PRIVACY POLICY

1. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed when you:

• visit MercadoFC;
• create or manage a MercadoFC account;
• purchase digital products or services;
• provide information required to fulfill an order;
• use the Sell Coins functionality;
• request a payout or Balance withdrawal;
• contact Customer Support;
• participate in referral or promotional programs;
• receive communications from us;
• otherwise interact with MercadoFC.

This Policy does not govern processing carried out independently by third parties under their own privacy policies.

2. Personal Data We Collect

The personal data we collect depends on how you use MercadoFC.

We only collect data that is reasonably necessary for the purposes described in this Policy.

Account and Profile Data

When you create or manage a MercadoFC account, we may collect:

• full name;
• email address;
• telephone number, where provided;
• country or region;
• preferred currency;
• gaming platform, such as PlayStation, Xbox or PC;
• MercadoFC user ID;
• account preferences;
• referral information;
• account creation and update dates.

MercadoFC account passwords are stored using appropriate cryptographic protection and are not intended to be stored in readable plain text.

3. Order and Transaction Data

When you place an order or use a transaction-related feature, we may process:

• order or transaction ID;
• product or service selected;
• quantity;
• gaming platform;
• price;
• currency;
• discounts or promotional codes;
• payment status;
• order status;
• timestamps;
• fulfillment records;
• refund information;
• payment dispute information;
• relevant communications concerning the transaction.

This information is used to manage your order and maintain an accurate transaction history.

4. Payment Data

Payments for customer purchases may be processed by third-party payment processors made available through MercadoFC.

Where card payments are processed through Stripe, Stripe may collect and process information including:

• cardholder information;
• payment card details;
• billing information;
• transaction information;
• device and authentication information;
• fraud-prevention information.

MercadoFC does not intend to receive or store complete card numbers or card security codes where those details are entered directly into the payment provider's secure environment.

We may receive limited transaction information from the payment processor, such as:

• payment transaction ID;
• payment status;
• amount;
• currency;
• card brand;
• last digits of the card;
• country associated with the payment;
• refund or dispute status;
• transaction risk information.

Payment providers may process certain personal data as independent controllers under their own privacy notices and legal obligations.

5. Sell Coins and Payout Data

If you use Sell Coins or request an eligible payout or Balance withdrawal, we may process:

• MercadoFC account information;
• gaming platform;
• quantity involved in the transaction;
• transaction value;
• transaction status;
• verification records;
• payout amount;
• selected payout method;
• payout status;
• relevant communications.

Where payment is made by bank transfer, we may process information such as:

• account holder name;
• IBAN or other necessary bank account details;
• bank or country information where required;
• currency;
• payment reference.

Where payment is made through PayPal, we may process:

• PayPal email address or account identifier;
• recipient information where required;
• payout amount;
• payout reference.

Banks and PayPal may separately process this information in accordance with their own privacy policies and legal requirements.

6. Gaming Account and Fulfillment Data

Certain MercadoFC services may require information relating to your gaming account so that we can fulfill your order.

Depending on the selected fulfillment method, this may include:

• gaming platform;
• gaming account email address;
• EA account identifier;
• information necessary to locate or identify the relevant gaming account;
• information necessary to carry out the requested digital service;
• transaction and fulfillment information.

Where a particular fulfillment method genuinely requires temporary access information, MercadoFC may also process:

• gaming account credentials;
• authentication information;
• backup or recovery codes.

We will only request such information where it is reasonably necessary for the selected fulfillment method.

Access to sensitive account-access information will be restricted to authorised personnel who require it to fulfill the relevant order.

Such information must not be included unnecessarily in:

• analytics systems;
• general application logs;
• marketing systems;
• unrelated internal communications.

Where account-access information is required only for a particular order, it will be deleted or otherwise securely removed when it is no longer reasonably necessary for fulfillment, security or resolution of an active issue.

If MercadoFC provides a feature allowing you to intentionally save gaming account information for future orders, we will clearly indicate which information is being saved and allow you to remove it where applicable.

We will never ask you to provide your online banking password or payment card PIN as part of a gaming service.

7. Customer Support Data

When you contact Customer Support, we may process:

• your name;
• email address;
• MercadoFC account details;
• order or transaction ID;
• content of your request;
• previous support communications;
• screenshots, files or other information you voluntarily provide.

Please avoid sending personal data that is not relevant to your request.

