Privacy policy

1. Data controller

GeneticPlace is a trade name of DJM Genetics, a sole proprietorship established in the Netherlands. DJM Genetics is the data controller within the meaning of the General Data Protection Regulation (GDPR, in Dutch AVG) for the processing of personal data through the Platform.

• Trade name: DJM Genetics, trading as GeneticPlace
• Company register number: 87933071
• Registered address: Wetering-Oost 14a, 8363 TJ Wetering
• Email: info@geneticplace.com
• Phone: 06 30 10 29 55

We have not appointed a Data Protection Officer. Given our size and the nature of our processing, that is not legally required.

2. What data do we collect?

We collect and process the following categories of personal data:

• Account data: name, email address, phone number, password (stored encrypted through Supabase Auth)
• Profile data: display name, profile photo (optional)
• Seller data: company name, company register number, VAT number, registered address, holding (UBN) number, description
• Auction data: bids, purchases, watchlist, saved searches, recently viewed listings
• Communication data: messages between Buyers and Sellers, questions and answers on listings, reviews
• Transaction data: purchase amount, payment moment, invoice number, status, Mollie payment ID
• Notification data: notification settings, push notification subscriptions (device token, browser properties)
• Tracking data (functional): listings visited (per user or anonymised per session), searches
• Technical data: IP address, browser type, device data, error reports. We use the IP address briefly to limit abuse and trace faults, and to determine which region a visit comes from. We do not keep the IP address itself in our statistics; only the derived place name is kept.
• Payment data: these are processed entirely by our payment provider Mollie B.V.; we receive only a payment ID and the payment status, no card or account numbers

3. What do we process your data for?

We process personal data for the following purposes:

• Creating and managing your account
• Facilitating auctions, transactions and commission invoicing
• Sending transactional emails and notifications (outbid, won, invoice, chat invitation, and so on)
• Enabling communication between Buyers and Sellers
• Handling disputes between Buyers and Sellers
• Preventing and detecting fraud, abuse and disallowed automated access (bots)
• Improving how the Platform works and how easy it is to use, based on usage statistics
• Complying with legal obligations, including the tax retention obligation

Legal bases: performance of the contract (Art. 6(1)(b) GDPR) for account, transactions and notifications; legitimate interest (Art. 6(1)(f) GDPR) for fraud prevention, security, fault diagnosis and usage statistics; legal obligation (Art. 6(1)(c) GDPR) for the tax retention obligation.

4. Automated decision-making

GeneticPlace does not take decisions with significant consequences for you based solely on automated processing, as referred to in Art. 22 GDPR. Decisions about disputes, account blocking or moderation of listings are taken by a human.

5. Who do we share your data with?

We share your data only with the following categories of recipients, and only to the extent necessary for the purpose stated below:

• Other Users: after a successful transaction, limited contact information is shared between Buyer and Seller, to the extent necessary to complete the sale
• Mollie B.V. (Amsterdam, NL): payment provider for the commission payments
• Vercel Inc. (Frankfurt, EU): hosting of the Platform and analysis of page performance (Vercel Web Analytics, Vercel Speed Insights). Cookieless and without storing personal data.
• Supabase Inc. (EU West, Ireland): hosting of the database, file storage, authentication
• Resend, Inc. (EU region): sending transactional emails
• PostHog Inc. (EU cloud, eu.posthog.com): product analytics. Visitors without an account are tracked with a session number that stays in the browser. If you are logged in, we link the statistics to your account number, so that we can see how the platform is used in practice and where it can be better. We do not send a name, email address or other directly identifying data to PostHog, and the IP address is not stored. Internal test accounts are filtered out.
• Functional Software, Inc. (Sentry) (EU ingest, Frankfurt): error detection and performance monitoring. Sentry collects error reports and performance metrics, linked to a UUID, without an email address or name.
• Anthropic PBC (through the Vercel AI Gateway): when you use the listing assistant (Bella), the messages, photos and listing details you send are processed by Anthropic's AI language model to help you draft the listing. We do not send an email address or account name along with them. Anthropic does not use this data to train models (zero data retention through the business gateway processing).

