Do I need a privacy policy when selling on a shopping platform commercially? I am selling 5 articles per month commercially (not privately) on the internet. I am doing this on eBay Kleinanzeigen in Germany. The English translation is eBay small advertisements. It's like Vinted, Shpock or Etsy. I already have a text for terms and conditions. I wonder if I also need a privacy policy which tells the buyer how long I will save his address (for example)? I also have the PayPal address or the IBAN of the buyer. Do I need a privacy policy which tells the buyer how long I will store this information?
If you process any personal data, you do need to provide notice to the data subjects per Art 13 or Art 14 GDPR. Personal data is any information relating to a (directly or indirectly) identifiable natural person. It seems you are processing personal data including as addresses, PayPal accounts, and IBANs. Thus you're in scope of the GDPR. The GDPR does have an exception when data is processed for “purely personal or household purposes”, but that very likely does not apply to you. The German Datenschutzkonferenz (DSK), a cooperation of the German supervisory authorities, has published a handout on information obligations, listing which information has to be provided in a privacy notice: https://datenschutzkonferenz-online.de/media/kp/dsk_kpnr_10.pdf Such a privacy notice can be fairly short if you're don't doing anything special, in particular if you only use the data as necessary to fulfil the sale contract and then as legally required (e.g. for keeping financial records). There are privacy notice generators that can help with the boilerplate, but be aware that some are significantly outdated, and that in any case you have to fill in the information about your concrete processing activities. You have guessed correctly that you will need to inform your customers about your data retention periods. Your privacy notice will get more complicated if you also want to use this data in other ways, for example for marketing purposes. That would also require you to think about appropriate legal bases (e.g. legitimate interests, or consent).
It might possibly be illegal. For criminal law, usually you need to obey the laws of three countries: The country you are a national of (by personality principle) The country from where you make the sale (by territoriality principle) The country that hosts the attacked interest (by territoriality principle) Then it depends on the jurisdiction (and other factors) whether the sale is legal or not. I'll use the example of my country, Czech Republic. There is a crime called "Unauthorized access to a computer system or data storage device". For example, you commit this crime by exploiting a vulnerability in a web application and copying the web owner's data on your computer. It is also codified that whoever wilfully facilitates the committing of a crime by providing the criminal with resources (such as the exploit) is considered to have also committed the crime. For this to apply, you must have known or expected that the exploit will be used to commit a crime. The courts would decide this.
Yes, phone numbers would generally qualify as Personal Data under GDPR. It would be so irrespective of whether you have also stored other information along with the phone numbers or not, since also information that indirectly could identify a natural person is Personal Data (provided that there are, somewhere else, public or not public, a register of who holds the specific phone number). See Article 4(1) GDPR. (One could possibly argue that the phone numbers would not be considered personal data if there is no actual register of who owns a specific phone number with any other party. Or if such register is in practice not available for anyone. It might be so in some cases, although I would not rely on it.) Whether you have the right to process the phone numbers must be assessed based on its lawfulness (see Article 6 GDPR). It could be based on consent, performance of contract, legitimate interest or any other ground set out therein.
GDPR &amp; EPD require user consent before storing a users personal information. Wrong. User consent is one of the ways that justify storing personal information, but there are others. You may check art.6 to see the several reasons that allow to store personal information. In this case, it seems reasonable to justify it under the paragraph f (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Of course, that means that the data has to be used for this purpose. Avoiding spammers and other banned users would be such a purpose, but you should ensure that you do not send those e-mail address commercial information or even a Christmas greeting. In any case, be careful with anything you store. If along with the e-mail you stored more info, this could be interpreted as excessive and beyond the scope of paragraph f. For example, imagine storing &quot;User wrote nazi statements&quot; explaining why the e-mail is banned; EU laws are very restrictive about storing information about political or religious beliefs.
