1. Who is responsible for your data
Dexicon, a sole proprietorship (eenmanszaak) established in the Netherlands, is the controller for the processing described here (art. 4(7) GDPR).
- Chamber of Commerce (KvK) number: to be added on registration with the Dutch Chamber of Commerce (scheduled 18 September 2026); until then Dexicon operates in early access and is reachable at the addresses below
- Business address: to be added on registration with the Dutch Chamber of Commerce (scheduled 18 September 2026); until then please write to the addresses below
- Contact for anything about your data: support@dexicon.app — the same address as everywhere else in Dexicon, because it is the one we actually read (ToS §1)
Your data is stored inside the EU. We have not appointed a data protection officer: Dexicon's core activity is not large-scale monitoring or large-scale processing of special categories of data, so art. 37 GDPR does not require one. We are established in the Netherlands, so no EU representative under art. 27 GDPR is needed. If either of those changes, this section changes with it.
2. What we collect
| Category | What it is |
|---|---|
| Account | e-mail address, display name, handle, date of birth, country, avatar, language, how you sign in (e-mail, or a provider such as Google), your device sessions |
| Collection | cards, products, binders, wishlist, scans, notes, the purchase prices you enter, photos you add |
| Marketplace | listings and their photos, offers and bids, deals (agreed price, fees, status, milestones), the order administration including the Payment fee, payout records with a masked IBAN (last 3 digits only), shipping references and tracking events, chat messages, reviews, reports and dispute evidence |
| Verification | the result of seller verification carried out by Mollie (passed / not passed, and the date) plus your verification status and two reference identifiers. Identity documents, facial scans and bank details are captured and processed by Mollie in its own secured environment — Dexicon never receives or stores them |
| Tax (DAC7) | once you cross the reporting threshold (30 sales or €2,000 in a calendar year): name, address, date of birth, tax identification number (the BSN for residents of the Netherlands), the number of sales and the amounts paid out |
| Device & logs | app version, device type, IP address, crash logs and security logs (sign-in attempts, session events, abuse signals) |
| Consent log | which version of which document you accepted, when, and through which screen |
| Optional, with your consent | usage analytics events (which screens you open, which features you use) — no advertising identifiers |
Payment details — card numbers, full bank account numbers — stay with Mollie. Dexicon never sees or stores them.
Where data comes from that you did not give us directly (art. 14 GDPR): the verification result comes from Mollie, tracking events come from the shipping broker and the carrier, payment statuses come from Mollie, and reports about you can come from other users.
What you have to give us. Your e-mail address and date of birth are necessary to have an account at all — without them we cannot provide the service. The DAC7 details are a legal requirement once you cross the threshold; without them the law obliges us to pause your payouts. Everything else is optional and refusing it costs you nothing but the feature itself.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (art. 6 GDPR) | Your control |
|---|---|---|
| Account, collection sync, marketplace, chat, and transactional e-mail/push about offers, payments, shipping, disputes and security | Contract — 6(1)(b) | No toggle: this is the service itself |
| Seller verification before your first active listing | Contract — 6(1)(b) for us, because we cannot let you sell without it. For Mollie it is also a legal obligation under the Dutch anti-money-laundering act (Wwft) | Required to sell; not required to buy or to collect |
| DAC7 reporting to the Dutch tax administration | Legal obligation — 6(1)(c), Directive (EU) 2021/514 as implemented in Dutch tax law. The BSN is processed on the statutory basis of art. 46 UAVG | Required once you cross the threshold; without the data, payouts pause and your balance stays visible and yours |
| Keeping transaction, fee and payout records | Legal obligation — fiscal retention, art. 52 AWR | None — statutory |
| Fraud prevention, moderation, dispute handling, platform safety and notice-and-action under the DSA | Legitimate interest — 6(1)(f): keeping a marketplace between strangers safe. We weighed this against your privacy and limited it to the data the check actually needs | No toggle; you can object at support@dexicon.app and we will look at your situation |
| Marketing e-mails (new sets, big movers, year recap) | Consent — 6(1)(a) | Opt-in, off by default, never bundled with creating an account, withdrawable per toggle |
| Usage analytics | Consent — 6(1)(a) and the ePrivacy rules | Opt-in, off by default, toggle in Settings → Privacy & data |
| Personalised recommendations | Runs on your device; no data leaves it | Preference toggle, off by default |
| Price and wishlist alerts | Contract — a service you set up yourself | Ordinary notification toggles |
Every optional purpose is off by default, and forced off for users under 16.
Withdrawing consent is as easy as giving it, and it does not affect what we lawfully did before you withdrew it.
