Privacy Policy
Effective 31 October 2026 · Notice version 2026-10-31.2. This notice covers retronative.com, its coming-soon page, launch mailing list, journal and preview marketplace.
Gabor Tarnok, trading under the Retronative brand.
2011 Budakalasz, Teglasi Andras u. 4/B, Hungary.
Privacy contact: info@retronative.com.
1. What we process and why
| Activity and information | Purpose and legal basis |
|---|---|
| Account: name, email, password hash, account identifier, sign-in provider if used, status and creation date. | Providing the account and requested marketplace features: GDPR Article 6(1)(b). Passwords are hashed, not stored as readable text. |
| Optional private phone number and address saved in My profile. | Providing the contact/address profile you request, Article 6(1)(b). These fields are optional; the preview works without them. Remove the information from your profile whenever you wish. |
| Listings, photographs, descriptions, prices, moderation and account actions. | Hosting and moderating your requested listings: Article 6(1)(b). Preventing abuse, enforcing moderation and protecting users: Article 6(1)(f), our legitimate interest in operating a secure, trustworthy marketplace. |
| Private product conversations: participant identifiers and display names, product reference, messages, read positions, per-user deletion state and transactional email-notification delivery status. | Providing the buyer/seller communication you request and notifying the recipient: Article 6(1)(b). Securing access and preventing abuse: Article 6(1)(f). The other participant sees your display name and messages, not your registered email. Service-notification emails are separate from marketing subscriptions. |
| Saved bag and availability enquiries, including requested products, totals, account contact details, dates and follow-up status. | Responding to your requests and taking steps at your request before a possible transaction: Article 6(1)(b). Payments are not connected; these are unpaid enquiries, not completed purchases. |
| Launch subscription: email, consent time, consent-text version, source and subscription status. | Sending the launch updates you expressly request: consent, Article 6(1)(a). Registration and cookie choices do not subscribe you. Withdraw your subscription or email us. |
| Optional Google Analytics: browser/device information, approximate geography, cookie identifiers, coarse public page routes and visit events. | Understanding audience use and improving public content: consent, Article 6(1)(a), and applicable cookie rules. No Analytics tag loads before permission. No advertising features, User-ID, profile-page tracking or deliberate personal identifiers are enabled by this integration. |
| Essential session identifier, security/CSRF tokens, expiring reset links, pseudonymous rate-limit buckets and activity logs. | Account security, fraud/abuse prevention and demonstrating actions: Article 6(1)(f). Where a specific legal obligation requires preservation, Article 6(1)(c) applies to that obligation. |
| Cookie preference and versioned consent events, with a random preference reference and timestamp. | Remembering your choice and demonstrating consent/withdrawal: Articles 6(1)(c) and 7(1), as applicable. We do not add your account email, raw IP address or browser fingerprint to these preference records. |
Hosting and network providers necessarily receive connection information, such as IP address and request metadata, to deliver and secure the site. Their infrastructure and backup practices are also relevant; see below. Providing basic account details is necessary to create an account. Optional contact information, newsletter consent and Analytics consent are not conditions of browsing or registration. We do not use automated decision-making producing legal or similarly significant effects or enable advertising profiling through this integration.
2. Who can see your information
Optional YouTube videos: some journal articles contain a video placeholder. No YouTube iframe, player script or remote thumbnail is requested until you choose “Load YouTube video” for that video. The embedded player then connects to Google via youtube-nocookie.com. Google receives connection information such as your IP address and browser/referrer metadata and may use its own storage under its policies. This choice is separate from Analytics and is not remembered for later visits. Use “Unload YouTube video” or leave the page to remove the player; information already received by Google cannot be recalled by unloading it. You can read the article without loading the video. See Google Privacy Policy.
Your listing title, photographs, description and price become visible after publication. Contact takes place through participant-only internal messaging, not a public seller email address. Do not include a private home address, identity document, other people’s contact details or information you do not want made public in a listing or photograph. Optional profile address and phone fields are private to you and authorised Retronative administrators. Messages are stored in MySQL and delivered only through authenticated participant endpoints; they are not end-to-end encrypted, and the operator/hosting provider can have necessary technical access. Ordinary administrator inbox access does not give access to another pair’s conversation.
GoDaddy and its relevant contracted entities/subprocessors provide web hosting, MySQL infrastructure and related email delivery. Google provides Analytics only when it is configured and you opt in. If enabled later, Google or Facebook sign-in redirects you to that provider only when you choose that sign-in method; the provider can return your identifier, name and verified email as applicable. Those providers also process information under their own privacy notices. Existing password accounts are not silently linked by email.
