Privacy policy
DraftLast updated 25 October 2026 — pending review by a Luxembourg lawyer.
rett ("we") runs a marketplace in Luxembourg where shops sell surplus food bags for collection. This policy explains what personal data we use, why, and your rights under the EU General Data Protection Regulation (GDPR).
Who we are
The data controller is [COMPANY NAME] SARL-S, [ADDRESS], Luxembourg, RCS [NUMBER]. Contact: privacy@rett.lu.
What we collect
- Account data: email address, name and profile picture (if you sign in with Google), language preference.
- Order data: bags reserved, pickup times, collection status, ratings.
- Payment data: handled by Stripe. We never see or store your full card number.
- Location: your approximate position, only in your browser, to sort nearby bags. It is not stored on our servers.
- Shop data (merchants): business name, address, opening hours, contact and payout details.
- Technical data: device, browser and error logs needed to keep the service secure.
Why we use it
- To provide your account and process orders (performance of a contract).
- To take payments and meet accounting and tax duties (legal obligation).
- To prevent fraud and keep the service safe (legitimate interest).
- To send notifications you switch on, such as a favourite shop posting a bag (consent, which you can withdraw at any time).
Who we share it with
The shop you order from sees your first name and order. We use processors bound by data-processing agreements: Stripe (payments), Google (sign-in), our hosting and database provider, and our email provider. Your account and order data are stored in the EU (Paris, France). Some processors, such as Google and Stripe, may handle limited data outside the EU under Standard Contractual Clauses. We never sell your data.
How long we keep it
Account data is kept while your account is open and deleted within 30 days of closing it. Order and payment records are kept for 10 years, as Luxembourg accounting law requires.
Your rights
You can access, correct, delete or export your data, object to or restrict its use, and withdraw consent. Email privacy@rett.lu. You may also complain to the Commission nationale pour la protection des données (CNPD), cnpd.public.lu.
Cookies and storage
We only use storage needed to keep you signed in and remember your language. We do not use advertising cookies.
Changes
We will post any changes here and tell you in the app if they are significant.
These terms are governed by Luxembourg law. Courts of Luxembourg City have jurisdiction.