8. Technical and Device Data

When you access MercadoFC, we may automatically process certain technical information, including:

• IP address;
• browser type and version;
• operating system;
• device type;
• approximate country or region;
• date and time of access;
• session identifiers;
• login activity;
• pages or features accessed;
• technical logs;
• error and diagnostic information;
• security events.

This information helps us operate, secure and troubleshoot the Platform.

Information collected through cookies or similar technologies is described separately in our Cookie Policy.

9. Fraud Prevention and Security Data

We may process information necessary to protect users, payments and MercadoFC against fraud and abuse.

This may include:

• unusual login activity;
• failed login attempts;
• IP and device information;
• transaction patterns;
• repeated payment failures;
• payment risk indicators;
• refund and chargeback history;
• suspected account compromise;
• suspected misuse of MercadoFC.

Payment processors and security providers may also provide fraud or risk information relating to transactions.

10. Marketing Data

If you choose to receive marketing communications, we may process:

• your email address;
• marketing preferences;
• consent status;
• date and method of consent;
• interactions with communications where legally permitted.

You may unsubscribe from marketing communications at any time.

Transactional communications concerning your account, security, payments or orders are not considered marketing communications.

HOW WE USE PERSONAL DATA

11. Creating and Managing Your Account

We use account information to:

• create your MercadoFC account;
• authenticate you;
• maintain your profile;
• provide account functionality;
• communicate important account information.

Legal basis: performance of a contract or steps taken at your request before entering into a contract.

12. Processing and Fulfilling Orders

We use personal data to:

• process orders;
• identify the correct gaming account;
• perform digital fulfillment;
• communicate order updates;
• maintain fulfillment records;
• resolve order-related problems.

Legal basis: performance of a contract.

13. Processing Payments, Payouts and Withdrawals

We process relevant data to:

• confirm customer payments;
• reconcile transactions;
• issue refunds;
• process Sell Coins payouts;
• process eligible Balance withdrawals;
• investigate payment problems.

Legal basis: performance of a contract and, where applicable, compliance with legal obligations.

14. Customer Support

We process personal data to:

• answer questions;
• investigate issues;
• resolve complaints;
• assist with orders or accounts.

Legal basis: performance of a contract and our legitimate interest in providing effective Customer Support.

15. Fraud Prevention and Security

We may process relevant information to:

• prevent fraudulent payments;
• detect account compromise;
• protect users;
• prevent abuse;
• investigate suspicious transactions;
• protect MercadoFC infrastructure;
• respond to payment disputes.

Legal basis: our legitimate interests in preventing fraud, protecting our users and securing our Platform.

Where processing is required by law, the applicable legal basis may instead be compliance with a legal obligation.

16. Accounting and Legal Compliance

We process certain information where necessary to:

• maintain financial and accounting records;
• comply with tax obligations;
• comply with consumer protection requirements;
• respond to lawful requests from authorities;
• establish, exercise or defend legal claims.

Legal basis: compliance with legal obligations and, where applicable, legitimate interests relating to legal claims.

17. Platform Operation and Improvement

We may use technical and usage information to:

• maintain the Platform;
• diagnose technical problems;
• improve performance;
• detect errors;
• understand how Platform features are used;
• improve the user experience.

Legal basis: legitimate interests, where appropriate.

Where analytics involves non-essential cookies or similar technologies requiring consent, we will rely on your consent instead.

18. Marketing

Where required by law, we use your personal data for electronic marketing only with your consent.

Legal basis: consent, where required.

You may withdraw that consent at any time.

LEGAL BASES FOR PROCESSING

19. Legal Bases We Rely On

Depending on the processing activity, MercadoFC may rely on:

Performance of a Contract

Where processing is necessary to provide a service you requested or take steps before entering into a contract.

Legal Obligation

Where processing is necessary to comply with a legal requirement applicable to MercadoFC.

Legitimate Interests

Where processing is reasonably necessary for purposes such as:

• information security;
• fraud prevention;
• Platform operation;
• dispute resolution;
• protecting our legal rights.

We consider the potential impact on your rights before relying on legitimate interests.

Consent

Where you voluntarily agree to processing, such as certain:

• marketing activities;
• analytics technologies;
• advertising cookies.

Where processing is based on consent, you may withdraw it at any time.

SHARING PERSONAL DATA

20. Who We Share Data With

We do not sell your personal data.

We may share personal data where necessary with service providers and other recipients involved in operating MercadoFC.

These may include:

Payment Processors

For processing payments, authentication, refunds, fraud prevention and payment disputes.

