This data protection statement applies to the online platform at www.vinted.co.uk ("Website") as operated by Vinted UAB, Zirmunu st. 70-701, LT-09124 Vilnius, Republic of Lithuania ("Us", "We" or "Vinted") and to the associated app ("App") operated by Vinted. More details about how to get in contact with us can be found at the end of this data protection statement under no. 13.
We take your privacy extremely seriously. We will not sell or lease your personal data. All data will be collected, stored and processed by us in accordance with the European Union General Data Protection Regulation No. 2016/679, other statutory regulations and not passed on to any third party unless we are under a statutory obligation to do so, or unless necessary for the provision of our services, or unless you have expressly agreed to the passing on of your data.
The services offered by us via the website and/or app (jointly "Platform") can function only if we collect, store, transfer, delete and/or otherwise use ("Process" or "Processing") specific data relating to you. Personal data means all information relating to an identified or identifiable natural person ("Data") such as your name, date of birth, address or email address.
This data protection statement describes which of your Data we collect and for what purposes we Process it when you use the services offered by us on the Platform. This data protection statement also contains important information on the protection of your Data, especially the statutory rights you have in connection with it.
Certain services on our Platform are offered by third-party suppliers. When you use these services, the data protection regulations of the third-party suppliers will then apply in addition to this data protection statement. Prior to your use of such services, the third-party suppliers may require you to provide permission under data protection law.
This data protection statement supplements the general terms and conditions ("GTC") that form the basis of your contract with Vinted for the usage of the Platform ("Usage Contract"). In the event of discrepancy between the GTC and this data protection statement, the provisions of the latter shall apply.
2. Which of your data do we Process?
2.1 Connection to Website and App
When you connect to the Website or App, we Process the following data (logfiles), even if you are not logged in to the Website as a member:
- the IP address of your device;
- the browser used by your device;
- the content and URLs you connect to;
- the date and time of your connections
In the event of access via mobile devices, the following logfiles are also captured as part of your use of the Vinted App:
- model and manufacturer of your mobile device;
- the operating system used by your mobile device (iOS, Android).
Without your express permission we will not use the personal data specified in this section, especially the IP address, unless such use is necessary (i) for the provision of our services and/or (ii) for security purposes, especially the prevention of cyber attacks such as data scraps and denial of service attacks and for preventing impermissible multiple applications.
2.2 Registration as member
In order to use our Platform, and especially to undertake commercial transactions via the Platform, to use the electronic payment system or to leave reviews and communicate with other members, you need a Vinted account. For this purpose, you must register as a member on the Website or App. If you have a Facebook or Google account, you can also register via one of these accounts.
(a) Registering via your Facebook or Google account
If you register via your Facebook or Google account, you will be transferred from our Website or App to the website of Facebook or Google and asked to enter the log-in details for your Facebook or Google account. If you enter your Google log-in details, Vinted will receive from Google the following data from your Google account:
- Profile photo
- First name
- Email address
Once you have entered your Facebook log-in details and you are on the Facebook website, you can decide whether, in addition to your
- public profile (specifically member name, gender, profile photo)
- you wish to give us more of your Facebook data, i.e.
- your friends list and/or
- email address.
Please note that if you keep your default settings, all the aforementioned Facebook data will be selected. If you click on the button marked "Continue as ..." you are agreeing to the transfer to Vinted of the Facebook data selected.
The data we obtain from Facebook or Google will be used to set up your Vinted account. This means that we will use the member name of your Facebook or Google account as the member name for your Vinted account so that it will be visible to other visitors to the Website and users of the App. If we obtain access to your friends list from Facebook, we will use it in your profile to show to other members the number of your Facebook friends and thus build up the confidence level for transactions with you. Other Data obtained from Facebook or Google will not be visible to anyone on the Platform.
You can at any time undo the link with your Facebook or Google account. This can be done under "My settings" in your Vinted account. If, however, when you initially registered, you did so without linking to your Facebook or Google account, you can create this link later.