Don't do it. So clearly tax fraud is bad and the state can prosecute this when tipped off. Alice is also clearly allowed to report the possible tax fraud to authorities and to serve as a witness if necessary. The problem is that Alice can expose herself to various liabilities, and could be sued by Bob or by the state. On what grounds did Alice snoop around in Bob's room? Even if they are roommates, Alice might not have a right to enter the room. Even if she has grounds to enter the room, she might not have permission to trawl through Bob's private stuff. A glance at a computer screen is also quite unlikely to show evidence of tax fraud, as even selling lots of stuff does not imply running a business.1 On what grounds can Alice collect and share personal data with authorities? There is no constitutional right for snooping and snitching.2 Alice must instead identify a legal basis for sharing such screenshots or pictures with third parties. Data protection law such as the GDPR does recognize that there might be a legitimate interest, but Alice is unlikely to have such a legitimate interest unless she is personally affected by Bob breaking the law. For example, some people have been sued for overly enthusiastic reports of parking violations. Footnotes: People can sell goods e.g. on eBay without running a business that would have to be registered with the tax office. A business in this context is any regular business-like for-profit activity. Thus, a registration might not be necessary for occasional activity, or if the activity isn't for profit. For example, a person selling their old stuff for less than they bought it for is not acting with a profit motive. Even if there is occasional profit, this can be a privates Veräußerungsgeschäft (private sale). Whether such a sale is taxable depends on the duration between acquisition and sale. If it is taxable, it has to be reported as part of income tax filings. Generally, the profit is free from income tax after one year. VAT is a different matter. Private sales don't involve VAT. When a sole proprietor registers a business, they can elect to ignore VAT until they reach certain turnover or profit limits (Kleinunternehmerregelung). This kind of tax fraud is typically not a crime, and more of an administrative offence. Thus, intrusive investigations are not proportional – and even then, they would be up to the state, not to individuals. It is worth noting that Germany has extremely poor whistleblower protections and has failed to implement relevant EU laws.
An app(lication program) is software run on the end-users machine. That does not fall under the GDPR. Any processing (including storage) you do on user data has to be compliant with the GDPR. Allows a user to authenticate via e.g. Facebook and stores some basic data (optional) Authentication via Facebook leaves GDPR compliance to Facebook (AFAIK). It would be a good idea to provide alternative authentication methods, such as Google and an "own account" user name and password so that the user doesn't have to share information with a multinational company in order to use your service. The "basic data" will need to be processed according to the GDPR. As long as the "optional" part is "opt in" (i.e. the user needs to at least click on something) then this means you have permission to process that data. Providing this "basic data" as a JSON or CSV file should meet data portability requirements. Allows a user to upload a GPX file (a route or some other activity) Stores the above file to Google's database Allows the user to analyze that file. Since the user is actively choosing to upload each file you have permission to do this. You should make it clear in your privacy policy that the data will be held by Google. Doing so should not be a problem as Google has set up the legal framework to do this under the GDPR. You don't have to store the information encrypted, but you should use encryption (e.g. HTTPS) for any data transmission. Allowing the user to analyse the file is not an issue; either the user is doing it on their own machine (GDPR irrelevant) or you are doing it under user instruction (meaning you have consent). Since the user has uploaded GPX files they already have data portability on those files. You should tell your users that while you will employ best endeavours you don't promise to keep their files accessible and they should maintain their own private copies. That way if your entire database gets corrupted they can't blame you for loss of data. Finally, make sure there is a "Close my account and delete all my data" option.
