Privacy notice for professional vendors
1.0Last updated: 8 October 2026
This notice is for those who sell on Secondgear as a Professional Seller (Terms and Conditions, Section 6): companies, sole traders, associations and anyone selling in the course of a business activity. For people using the platform as private individuals, the notice for private users applies.
A company's data is not personal data; the data of the natural persons who represent or manage it (owner, legal representative, contact persons) is, as is all the data of a sole trader. This notice covers that data and is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR").
1. Who processes the data
Data controller: Agostino Moio, sole proprietorship operating the Secondgear platform
Registered address: Via Luigi Longo n. 4, 50012 Bagno a Ripoli (FI), Italy
VAT number: 06938630487
Privacy contact: [email protected] (from Italy: [email protected])
The controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply.
2. What data we process
2.1 Account and contact person data
First name, last name, email, phone, date of birth, nationality, country, language, password (stored by our authentication provider in encrypted form only). The person who opens the account is the Gear Depot's contact person towards Secondgear.
2.2 Business data
business or company name, legal form, VAT number, tax code;
registered office and the address where items are collected;
SDI recipient code or certified email (PEC) address, for Italian electronic invoicing;
whether you use your own courier instead of the platform's shipping service;
the business details you enter on your Gear Depot page to inform buyers, as required by the Terms (Section 6.5): for example registered office, company register number, contact details.
2.3 Gear Depot and sales data
Name and description of your storefront, images, listings, orders received, amounts collected, commissions, returns, refunds, reviews received and replies, messages with buyers, support tickets, sponsorship services purchased.
2.4 Payments and identity verification
To receive your proceeds, you complete identity verification and enter your bank account directly on Stripe. Secondgear only receives the outcome of the verification and the identifier of your Stripe account: it does not keep identity documents or bank details.
2.5 Technical data
IP address, browser and device, login attempts, a log of significant account operations, country of connection. For cookies, see the notice for private users, § 8: the same rules apply.
3. Why we process the data and on what legal basis
Opening and managing the account and the Gear Depot, publishing listings: Performance of a contract (Art. 6(1)(b))
Telling buyers that you are a Professional Seller and publishing the business details you enter on your Gear Depot: Legal obligation (Art. 6(1)(c)): Art. 7 of Italian Legislative Decree 70/2003 and Art. 49 of the Italian Consumer Code
Handling orders, shipments and returns, and transferring your proceeds through Stripe: Performance of a contract
Issuing the monthly invoice for commissions and sponsorship services, keeping accounts: Legal obligation
Reporting your data to the Italian Revenue Agency (DAC7, § 5): Legal obligation (Italian Legislative Decree 32/2023)
Checking that the Professional Seller status is correct (Terms, Sections 6.2-6.3): Legitimate interest (Art. 6(1)(f)) in the accuracy of the information given to buyers
Security, prevention of fraud and abuse, defence of legal claims: Legitimate interest
Automated moderation of messages (notice for private users, § 4): Performance of a contract and legitimate interest
Operational communications about the service (new features, terms, fees): Performance of a contract
Commercial communications about Secondgear services similar to those you use (for example listing sponsorship): Legitimate interest (Art. 130(4) of the Italian Privacy Code); you can object at any time, including from the link at the bottom of every email
Newsletter and promotions not related to the services you use: Consent (Art. 6(1)(a))
Featuring listings on our channels (website, social networks, Discord server): Legitimate interest in promoting the items for sale
Without the data required by the contract and the law, we cannot activate the Gear Depot as professional or transfer your proceeds.
4. Public data
Visible to anyone visiting the platform: Gear Depot name, description, images, listings, ratings and reviews, the Professional Seller status and the business details you enter on your Gear Depot page (§ 2.2). For a sole trader these may include the owner's name. The VAT number, tax code, SDI code and PEC you give us for invoicing are not published by Secondgear.
5. Tax obligations and DAC7
Every month we issue an invoice for commissions and any sponsorship services, using your business name, VAT number, tax code, registered office and SDI code or PEC. Invoices are prepared with Fatture in Cloud (TeamSystem) and sent to the Italian Revenue Agency's Exchange System (SDI).
The DAC7 rules (Directive (EU) 2021/514, Italian Legislative Decree 32/2023) require platforms to report to the Italian Revenue Agency the data of sellers who, in a year, exceed 30 sales or EUR 2,000 in consideration: business name, registered office, VAT number, tax identification number, number of sales, amounts and commissions, and for sole traders also the owner's name and date of birth. The Agency may pass them on to the tax authorities of other EU Member States. By 31 January of the following year we send you a copy of the data reported.
6. You as controller of your customers' data
When you receive an order, Secondgear sends you the buyer's name and delivery address, and you may receive further information through messaging. For this data you are an independent controller and are responsible for complying with the GDPR. In particular:
you may use it only to fulfil the order, handle returns and warranties and meet your legal obligations, for example tax obligations;
you may not use it to contact the buyer outside the platform, send them advertising or add them to your customer lists without their separate consent;
you keep it only as long as needed for those purposes, with appropriate security measures;
if you issue a tax document to the buyer (Terms, Section 6.5), the data you use to do so is processed under your responsibility.
Misuse of buyers' data also breaches the Terms (Section 11.9) and may lead to the suspension of the Gear Depot.
7. Who we share data with
We do not sell data to anyone. We share it only:
with buyers, for the public data in § 4 and as needed for each order (Gear Depot name and sender's address on the shipping label);
with providers working on our behalf (processors, Article 28 GDPR), the same listed in the notice for private users (§ 6), plus Fatture in Cloud (TeamSystem) for invoices;
with Stripe (Stripe Payments Europe, Ireland), an independent controller for payments, identity verification and its own anti-money-laundering obligations. Privacy notice: https://stripe.com/privacy
with BRT, an independent controller for carrying out shipments;
with the Italian Revenue Agency and other authorities when required by law (electronic invoicing, DAC7, requests from judicial authorities).
For transfers outside the European Union, the safeguards described in the notice for private users, § 7, apply.
8. How long we keep data
Active account and Gear Depot: For the whole duration of the relationship
Closed Gear Depot: Its content (listings, images, storefront) is deleted 30 days after closure
Invoices, orders, proceeds and accounting records: 10 years from recording (Italian Civil Code Art. 2220, Presidential Decree 600/1973 Art. 22)
Data reported for DAC7: 10 years from the end of the year it refers to
Messages and support tickets: For the life of the account, as history; anonymised when it is deleted
Login attempts: 90 days
Account operations log: 2 years
Commercial communications: Until you object or withdraw consent
When these periods expire, the data is deleted or anonymised. It may be kept longer only if needed to defend a legal claim.
9. Your rights
As a natural person you have the rights under Articles 15-22 GDPR: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest and, always, to commercial communications, withdrawal of consent. Erasure does not cover data we must keep by law (§ 8).
How to exercise them:
from your account: data export and deletion from your Profile, changes to your Gear Depot details from the seller dashboard;
for everything else, by writing to [email protected] (from Italy: [email protected]).
We reply within one month, which may be extended by two further months for complex requests. You can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.
10. Security
The measures described in the notice for private users, § 12, apply. In addition, tax data (tax code, VAT number, SDI code, PEC) is visible in the administration area only to authorised administrators, whose access is protected by two-factor authentication.
11. Changes to this notice
We may update this notice when our services or the law change. The version in force is always on this page, with the date of last update at the top. We will notify you of significant changes by email or with a notice in the seller dashboard.