1. Data Controller
The data controller for personal data is Kinkoza OÜ, a company incorporated under Estonian law, Tallinn, Estonia (registry code: 17494294). Data Protection Officer contact: [email protected].
Privacy Policy
Version 1.0 — May 2026
2. Data Collected
2.1 Identification data
- Name, surname, date of birth of legal representatives and beneficial owners
- Company registration number, VAT number
- Identity documents and supporting documents for KYC
2.2 Contact data
- Professional email address
- Professional telephone number
- Registered office address
2.3 Transactional data
- History of listings published, offers received and submitted
- Payment data (processed by the partner PSP — Kinkoza does not store card data)
- Escrow and fund release data
2.4 Technical data
- IP addresses, connection data, session cookies
- Platform usage data (pages viewed, clicks, session duration)
3. Purposes and Legal Bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Account management and KYC | Legal obligation (AML) | 5 years after closure |
| Transaction execution | Contract performance | 10 years (accounting) |
| Fraud prevention | Legitimate interest | 3 years |
| Platform improvement | Legitimate interest | 2 years |
| Marketing (opt-in) | Consent | Until withdrawal |
4. Data Recipients
Personal data may be shared with the following categories of recipients: (i) the licensed Payment Service Provider, Trustap (Cork, Ireland), operating in partnership with Stripe, for processing escrow and payment transactions, (ii) the KYC/AML provider for identity verification, (iii) competent Estonian and European authorities where legally required, (iv) technical sub-processors (hosting, analytics) bound by GDPR standard contractual clauses.
No personal data is sold to third parties. Transfers outside the European Union are governed by appropriate protection mechanisms (standard contractual clauses, adequacy decision).
5. Data Subject Rights
In accordance with Regulation (EU) 2016/679 (GDPR), you have the following rights: right of access, rectification, erasure (subject to conditions), restriction of processing, objection, data portability, and withdrawal of consent. These rights may be exercised by contacting [email protected]. You also have the right to lodge a complaint with the Estonian supervisory authority (AKI — Andmekaitse Inspektsioon, www.aki.ee).
6. Cookies
The platform uses cookies strictly necessary for operation (session, security) and analytics cookies (anonymised audience measurement). Third-party advertising cookies are not used. The full list of cookies and their purposes is available in our cookie manager accessible from each page of the platform.