial information provided to partners is always aggregated. This sharing relies on the legitimate interests of Berry Marketplace and the partner in operating a referral and market-development programme, and partners are bound by confidentiality and data-protection obligations.

6. INTERNATIONAL TRANSFERS

6.1 Transfer Locations

Your data may be processed in:

  • Romania (primary data center)
  • European Union (Supabase EU region)
  • United States (certain service providers with appropriate safeguards)

6.2 Transfer Safeguards

For transfers outside the EU/EEA, we ensure protection through:

  • EU Standard Contractual Clauses (SCCs)
  • Data Processing Agreements with all providers
  • Technical and organizational security measures
  • Adequacy decisions where applicable

7. DATA RETENTION

7.1 Retention Periods

Data Type Retention Period Reason
Account Data Duration of account + 7 years Legal/tax requirements
Contract Data 10 years from contract date Commercial law requirements
Signature Records 10 years eIDAS compliance
Consent Records 10 years GDPR accountability
Transaction Logs 10 years Audit requirements
Communication Records 7 years Dispute resolution
Technical Logs 90 days Security monitoring
Marketing Preferences Until consent withdrawn + 3 years Compliance records

7.2 Onboarding Rejection Data

If your application is rejected following our onboarding review:

  • Partial account data is retained for 3 years
  • Reason: fraud prevention, and the establishment, exercise or defence of legal claims
  • You may request deletion after 3 years

7.3 Deletion

Upon account termination:

  • Active data is archived
  • Data is retained for required periods
  • Data is securely deleted after retention periods expire
  • Anonymized data may be retained indefinitely for analytics

8. YOUR RIGHTS

8.1 GDPR Rights

Right Description How to Exercise
Access (Art. 15) Obtain a copy of your personal data Email support@berry-marketplace.com
Rectification (Art. 16) Correct inaccurate or incomplete data Account settings or email us
Erasure (Art. 17) Request deletion of your data Email support@berry-marketplace.com
Restriction (Art. 18) Limit how we process your data Email support@berry-marketplace.com
Portability (Art. 20) Receive your data in structured format Email support@berry-marketplace.com
Objection (Art. 21) Object to processing based on legitimate interests Email support@berry-marketplace.com
Withdraw Consent Withdraw marketing consent at any time Account settings or unsubscribe link
Complaint Lodge a complaint with supervisory authority See Section 8.4

8.2 Exercising Your Rights

To exercise your rights:

We will:

  • Verify your identity before processing requests
  • Respond within 30 days (extendable by 60 days for complex requests)
  • Provide information free of charge (fees may apply for manifestly unfounded requests)

8.3 Limitations

Some rights may be limited where:

  • We have legal obligations to retain data
  • Data is necessary for contract performance
  • Deletion would affect other parties' data
  • Retention is required for legal claims
  • National security or public interest applies

8.4 Supervisory Authority

You have the right to lodge a complaint with:

Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

You may also complain to the supervisory authority in your country of residence or work.

9. DATA SECURITY

9.1 Technical Measures

We implement:

  • Encryption in transit (TLS 1.3)
  • Encryption at rest (AES-256)
  • Secure authentication (multi-factor available)
  • Regular security audits
  • Intrusion detection and monitoring
  • Access controls and logging
  • Regular security testing

9.2 Organizational Measures

We maintain:

  • Staff training on data protection
  • Access limited to authorized personnel on need-to-know basis
  • Confidentiality agreements with all staff
  • Incident response procedures
  • Regular security assessments
  • Vendor security requirements

9.3 Breach Notification

In the event of a personal data breach:

  • We will notify ANSPDCP within 72 hours where required
  • We will notify affected individuals without undue delay if there is high risk
  • We will document all breaches and remediation actions
  • We will take steps to mitigate harm

10. COOKIES AND TRACKING

Category Purpose Consent Required
Strictly Necessary Platform functionality, security No (essential)
Functional Remember preferences, settings Yes
Analytics Usage patterns, service improvement Yes
Marketing Targeted advertising (if applicable) Yes
Cookie Category Duration Purpose
session_id Necessary Session Authentication
csrf_token Necessary Session Security
preferences Functional 1 year User settings
analytics_id Analytics 2 years Usage tracking

You can manage cookies through:

  • Our cookie consent banner (shown on first visit)
  • Browser settings
  • Account privacy settings

You may withdraw cookie consent at any time via:

  • Cookie settings in footer
  • Browser cookie deletion
  • Account privacy settings

11. AUTOMATED DECISION-MAKING

11.1 Automated Processes

Process Purpose Human Review Available
Fraud detection Security Yes, on request
Risk scoring Platform integrity Yes, on request
Offer matching Recommendations Not applicable
Rating calculations Reputation Yes, for disputes
Commission calculations Billing Yes, for disputes

11.2 Profiling

We create risk profiles based on:

  • Transaction history
  • QC claim patterns
  • Payment behavior
  • Verification results

These profiles affect:

  • Search ranking visibility
  • Access to certain features
  • Risk warnings to counterparties

11.3 Your Rights

You have the right to:

  • Obtain human review of automated decisions
  • Express your point of view
  • Contest decisions

Contact support@berry-marketplace.com to exercise these rights.

12. CHILDREN'S PRIVACY

Berry Marketplace is a B2B platform intended for business use. We do not knowingly collect data from individuals under 18.

If we discover we have collected data from a minor, we will delete it promptly.

13. CHANGES TO THIS POLICY

13.1 Notification

We will notify you of material changes to this policy by:

  • Email notification to your registered address
  • Prominent notice on the platform
  • Requiring re-acceptance for significant changes (with typed name)

13.2 Review

We review this policy annually and update it as needed.

13.3 Version History

Version Date Changes
1.0 20 November 2025 Initial version
1.1 1 July 2026 Added Section 5.6 (Market Development Partners); HTML rendering

14. CONTACT US

For privacy inquiries:

Email: support@berry-marketplace.com

Data Protection Officer: Email: support@berry-marketplace.com

Postal Address: Nuvagra S.R.L. Attn: Data Protection Officer Strada Pădurii, Nr. 6, Bl. IAS, Scara B, Ap. 1 Iași, Județul Iași, Romania

Supervisory Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)

Website: www.dataprotection.ro

Access to Legal Documents:

15. ACCEPTANCE

By clicking "I Accept" and typing your full legal name, you acknowledge that you have read and understood this Privacy Policy.

Your acceptance is recorded with:

  • Your typed full name
  • Timestamp
  • IP address
  • Device information

This record serves as proof of your informed consent to our data practices.

Berry Marketplace — Privacy Policy · Version 2.0 · Effective Date: 15 August 2026 · Last Updated: 15 August 2026 · Document ID: BM-PRIVACY-v2.0