Where enabled, this may include Stripe.

Payout Providers

Banks, PayPal and other payment institutions where necessary to make a payout requested by you.

Hosting and Infrastructure Providers

Providers used to operate:

• hosting;
• databases;
• cloud infrastructure;
• storage;
• backups;
• security services.

Email and Communication Providers

Providers used to send:

• account verification messages;
• order notifications;
• security notices;
• transactional communications.

Customer Support Providers

Where third-party software is used to manage support requests.

Analytics Providers

Where analytics services are enabled and the applicable consent requirements have been satisfied.

Professional Advisers

Where necessary, we may share relevant information with:

• accountants;
• lawyers;
• auditors;
• tax advisers.

Public Authorities

We may disclose information where required or permitted by applicable law, including to:

• courts;
• tax authorities;
• law enforcement authorities;
• consumer protection authorities;
• data protection authorities.

21. Data Processors

Where another company processes personal data solely on our behalf, we require appropriate contractual and security obligations consistent with applicable data protection law.

Certain third parties, including payment providers and financial institutions, may act independently as data controllers for some of their activities.

Their independent processing is governed by their own privacy policies.

INTERNATIONAL DATA TRANSFERS

22. Transfers Outside the EEA

MercadoFC may use service providers that process or access personal data from countries outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, we will use an appropriate safeguard or legal transfer mechanism where required.

Depending on the circumstances, this may include:

• a European Commission adequacy decision;
• Standard Contractual Clauses approved by the European Commission;
• another transfer mechanism permitted under applicable data protection law.

Where appropriate, supplementary technical, organisational or contractual measures may also be applied.

You may contact us if you would like more information about the safeguards used for a particular international transfer.

DATA RETENTION

23. How Long We Keep Personal Data

MercadoFC retains personal data only for as long as reasonably necessary for the purpose for which it was collected or where retention is required by law.

Retention periods may also depend on:

• whether your account remains active;
• whether a transaction remains open;
• accounting or tax requirements;
• fraud prevention requirements;
• applicable limitation periods;
• ongoing disputes or investigations;
• legal obligations.

Our general retention approach is described below.

24. Account Data

Account and profile information is generally retained while your MercadoFC account remains active.

After account closure, limited information may continue to be retained where reasonably necessary for:

• legal claims;
• fraud prevention;
• transaction records;
• compliance obligations.

Information that is no longer required will be deleted or anonymised.

25. Order and Financial Records

Order, payment, payout and financial records may be retained for the period required by applicable accounting, tax and legal obligations.

Where records qualify as accounting documents under Romanian law, they will generally be retained for the applicable statutory period.

Operational information that is not subject to a legal retention requirement may be deleted earlier when it is no longer required.

26. Gaming Account Information

Gaming account information used exclusively to fulfill an order will be retained only for as long as reasonably necessary to:

• perform the order;
• verify completion;
• resolve an active fulfillment issue;
• investigate an applicable security incident.

Credentials, authentication information or backup codes should be removed as soon as they are no longer reasonably necessary.

Where you intentionally use a feature that saves gaming account information for future orders, the relevant information may be retained until:

• you remove the saved account;
• you request deletion;
• your MercadoFC account is closed; or
• retention is no longer necessary or lawful.

27. Support Communications

Customer Support records may be retained for as long as reasonably necessary to:

• resolve the request;
• maintain appropriate service history;
• handle disputes;
• establish or defend legal claims.

Routine support data that is no longer required may be deleted earlier.

28. Security Records

Security and technical logs may be retained for a limited period necessary for:

• security monitoring;
• fraud detection;
• troubleshooting;
• investigation of incidents.

Relevant records may be retained longer where they relate to an active security incident, transaction dispute or legal claim.

29. Marketing Data

Marketing data is retained until:

• you withdraw consent;
• you unsubscribe;
• the information is no longer necessary for the relevant marketing purpose.

We may retain limited evidence of an opt-out or withdrawn consent where necessary to demonstrate compliance and ensure that your preference continues to be respected.

30. Deletion and Anonymisation

When personal data is no longer required, we may:

• securely delete it;
• anonymise it;
• restrict it pending deletion;
• securely destroy it.

Information may temporarily remain in secure backups until those backups are overwritten according to the applicable backup cycle.

DATA SECURITY

31. Security Measures

MercadoFC applies technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• alteration;
• disclosure;
• misuse;
• destruction.