(b) Registering without a Facebook or Google account
If you do not want to register via a Facebook or Google account, you will be asked to enter the following details on our Website or App:
- Member name (mandatory info for the use of the Platform)
- Email address (mandatory info for the use of the Platform)
- Confirmation you are aged over 18
Your member name will be visible to all visitors to the Website and users of the App. Other data you provide as part of the registration process will not be visible. Your member name can be a pseudonym and does not have to be the same as your real name.
2.3 Completion of your profile
After registering, you can add optional information to your profile. Go to "My settings" in your account.
a) Profile details
Under "Profile details" you can add the following data:
- First name and surname
- Date of birth
- Profile photo
- About you
Your profile photo and the information you provide in the "About you" field are visible to other visitors to the Website and users of the App, but the remainder of the Data entered by you is not visible.
(b) My feed
Under "Manage my feed", you can enter your dress and shoe sizes. This Data cannot be seen by others.
Under "Dispatch" you can enter your address and a country and a location (city or town) where the item you are selling is located (meeting point). The location you enter is visible to other members, but you can conceal it by adjusting your settings under "My Settings" in "Privacy Settings". Other members will only ever see your approximate location. The other data provided by you will not be visible to visitors to the Website or users of the App.
Under "Payment" you can enter the details for the bank account (name of account holder and IBAN) to which payment is to be made by purchasers of the items you sell via the Platform. To make it easy to provide this information, you can save your account details under "Payment". Otherwise your account details will of course not be visible to anyone.
2.4 Use of Platform for transactions
We will store and Process Data on your transactions on the Platform (e.g. item, price, time of transaction etc.). You can see this Data in the transactions overview of your account.
If you sell items on our Platform, we collect additional Data that you create when you offer the items for sale, particularly photos and video as well as text and other descriptions (e.g. brand, price, size, condition, colour etc.), payment methods accepted, location, item comments etc. This Data will be visible only to visitors to the Website and users of the App.
2.5 Use of the MANGOPAY electronic payment system
(a) Setting up your e-wallet
If you opt to pay a seller by credit card, PayPal, or if you accept payment from a buyer via one of these methods, or if you use other services on the Platform for which a charge is made, the transaction in question will be processed via our electronic payment system, MANGOPAY (see our GTC), which is operated by MANGOPAY S.A., 10 Boulevard Royal, L-2449 Luxembourg ("MANGOPAY"). To use MANGOPAY, you will need to set up an e-wallet on the Platform (referred to on the Platform as a "wallet") and provide us with the following information, which we will transfer to MANGOPAY:
- First name
- Date of birth
- Invoice address
(b) Payment via MANGOPAY
If you use the MANGOPAY electronic payment system, MANGOPAY will collect the payment information required according to the payment method selected (e.g. credit card, PayPal). Payment will then be implemented via MANGOPAY and the payment service provider you have selected (e.g. PayPal). To this extent, the data protection regulations of MANGOPAY and the relevant payment service provider will apply. For more information on payment procedure and payment service providers, see no. 13 of our GTC. If you use a credit card as your payment method, Vinted will see only the last four digits of your card number. This information will be used by us solely for the purpose of confirming payment and preventing fraud.
2.6 Communication, comments and reviews
When you use our services, we also collect the following Data:
- News that you share with other members via the Platform;
- Forum contributions;
- Comments you leave regarding items offered for sale by other members;
- Your communication with other users.
For technical reasons, this content generated by you will remain online after the end of your user agreement. Nonetheless your member name will not be visible and there will be a note stating that the content comes from a member who is no longer active (see our GTC).
2.7 Location data when you use the App and certain web browsers
Prior to installation of the App or the use of location-specific content and services within the App, and when you use certain web browsers (e.g. Google Chrome), you will be asked by the App or browser for authorisation to Process your location data. If you give your permission, Vinted will use the App and your mobile device or web browser to determine the location of your mobile device or computer from various sources (GSM radio cells, GPS location, WLAN etc.). Location data are only ever approximate.
Please note that, if you do not provide permission for the collection of your location data, the App cannot be installed and the Platform services for which the assessment of your location is necessary ("Location Services") cannot be used. If you wish to revoke your permission, you can at any time prevent your location data being collected in the future by adjusting the settings in your mobile device or web browser. If you do so, you may no longer be able to use the Location Services.