Affiliate links take you to an external seller, such as eBay. We identify these offers and may earn a commission. This integration does not embed affiliate tracking pixels or third-party product widgets; the external site’s processing applies once you follow its link. We may disclose information to authorities when legally required, or to professional advisers where needed to establish, exercise or defend legal claims.
3. International processing and safeguards
GoDaddy, Google and optional sign-in providers may process information outside the EEA, including in the United States. The applicable processing terms must provide a valid transfer mechanism where required: an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses, with supplementary measures where necessary. Analytics is not enabled by default. You can ask info@retronative.com which contracted entity, processing locations and transfer safeguards apply and how to obtain the relevant safeguards. Consent to optional Analytics is not a waiver of GDPR transfer protections.
Provider references: GoDaddy privacy information, Google data processing terms, Google Privacy Policy. Account-specific hosting region, backup retention, processing terms and access permissions must be confirmed with the actual providers; they are not inferred from a domain name.
4. Retention
The operational retention schedule is below. Records needed for a concrete legal obligation or documented dispute may be retained separately for the applicable period, with access restricted. These exceptions must be assessed and documented, not applied indefinitely to every record.
- Accounts and optional profile data: while the account is active, until you remove a field or close the account. Personal community listings, bag and unpaid enquiries are removed on account deletion. Retained shop/editorial records are detached from your account; your uploaded shop products are archived and no longer publicly accessible. Existing public copies made by other people cannot necessarily be retrieved.
- Launch subscription: until withdrawal, or up to 12 months from the most recent subscription consent without renewal. Withdrawn entries are kept for up to 60 days for suppression and reconciliation, then removed. A fresh explicit subscription may renew the record.
- Unpaid enquiries: closed/cancelled records are removed after they are at least 12 months old. Open requests remain until resolved or account deletion.
- Messages: up to 12 months after the conversation’s last activity, unless deleted earlier by both participants or by account deletion. Deleting a conversation removes it from your own view, not the other participant’s copy; later incoming messages can reopen a new visible history without restoring your hidden older messages. Account deletion removes the account’s conversations for both participants. Email notifications already delivered cannot be recalled from someone else’s mailbox. Notification retry metadata is removed with the conversation.
- Security activity logs: 90 days. Rate-limit entries expire according to their short security window. Sessions expire after two hours of inactivity; session cookies normally end with the browser session. Reset and unsubscribe links expire after 30 minutes.
- Cookie preferences: 180 days, then a new choice is requested. Versioned preference evidence is retained for up to 400 days; it is not linked to your account identity.
- Google Analytics: this integration limits its first-party Analytics cookies to 180 days without refreshing that period on every visit. The operator’s setup requires a two-month user/event retention setting and disabled advertising/enhanced-measurement features. Aggregated reporting has a separate lifecycle and is not erased merely by changing that setting. Removing a cookie does not retrospectively erase information Google already received; contact us for an applicable erasure request.
- Infrastructure logs and backups: managed according to the actual hosting contract and backup schedule, not by the application’s account-delete button. Deleted information must not be reintroduced into live use on restoration; deletion requests must be reapplied. Ask us for the current hosting retention details.
5. Your rights and choices
Subject to the GDPR’s conditions, you can request access, correction, erasure, restriction and portability of your information, and object to processing based on legitimate interests. Withdraw optional consent at any time without affecting processing already lawfully carried out. Use My profile for corrections, account deletion and a machine-readable export; use for Analytics and Unsubscribe for launch emails. You can also contact info@retronative.com without creating an account.
We normally respond within one month. Where an extension is permitted for complexity or volume, we explain it within that first month. We may request proportionate verification of your identity, but do not send passwords or identity documents unless a justified secure process has been agreed.
You may complain to your local supervisory authority or Hungary’s NAIH: naih.hu, 1055 Budapest, Falk Miksa utca 9–11, Hungary. You may also seek a judicial remedy.
6. Data Act and changes
The EU Data Act is distinct from GDPR. It can create product-data access and pre-contractual information duties for qualifying connected products and related services; it is not a blanket rule making all webshop data public. Read the product-data and request information. Product-specific applicability and seller/data-holder responsibilities must be assessed before a qualifying offer or contract is made.
When processing changes, we update this notice and, where required, ask for new consent before the new optional processing starts. Contact details: info@retronative.com.