We never sell your data to third parties and we do not use your data for advertising.

6. Transfers outside the EU

Our hosting (Vercel, Supabase), email (Resend), product analytics (PostHog) and error detection (Sentry) all run on servers within the European Union or the European Economic Area. Sentry error reports are processed through the EU ingest (Frankfurt, Germany). Your personal data is not transferred outside the EU.

The listing assistant (Bella) processes your messages and photos through Anthropic PBC, an AI supplier established in the United States, reached through the Vercel AI Gateway. That transfer takes place under the European Commission's Standard Contractual Clauses (SCCs). Your data is not used to train AI models.

7. How long do we keep your data?

• Account data: as long as your account is active, plus 30 days after deletion
• Transaction and invoice data: 7 years after the calendar year of the transaction (tax retention obligation, Art. 52 AWR)
• Communication data (chat, Q&A, reviews): as long as the listing or the account exists, after that in line with the retention period of the account
• Draft conversations with the listing assistant (Bella): empty drafts without messages are deleted automatically after 24 hours. Drafts with content (photos, details filled in) we keep as long as your account is active, so that you can continue a conversation later. They are deleted along with your account
• Disputes: 7 years after the dispute is closed (in connection with possible legal claims)
• Error reports and logs: 90 days at most, after that anonymised or deleted automatically
• Usage statistics (PostHog, Vercel Analytics): 12 months at most
• IP addresses for rate limiting: 24 hours at most

8. Your rights

Under the GDPR you have the right to:

• Access: request which data we hold about you
• Rectification: have incorrect data corrected
• Erasure: have your account and data deleted, to the extent that no legal retention obligation applies
• Portability: receive your data in a structured, commonly used format
• Objection: object to processing based on legitimate interest
• Restriction: have processing restricted temporarily
• Withdrawing consent: to the extent that the processing is based on your consent

You can exercise your rights through your account settings or by contacting us at info@geneticplace.com or by phone on 06 30 10 29 55. You can delete your account yourself under Account, Profile, Delete account. We respond to your request within one month.

9. Cookies and web analytics

We use only functional cookies that are necessary for the Platform to work, such as authentication and session cookies. These cookies do not require consent under Dutch telecommunications law or the GDPR.

To improve our service we use:

• Vercel Web Analytics and Vercel Speed Insights: measure anonymised visitor statistics and page performance. Cookieless, no storage of IP addresses, no personal data.
• PostHog (EU cloud): product analytics based on a session number stored in your browser (sessionStorage). For logged-in users we also use the account number, so that we can understand usage across several visits. Through PostHog we collect no email address, name or other directly identifying data, and the IP address is not kept. Internal staff are filtered out.
• Sentry: error reports and performance monitoring, linked to a UUID. No session replay, no keystroke or mouse capture, no form data.

These analytics fall under our legitimate interest (Art. 6(1)(f) GDPR) and place no tracking or advertising cookies. You can block this processing with a browser extension (such as uBlock Origin) or through your browser's "Do Not Track" setting.

10. Security

We take appropriate technical and organisational measures to protect your data. These include:

• Encrypted storage of passwords through Supabase Auth (bcrypt)
• Row Level Security at database level, so that users can only reach their own data
• HTTPS connections for all communication between browser and server
• A Content Security Policy and other security headers
• Rate limiting against automated attacks
• Regular security audits of the codebase and the database
• Limited access to production data, for the administrator only

11. Complaints

Do you have a complaint about the processing of your personal data? Please contact us first at info@geneticplace.com. You also always have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

12. Changes

We reserve the right to change this privacy policy. In the event of material changes we will inform you by email or through a notice on the Platform. You will always find the most recent version on this page, with the date of the latest change.