Vinted will process the location data collected via your App or web browser to offer you items in your location and enable you to meet other members in your location (location-related services). We will not store your location data long term. We will keep it only for long as and insofar as we need it to offer you location-related services.
3. Purposes for which we Process your Data
Insofar as not already specified under 2, we will Process your Data for the following purposes.
3.1 Provision of our services
We will Process your Data for the purposes of performing the usage agreement, for providing the services used by you on our Platform
- and for facilitating your buying and selling of items
- for facilitating the electronic processing of payments for goods bought and sold on the Platform
- for verifying your identity and details
- for facilitating communication with other members
- for sending you messages necessary for the provision of our services
- for providing an overview of your transactions on the Platform (transaction history)
- to show you offers from other members that might interest you (e.g. offers specific to your age, gender, transaction history or dress size)
- to show you offers in your location, which could help you to trade locally, save on despatch costs or meet other members local to you (location-related services)
- to be able to offer our services free of technical errors and to be able to recognise and resolve any errors.
3.2 Legal rights, improvement of our Platform, prevention and detection of inadmissible activity, system security
We will also process your Data to protect the following legitimate interests of Vinted and/or any third parties:
- Resolution of disputes, enforcing our GTC and the enforcement, exercise and upholding of our rights
- Analysis and evaluation of usage of our Platform for the purposes of continual improvement of our products and services
- Prevention, detection and prosecution of unlawful activity, especially fraud
- Guaranteeing the security of the Platform, the protection of the Data we hold and the detection of cyber attacks and other threats to the integrity of the Platform
3.3 Creation of anonymous user profiles
Vinted will use the Data gathered during registration (see above under 2.2) and during profile creation (see 2.3), the Data on your forum activity (see 2.6), your logfiles (see 2.1) and your usage data as collected via cookies (see below under 8) to create an anonymous user profile ("User Profile").
Unless permission is provided, Vinted will under no circumstances use this User Profile in such a way as to allow a connection to be established between it and a specific person. This means that Vinted will not be able to establish the member's identity. Vinted further guarantees that, without permission, anonymous user profiles will not be combined with users' other personal Data for any technical, personal or administrative purpose.
Vinted will create and use User Profiles in pursuit of the following legitimate interests:
- We will use User Profiles to analyse and understand members' behaviour. For essential and often-used services of the Platform, this understanding will enable us to improve existing services and/or add further services.
- Members will receive personalised marketing messages based on the User Profile created. This means that users will receive marketing messages based on their interests and User Profile. Marketing messages will be sent on the basis of advertisers involved with the Platform and, provided permission has been granted, via email to the address provided on registration or to the mailbox held within the Platform account (messages or mailbox).
3.4 Email newsletter and other marketing emails
You can register for our newsletter and for other marketing emails ("Marketing Emails"). When you register, we will ask you for your permission to Process your email address for the purposes of sending you Marketing Emails containing the latest information on our products and services, especially with regard to goods available on the Platform, special offers and marketing campaigns. You will receive Marketing Emails only if you have given permission.
Your permission for the sending of Marketing Emails can be withdrawn by you at any time with future effect. In your Vinted account, you can adjust your settings to block the sending of any further Marketing Emails. Alternatively you can click "Unregister" at the end of the Marketing Email. Withdrawal of permission will not affect the lawfulness of Processing carried out prior to withdrawal of permission.
3.5 Account verification for security purposes
We will use Data on your usage of our Platform to give each member a "trust score" calculated using an algorithm. The "trust score" indicates the likelihood of misuse of the Platform. In such cases, our service provider will send you an automated security message requesting you to give us your phone number for the purposes of account verification. You will receive a code via a text massage sent to the phone number you have provided. You will not be able to continue using the App until you have entered the code. Until then, your usage of the Platform will be blocked. Your phone number will not be visible to Platform users and will not be used by us for any other purpose, and especially not for marketing purposes.
4. Online security
Access to your account is protect by a password set by you. Do not disclose your password to anyone. Once you have finished using Vinted, remember to log off by using the log-off button, especially if you're using a public computer. Please note that the transfer of data via the Internet (e.g. via email) is not always totally secure and the prevention of access by third parties cannot be guaranteed.