4. Automated decisions
We do not take decisions solely by automated means that produce legal effects for you or similarly significantly affect you (art. 22 GDPR).
Automated checks do exist — fraud signals, duplicate-account detection, listing checks, an automatic release of held money when a check window passes without a report. They flag, schedule or execute what the rules in the Marketplace & Trading Rules already say. Every sanction and every dispute decision is taken by a human, comes with a statement of reasons, and can be appealed to a different human (ToS §12).
5. Who we share data with
- Mollie B.V. (Amsterdam, licensed payment service provider) — processes all payments, holds the escrowed funds, performs seller verification and handles chargebacks. For its own regulatory duties Mollie is an independent controller. Identity documents never pass through Dexicon.
- Cloudflare (hosting, database, file storage, CDN and edge) — the app and its data run on Cloudflare's EU infrastructure under a data processing agreement. Where any processing outside the EEA cannot be avoided, it relies on the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
- Resend (transactional e-mail) — sends account and deal e-mails. It receives your e-mail address and the content of the message.
- MyParcel (shipping broker) and the carrier that actually moves the parcel (PostNL) — to make a label and follow the parcel we pass the recipient's name and delivery address. The seller never sees the buyer's address in chat; it appears only on the label.
- Push services (Apple, Google, Mozilla) — if you switch push notifications on, the notification is delivered through the push service of your browser or operating system.
- The app stores (Apple, Google) — only for in-app purchases of Dexicon Pro; they are the seller there and process the payment under their own privacy policies.
- Dexicon administration — the platform operator sees reported content, dispute evidence and the admin queues needed to run the service.
- The Dutch tax administration (Belastingdienst) — the annual DAC7 report, where the law requires it.
- Authorities — only where the law obliges us, and only what it obliges us to hand over.
We never sell personal data and there is no third-party advertising in Dexicon.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and collection data | Until you delete your account, plus the 30-day grace period; then permanently deleted |
| Deal records, order administration and the chat belonging to a deal | 2 years after the deal ends — dispute handling, fraud prevention, buyer protection |
| Fee, payout and other fiscal records | 7 years — Dutch fiscal retention obligation (art. 52 AWR) |
| DAC7 report data | 7 years, on the same fiscal retention obligation |
| Reports, moderation records and dispute evidence, including photos | 2 years |
| Consent log | As long as the account exists, plus 5 years afterwards, to be able to show what you agreed to |
| Crash logs | 90 days |
| Security logs (sign-in attempts, abuse signals) | 12 months |
| Analytics, if you switched it on | 14 months, then only in aggregated form |
When you delete your account everything is erased after the grace period except the records above that we must keep by law. Those are kept apart, used for nothing else, and deleted when their term ends.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time. Most of it is self-service:
- Download my data (Settings → Privacy & data) — one complete, machine-readable export of what Dexicon holds about you.
- Delete my account (Settings → Privacy & data) — 30-day grace period; see ToS §5. Closing is blocked while a deal is running, and the app shows which one.
- Deleting without the app. You never need the app to get your account removed. The same screen is on the web at dexicon.app/settings/privacy, and a message to support@dexicon.app from the address on the account works just as well. We confirm when it is done, and we tell you which records the law makes us keep and for how long (§6).
- Consent toggles per purpose in Privacy & data.
For anything else, write to support@dexicon.app. We answer a request about your rights within one month; if a request is unusually complex we may extend that by two months and we will tell you why within the first month (art. 12(3) GDPR). Exercising these rights is free.
8. Children
Anyone can use the collection tools. The marketplace, chat and community require you to be 16 or older — the age the Netherlands set under art. 8 GDPR. We do not knowingly process marketplace, chat or community data of anyone younger, and every consent-based purpose is disabled below 16. The date of birth given at sign-up controls this and can only be corrected through support. A parent or legal guardian can write to support@dexicon.app to review, export or delete a child's account.
9. Security
Encryption in transit and at rest, access control, EU data centres, session management with per-device sign-out, and breach notification to the Autoriteit Persoonsgegevens and to you as required by art. 33 and 34 GDPR.
10. International transfers
Processing takes place in the EU/EEA. Where an exception cannot be avoided (see §5), it relies on an adequacy decision or on the EU Standard Contractual Clauses, with additional measures where those are needed.
11. Complaints
Write to support@dexicon.app first — it is usually the fastest route. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority of the EU country where you live, and to go to court.
12. Changes
The version number and the date at the top always reflect the text that applies. A material change is announced in the app and asks you to confirm it before it applies to you.