united-states I am going to answer based on US law. But many of the principles would be similar in many other countries. In particular the law in the EU is similar. There are two separate issues here, trademark rights and copyright. Trademark Rights Trademark law provides protection against the use of the mark &quot;in commerce&quot;. This means using the mark to identify or advertise goods or services. It does not provide any protection against use not in commerce. Specifically 15 USC 1114 (part of the Lanham Act, the main US Federal trademark law) provides, in relevant part: (1) Any person who shall, without the consent of the registrant— (1) (a) use in commerce any reproduction, counterfeit, copy, or colorable imitation of a registered mark in connection with the sale, offering for sale, distribution, or advertising of any goods or services on or in connection with which such use is likely to cause confusion, or to cause mistake, or to deceive; or (1) (b) reproduce, counterfeit, copy, or colorably imitate a registered mark and apply such reproduction, counterfeit, copy, or colorable imitation to labels, signs, prints, packages, wrappers, receptacles or advertisements intended to be used in commerce upon or in connection with the sale, offering for sale, distribution, or advertising of goods or services on or in connection with which such use is likely to cause confusion, or to cause mistake, or to deceive, shall be liable in a civil action by the registrant for the remedies hereinafter provided. Under subsection (b) hereof, the registrant shall not be entitled to recover profits or damages unless the acts have been committed with knowledge that such imitation is intended to be used to cause confusion, or to cause mistake, or to deceive. If the plane was being used commercially, using someone else's trademark would be infringement and could lead to a successful infringement suit. But if it is not being used to provide or advertise a service or goodsm there is no trademark issue. Copyright 17 USC 106 specifies the exclusive rights that a copyright owner has. One is to make copies, another is to make derivative works. Unless fair use (or fair dealing in the UK) applies, one needs permission from the copyright owner. Without such permission, copying is infringement, and can lead to an award of damages. However, according to the question, the image has been released under a CC-BY-NC license. That grants permission, under certain conditions. One condition is that the image (or text) not be used for commercial purposes. If the plane is purely private, not rente out, these conditions seem to be complied with, so there is no copyright issue either. Conclusion Based on the statements in the question, there seems to br no IP issue here. Be sure that there is no commercial purpose, and that the CC license was issued by the actual copyright owner. A brief consultatuion with a lawyer might be wise.
The critical part is the nature of the relationship between you, the website provider, and the provider of the material you embed. If the embed-provider acts as your data processor, then things are generally fine. The GDPR does not really distinguish between personal data processing activities that you perform yourself versus activities that you've outsourced to third parties. However, you would remain responsible for compliance. This also means that per Art 28 GDPR, you will need a contract with that embed-provider (sometimes called a “Data Processing Agreement”, DPA). This contract stipulates that the processor will only use the personal data as instructed by you, but not for their own purposes. With the Google Fonts case, it must be highlighted that Google does not act as a processor for this service. Google does not offer a DPA that covers the Fonts CDN. While Google promises that it doesn't use the personal data collected in this context in any nefarious way, there are zero contractual guarantees for website providers. So we have to consider the scenario when the embed-provider is an independent data controller. We as the website provider have no control over what the embed-provider does with the collected data, our control only extends to whether or not we cause the website to disclose data to that third party. But this is still processing as personal data (see also the CJEU Fashion ID case), and we need a legal basis for this data sharing. In the Google Fonts case, the court in Munich found that there was no legal basis for using Google's CDN. There was no consent, no contractual necessity, and no necessity for a legitimate interest. After all, these fonts could all be self-hosted. (Technical remark: and given how modern browsers enforce cache isolation and provide HTTP/2, serving fonts from your main domain is probably faster anyway). Consent management services will typically act as your data processor. You don't need a legal basis for “sharing” data with them, because the processing remains under your control. As far as the GDPR is concerned, loading a script from your processor's servers is equivalent to loading a script from your own servers (which you're probably hosting via a another data processor anyway). Sometimes, the necessary data processing agreement is already part of the standard terms of service, sometimes it's a separate document that has to be signed. Figuring this out is your responsibility as the data controller, before deploying the service. Art 6 GDPR doesn't say that you always need consent. It says that you need a legal basis, for which paragraph 1 enumerates six choices. For a lot of use cases, a “legitimate interest” will be appropriate, though it requires a balancing test. Sometimes, other laws mandate that you use a particular legal basis. For example, the ePrivacy Directive says that you must get GDPR-consent when accessing or storing information on the user's device (such as cookies), unless that access/storage is strictly necessary to provide a service explicitly requested by the user.