We will take all technical and administrative security measures required to protect your Data from unauthorised loss and access as well as from unauthorised amendment, disclosure or deletion. Access to your Data is limited to those persons who require it for the purposes described in this data protection statement. Such persons are bound by the applicable data protection laws.
5. Contract processing
Vinted may appoint external service providers to provide specific services. These service providers will undertake data processing procedures on our behalf and at our instruction (contract processors). Vinted will select contract processors carefully and in accordance with applicable data protection laws. It will also ensure that Processing is carried out in accordance with the provisions of any written contract and with statutory data processing regulations.
The procedures carried out on our behalf include:
- the provision of the technical infrastructure for the Platform and the provision of server space
- shipping services
- online and usage analysis
- account verification
- customer service and enquiry processing
- payment processing and escrow
- trust in and security of the Platform (e.g. prevention of fraud and harassment).
The contract processors appointed by us may under certain circumstances be granted access to your personal Data but solely for the purpose of the data processing requested. Contract processors are also contractually required to ensure that the level of their data protection is at least equivalent to that provided by us. All Data processed on our behalf remains under our control. We continually monitor compliance with our instructions, with guaranteed levels of data security and with contractual agreements formed with the data processor.
Some of these service providers may be in countries outside the EU/EEA whose data protection levels are viewed within the EU/EEA as inadequate. We have nonetheless formed appropriate agreements with these service providers (or there are other guarantees in place) that ensure that all necessary measures will be taken to protect your data in accordance with the applicable requirements. If you have any questions about our service providers, please contact our Platform help centre. If our question is not answered there, please contact us via email at firstname.lastname@example.org. As a minimum, we will always supply on request any additional information on the guarantees we have put in place (or where applicable a copy of this information via email).
6.Capture of public content by external search engines
Your member name, profile photo and the "About you" details in your profile (see 2.2. and 2.3 above), all other content published by you, e.g. items offered for sale, forum posts, comments on items (see 2.4 and 2.6 above) as well as the date of your registration and the time of your last log-on will be freely available online and thus included in external search engine results. We therefore advise you not to publish any addresses, mobile numbers, email addresses or other contact data or sensitive or private information.
7. Disclosure of your Data to third parties
Vinted will share your Data with other entities in Vinted group. Vinted is statutorily obliged to provide personal and/or usage Data to investigative, criminal prosecution or supervisory authorities if and insofar as required for the avoidance of risk to the public and for the prosecution of criminal acts.
In all other cases your Data will be passed on to third parties only where you have granted permission or have yourself given third parties access to your Data (not including third parties that we have commissioned as contract processors, see 5 above).
8.1 Required cookies
Cookies are small text files that our Platform wants to place on your computer or other online devices such as tablets or smartphones. Provided your browser settings accept cookies, your browser adds the text in the form of a small file.
Unless stated otherwise elsewhere in this data protection statement, the cookies we use are necessary for the functionality and performance of our Platform. This includes cookies that enable you to register for the protected areas of our Platform, to buy an item or to use the electronic payment system. Most cookies are deleted from your device after the end of your browser session (session cookies). The information saved in the required cookies will be used by us solely to provide the services and functions requested.
8.2 Cookie consent
When you access our Platform, we will ask for your consent to place additional cookies on your device by showing you a cookie banner and obtaining your permission. These cookies are not strictly necessary for the functioning and performance of our Platform, but they do help us
- to recognise how many visitors visit our Platform and how they behave when they are here. This helps us to improve the functionality of our Platform, e.g. by ensuring that users can find what they are looking for (analytic/performance cookies) and by helping us
- to recognise you when you re-visit our Platform. This helps us to personalise our content for you, greet you by your name and note your preferences (functional cookies) and
- to capture your visit to our Platform and which pages you visit and which links you click on. We will use this information to better tailor our Platform, and the advertising we show you, to your interests. If you have given us your permission to send you Marketing Emails (see 3.4 below), we will also use this information to send you personalised Marketing Emails (targeting cookies).
Further information on cookie usage by Vinted and on how you can withdraw your consent or decline to accept cookies can be found below.
