Privacy Policy

BHAZAR S.R.L. ("Bhazar", "we", "us", or "our") operates the Bhazar Marketplace. We are a company registered in Romania under Trade Registry number J2026005179006, with Unique Registration Code (CUI) 53489103.

Registered Address: Strada Traian 107, Sector 3, București, Romania.

Main Activity: CAEN 4690 — Non-specialized wholesale trade.

Data Protection Contact: gdpr@bhazar.com

The Bhazar Marketplace connects Buyers with independent third-party Sellers. This affects who is the data controller:

• Bhazar is the controller for the data we process to operate the Platform: account registration, browsing, search, checkout and escrow, payments facilitation, payouts, dispute mediation, security, and Platform-level communications.
• Each Seller is an independent controller for the personal data they receive to fulfil their own orders (e.g., a Buyer's name and delivery address) and to meet their own legal obligations (invoicing, fiscal retention, handling returns under consumer law). Sellers must have their own privacy practices and are responsible for their processing.
• When you purchase from a Seller, we share the order data the Seller needs to deliver and to honour returns/warranty. From that point, the Seller processes that data as its own controller.

If you have a question about how a specific Seller uses your data, contact that Seller directly; we can help route the request.

We may collect and process the following categories of personal data:

• Identity Data: Name, username, and — for Sellers — company name, legal-entity and fiscal identifiers.
• Contact Data: Email address, phone number, billing and delivery address.
• Account Data: Login credentials (hashed), preferences, role (Buyer/Seller).
• Transaction Data: Orders, products purchased or sold, prices, escrow status, payouts, invoices.
• Payment Data: Processed by our payment partner; we receive limited data such as transaction references and last digits/card brand. We do not store full card numbers.
• Payout Data (Sellers): Bank/IBAN or payout-account details, required to transfer released funds.
• Return & Refund Data: Return reasons, IBAN (when a bank-transfer refund is chosen), and photos uploaded to support damage/non-conformity claims.
• Communication Data: Messages between Buyers and Sellers on the Platform, support correspondence, dispute communications.
• Technical Data: IP address, browser type/version, time zone, operating system, device information.
• Usage Data: Pages visited, listings viewed, clicks, timestamps, session duration.
• Cookie Data: Information collected through cookies and similar technologies (see our Cookie Policy).

• To create and manage Buyer and Seller accounts.
• To operate the Marketplace: listings, search, checkout, escrow, payouts, and invoicing.
• To process and facilitate payments, refunds, and returns.
• To mediate and resolve disputes between Buyers and Sellers.
• To respond to inquiries and provide customer support.
• To verify Seller identity and prevent fraud, abuse, and prohibited listings.
• To send service and transactional communications.
• To send promotional communications (with your consent).
• To analyze usage and improve the Platform.
• To comply with legal, fiscal, and regulatory obligations.

• Contract Performance (Art. 6(1)(b)) — Creating accounts, processing orders, escrow, payouts, returns, and refunds.
• Legal Obligation (Art. 6(1)(c)) — Invoicing, fiscal and accounting retention, consumer-law obligations, responding to authorities.
• Legitimate Interest (Art. 6(1)(f)) — Securing the Platform, preventing fraud, improving services, and operating dispute mediation. We balance these against your rights.
• Consent (Art. 6(1)(a)) — Marketing communications and non-essential cookies. You may withdraw consent at any time.

We do not sell your personal data. We may share data with:

• Sellers — the order data needed to fulfil your purchase and handle returns/warranty (each Seller is an independent controller).
• Buyers — limited Seller information required to complete and support a transaction.
• Payment & escrow providers — to process payments, hold escrow, issue refunds, and execute payouts.
• Logistics/courier partners — delivery and return shipping, where applicable.
• Service providers — hosting, communications, fraud-prevention, and analytics, acting as our processors under contract.
• Legal authorities — when required by law or to protect our rights, users, or the public (e.g., ANPC, tax authorities, courts).

We prioritize processing within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure adequate safeguards, including European Commission adequacy decisions or Standard Contractual Clauses (SCCs).

We retain personal data only as long as necessary:

• Account data: Duration of your account plus 3 years.
• Transaction & invoicing data: 10 years (Romanian fiscal law requirement).
• Return/refund data: For the duration of the return plus the fiscal/audit window; IBAN provided for a refund is kept only as long as needed to complete the refund plus the legally required retention period, then deleted or anonymized.
• Return-claim photos: Kept only for the duration of the claim and any related dispute, then deleted.
• Communication data: 2 years from last contact (longer if needed for an open dispute or legal claim).
• Cookie data: As specified in our Cookie Policy.

• Access — a copy of the data we hold about you.
• Rectification — correction of inaccurate or incomplete data.
• Erasure — deletion ("right to be forgotten"), subject to legal retention duties.
• Restriction — limitation of processing.
• Portability — your data in a structured, machine-readable format.
• Objection — to processing based on legitimate interest.
• Withdraw consent — at any time, without affecting prior processing.

To exercise these rights, contact gdpr@bhazar.com. We respond within 30 days. For data a Seller controls, we will help direct your request to that Seller.

If you believe your data-protection rights have been violated, you may lodge a complaint with the Romanian Data Protection Authority:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP / ANPD) Website: https://anpd.gov.ro/web/

We implement appropriate technical and organizational measures to protect your data, including encryption (notably for credentials and IBAN/financial data), access controls, EXIF-stripping of uploaded claim photos, regular security audits, and secure hosting.

The Marketplace is not directed to children under 18. We do not knowingly collect data from minors.

We may update this Privacy Policy from time to time. Changes will be posted with a revised "Last updated" date.

• Data Protection (DPO/GDPR): gdpr@bhazar.com
• General Contact: contact@bhazar.com
• Registered Office: Strada Traian 107, Sector 3, București, Romania

---