Privacy Policy

KHADROX, a company registered in Romania (VAT ID [VAT ID], Trade Registry no. [J-NUMBER]), Bucharest, Romania. E-mail: [email protected]. Phone: +40 745 940 049. Website: www.khadrox.com.

The controller is established in Romania and complies with the GDPR and applicable Romanian data protection law.

2.1 Account registration

Company name, registered address, VAT ID, representative name, work e-mail and phone. Legal basis: Art. 6(1)(b) GDPR, performance of the contract (Terms).

2.2 Seller verification

Trade-register extract, VAT certificate, ID of the legal representative, and optional site or machine photos for identity verification. Verification may include a site visit or a video call. Legal basis: Art. 6(1)(b) and (f) GDPR, contract performance and legitimate interests (fraud prevention, platform integrity).

2.3 Listings and auctions

Machine data you provide; bid history (amounts and timestamps) without exposing bidder identity to others; the seller company's name and a business contact phone number, which are shown on the listing; and further seller and buyer contact data, released to the counterparty after the seller accepts the bid. Legal basis: Art. 6(1)(b) GDPR.

2.4 Transactions and invoicing

Buyer and seller company data for invoices; transaction amounts and billing metadata; seller bank details (IBAN, BIC) for payout. KHADROX does not store card data, as payments are by bank transfer only. Legal basis: Art. 6(1)(b) and (c) GDPR, including tax and accounting retention obligations.

2.5 VAT Refund portal

Export documents (Bill of Lading, export declaration, CMR and similar), bank details for the refund, and company data to validate the request. Contact: [email protected]. Legal basis: Art. 6(1)(c) and (b) GDPR.

2.6 Communications and support

When you e-mail, call or use the contact form we process the data you send in order to respond. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in user support.

2.7 Technical data and analytics

Standard server logs (IP, browser type, pages, timestamps) for security and operations. We may use Google Analytics (or an equivalent) with anonymisation or pseudonymisation. Non-essential analytics cookies require your consent through the cookie banner. See also our Cookie Policy. Legal basis: Art. 6(1)(a) for non-essential cookies, and Art. 6(1)(f) for security-related technical data.

We do not sell personal data. Sharing is limited to: transaction counterparties (after the seller accepts the bid, seller and buyer receive the contact data needed for pickup and completion); delegated verification partners (limited access under contract and confidentiality); processors such as hosting, cloud, e-mail deliverability and analytics providers (under GDPR-compliant agreements); and authorities where legally required or by court order. Where providers are outside the EEA (for example Google), we use standard contractual clauses or other approved mechanisms.

Active account: for the life of the account. After account closure: 8 weeks, unless legal retention applies. Invoicing and transactions: for the periods required by tax and accounting law. Seller verification documents: 5 years after the relationship ends. Support communications: 3 years. Server logs: up to 90 days. Analytics cookies: per vendor policy, often up to about 14 months, and you can clear cookies in your browser.

You may request access, rectification, erasure, restriction and portability, object to processing, withdraw consent for consent-based processing, and lodge a complaint with a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro). You may also contact the authority in your own country.

Requests: [email protected]. We respond within one month, extendable by two further months in complex cases, with notice.

We use appropriate technical and organisational measures, including TLS, role-based access, password hashing and monitoring. Personal data breaches affecting your rights will be reported to the supervisory authority within 72 hours where required, and you will be informed if the risk is high.

See our Cookie Policy (essential versus analytics cookies, the banner and browser controls).

The platform is for businesses and adult representatives only. We do not knowingly collect data from under-18s and will delete any such data discovered.

Links may leave our site, and this policy applies only to KHADROX. We are not responsible for third-party privacy practices.

We may update this policy. Material changes will be notified by e-mail or a prominent notice on the platform at least 14 days before they take effect.

[email protected]. KHADROX, Bucharest, Romania. +40 745 940 049.