8.3 Managing your cookie settings
You can configure your browser to decline some or all cookies or to ask for your permission before accepting them. If however you decline cookies, some of our services may have restricted functionality. For information on how to adjust or change your browser settings, visit www.aboutcookies.org or www.allaboutcookies.org. If you use multiple devices to access our Platform (e.g. smartphone, tablet, computer etc.) you must ensure that each browser is adapted to each device in accordance with your cookie preferences.
You can prevent storage of, and tracking by, such third-party cookies by adjusting your browser settings.
9. Use of SurveyMonkey survey tool
For our surveys we use the SurveyMonkey online survey tool, which is provided by SurveyMonkey Europe Sarl, 6 rue Jean Monnet, L-2180 Luxemburg and SurveyMonkey Inc, 101 Lytton Avenue, Palo Alto, CA 94301, US ("SurveyMonkey"). SurveyMonkey Inc. is certified by the EU-US Privacy Shield scheme. When you take part in our surveys, Data such as your IP address, name and other Data provided by you as part of the survey will be saved on SurveyMonkey's servers. This process is governed by SurveyMonkey's data protection regulations, which can be found at https://www.surveymonkey.com/mp/legal/privacy-policy/.
As we are constantly developing our services, we reserve the right to change this data protection statement at any time subject to the applicable regulations. Any changes will be published promptly on this page. Regardless of the aforementioned, you should check this page regularly for any updates.
Unless stated otherwise on this data protection statement or provided for by statute, we will save
- the personal Data specified under 2.1 for 30 days from the date of its capture
- the personal Data related to your transactions for 13 months from the date of transaction
- all other personal Data specified in this data protection statement for three months from the date of deletion of your Vinted account or for three months after five years of inactivity on your account.
Under statutory data protection provisions, you have the right at any time:
- to be informed of the Data we Process and to demand a copy of the data concerned (right to be informed). All the Data that you have actively provided for us on the Platform (2.2 to 2.6) can also be accessed by you at any time in your Vinted account;
- to demand the correction of inaccurate Data and, subject to the nature of the Processing, the completion of incomplete Data (right to rectification). All the Data that you have actively provided us with on the Platform (2.2 to 2.6) can also be amended by you yourself at any time in your Vinted account (except sent messages and any forum posts or reviews);
- subject to just cause, to demand the deletion of your Data (right to deletion);
- to demand restriction of the processing of your Data, provided the statutory criteria are met (right to restrict processing);
- subject to the statutory criteria being met, to receive the Data you have provided in a structured, current and machine-readable form and to transfer this Data to another processor or, where technically feasible, to have it transferred by Vinted (right to data portability); and
- to be subject to decision-making not wholly reliant on automated Processing, unless the statutory conditions for such automated decision-making are met. Vinted does not currently operate automated decision-making.
You also have the right on exceptional grounds to opt out of the statutory Processing of your Data. Where your personal Data are Processed for direct marketing purposes, you can object to such Processing (right to object).
You further have the right to withdraw at any time any permission you have provided as part of registering for or using our services. Such withdrawal will not affect the lawfulness of Processing carried out prior to withdrawal and based on the permission granted. Where permission for cookies is concerned, you can use the deregistration and deactivation mechanisms set up for the various services (see data protection statement for the individual services under 8.4 and 8.6 of this Website). This will result in a permanent deactivation cookie being placed in your browser, thereby signaling to us that your browser should not be subject to such data capture. Please note that, if you remove all cookies that have been placed in your browser, the deactivation cookie too will be deleted. To above process will have to be completed by you again if you use our Platform with another device or another browser.
You can withdraw your permission for the sending of our newsletter by adjusting your Vinted account settings to block the sending of any further Marketing Emails. Alternatively you can click "Unregister" at the end of the Marketing Email.
To exercise any of the rights specified in this section, you can contact Vinted using the contact details below. Regardless of any other legal remedy, you also have the right at any time to submit a complaint to the supervisory authorities.
13. Our contact details
If you have any queries regarding the Processing of your data as part of your use of the Platform, or regarding your rights, please contact our data protection officer at
Zirmunu st. 70-701
Republic of Lithuania
Vinted data protection officer:
14. Text of any consent you have provided