Depending on the type of data, these measures may include:

• encrypted connections;
• encryption of appropriate stored data;
• password hashing;
• access controls;
• role-based permissions;
• authentication controls;
• logging and monitoring;
• secure backups;
• restricted administrative access;
• security updates;
• incident response procedures.

No online system can be guaranteed to be completely secure.

32. Access to Personal Data

Access to personal data is limited to authorised persons who require the information for legitimate business purposes.

Particularly sensitive account-access information should only be accessible to personnel who require it for fulfillment or security purposes.

33. Personal Data Breaches

If a personal data breach occurs, MercadoFC will investigate the incident and take appropriate measures.

Where legally required, MercadoFC will notify the competent data protection authority and affected individuals in accordance with applicable law.

AUTOMATED PROCESSING

34. Fraud Detection and Automated Risk Indicators

MercadoFC and its service providers may use automated systems or risk indicators to detect:

• potentially fraudulent transactions;
• suspicious account activity;
• unusual payment behaviour;
• security threats.

Payment providers may independently generate transaction risk assessments.

Where MercadoFC makes a decision based solely on automated processing that produces legal effects or similarly significantly affects an individual, we will provide the safeguards required by applicable data protection law.

YOUR GDPR RIGHTS

35. Your Rights

Subject to the conditions and exceptions provided by applicable law, you have rights concerning your personal data.

Right of Access

You may ask whether MercadoFC processes your personal data and request access to that data.

Right to Rectification

You may request correction of inaccurate or incomplete personal data.

Right to Erasure

You may request deletion of personal data where the legal conditions for erasure are satisfied.

This right is not absolute. For example, certain transaction records may need to be retained because of legal obligations.

Right to Restriction of Processing

You may request that certain processing be restricted in circumstances provided by law.

Right to Data Portability

Where applicable, you may request personal data that you provided to us in a structured, commonly used and machine-readable format.

You may also request transmission to another controller where legally and technically applicable.

Right to Object

Where we process personal data based on legitimate interests, you may object based on your particular circumstances.

You may object to direct marketing at any time.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

Rights Relating to Automated Decision-Making

Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

36. Exercising Your Rights

To exercise a privacy right, contact:

[PRIVACY EMAIL]

Please describe your request and provide enough information for us to identify your account or relevant data.

We may request reasonable information to verify your identity before fulfilling a request.

We will respond within the period required by applicable data protection law, normally within one month of receiving a valid request.

Where legally permitted because of the complexity or number of requests, this period may be extended. You will be informed where an extension applies.

37. Account Deletion

You may request deletion of your MercadoFC account through any account deletion functionality made available on the Platform or by contacting us.

Deleting an account does not necessarily require MercadoFC to immediately delete information that we must retain for:

• accounting;
• tax;
• legal compliance;
• active disputes;
• fraud prevention;
• legal claims.

Any remaining data will be removed or anonymised once there is no longer a lawful reason to retain it.

COMPLAINTS

38. Data Protection Complaints

If you believe MercadoFC has processed your personal data incorrectly, you may contact us at:

[PRIVACY EMAIL]

You also have the right to lodge a complaint with a competent data protection supervisory authority.

For MercadoFC's Romanian operator, the supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP).

If you reside in another EU or EEA country, you may also have the right to contact the competent supervisory authority in your country.

CHILDREN

39. Children's Privacy

MercadoFC is intended for users who meet the eligibility requirements established in our Terms & Conditions.

We do not intentionally seek to collect personal data from children who are not legally permitted to use the relevant Services.

If we become aware that personal data has been collected unlawfully from a child, we will take appropriate steps to delete or otherwise lawfully handle that information.

THIRD-PARTY SERVICES

40. Third-Party Websites and Services

MercadoFC may contain links to or integrations with independent third-party services.

Their processing of personal data is governed by their own privacy policies.

MercadoFC is not responsible for the independent privacy practices of unrelated third parties.

CHANGES TO THIS POLICY

41. Changes to the Privacy Policy

We may update this Privacy Policy to reflect:

• changes to MercadoFC;
• new functionality;
• changes to service providers;
• changes to our data processing activities;
• security requirements;
• changes in applicable law.

The current version will always display the date on which it was last updated.

Where required by law, we will provide additional notice of material changes.

42. Contact

For questions about this Privacy Policy or the processing of your personal data, contact:

DASHPLAY SRL, trading as MercadoFC Privacy email: [PRIVACY EMAIL]

Full company information is available in our Terms & Conditions.