Last updated in September 2020. Please find the previous version of your Privacy Statement here.
We care about your privacy and are committed to protecting your personal data. This privacy statement will inform you how we handle your personal data, your privacy rights and how the law protects you. Please read this privacy statement carefully before using our Services.
- Who are we? 2
- What data do we collect about you? 2
- Do we collect data from children? 6
- Why do we process your personal information? 6
- How will we inform you about changes in our privacy statement? 11
- Your rights 11
- Communication and Marketing 12
- Who do we share your data with? 13
- International transfers 14
- Where do we store your data and for how long? 16
- Technical and organisational measures and processing security 17
- Links to third-party websites 18
- Contact 18
- Data Protection Authority 18
This privacy statement applies to your use of any products, services, content, features, technologies, or functions, and all related websites, mobile apps, mobile sites or other online properties or applications offered to you by us (collectively the "Services").
Who are we?
The local data controller who processes your personal data is: Tradus B.V., a company incorporated and registered in the Netherlands with company number 61818534, whose registered office is at Wibautstraat 137-C, 1097 DN Amsterdam, the Netherlands.
What data do we collect about you?
- Data provided through direct interactions
Registration and other account information
When you register to use our Services we may collect the following information about you:
- if you register directly on our platform you will be asked to provide your email address;
- if you register using your Google account: first name, last name and email address and the URL to your Google profile picture;
- if you register using your Facebook account: first name and last name as appeared on your Facebook account, the email address related to your Facebook account, your Facebook ID and the URL to your Facebook profile picture. In the event you have provided permission to Facebook through their in-app privacy option (which appears just before you register to our Services), we may collect your gender, age or email id depending on the permissions granted by you; and
Depending on the choices you make during the log-in to our Services or during the process of engaging our Services, you may opt to give the following additional personal data:
- your name;
- e-mail address;
- mobile number;
- preferred language;
- your city and country.
- your credit card details (card holder name, card expiry date, credit card type and the last four digits of your credit card number);
- your mobile number;
- your email address.
- On the landing page of your account, you may choose to provide us with certain additional information related to your business needs and buying preferences as a buyer including:
- vehicle of your interest;
- your additional spoken language;
You can provide the information about your business needs and buying preferences on a voluntary basis. If you do not choose to provide this information you will still be able to use our Services.
Taking part in our user surveys
We might occasionally provide you with our user surveys in order to measure your overall satisfaction with the quality of our Services. For this purpose, we will only use a session long (this is a random identifier assigned to you when you are downloading our mobile app or visit our website). Furthermore, you may choose to provide us with your contact details such as your email and your mobile number upon our request to contact you and invite you to attend one of our user experience (UX) tests or an interview with our team. Please be aware that the information you give us in relation to our survey questions may occasionally contain personal data as voluntarily provided by you in your answers.
- Data we collect automatically when you use our Services
When you use our Services, we automatically collect the following information about you:
- We collect device-specific information such as operating system version, unique identifiers. For example, the name of the mobile network that you are using, your IP address, your device language settings, device brand and type, device operating system and version, browser type and version, and device specific software information such as fonts, system and browser timezone, available video and audio formats. If you are logged in, we associate the device identifiers with your OLX account.
- Depending on your device permissions, if you post an item on our Services, we automatically collect and process information about your actual location. We use various technologies to determine location, including IP address, GPS, Wi-Fi access points and mobile towers. Your location data allows you to see user items near you and helps you in posting items within your location. In case we need your location data we will first show you a pop-up which will ask you to choose to allow or not to allow us to access your location data, on your mobile device. If you do not allow us to have access to your location data, you will still be able to use our Services but with limited functionality. If you do allow us to access your location data you can always change this later by going to the settings on our website or mobile app and disable the permissions related to location sharing. To find out more on the purposes of using your location data and the way such data are processed, please be referred to Section 4.2 (ii) of this Privacy Statement.
Client and Log data
- Technical details, including the Internet Protocol (IP) address of your device, time zone and operating system. We will also store your login information (registration date, date of last password change, date of last successful login), type and version of your browser.
- We collect information about your activity on our Services which includes the sites from which you accessed our Services, date and time stamp of each visit, searches you have performed, ad listings or advertisement banners you clicked, your interaction with such advertisements or ad listings, duration of your visit and the order in which you visit the content on our Services.
Cookies and Similar Technologies
- Data from third parties or publicly available sources
We receive personal data about you from various third parties and public sources which we may combine or connect to the personal data we collect from you through our Services. In particular, this includes the following information:
- if you register using your Google account: we receive the email address connected to your Google account (to create your OLX account and to send you system notifications and marketing messages), your Google ID an your full name (used as your user name when you are using our Services) and the URL to your profile picture (to create the profile picture of your OLX account)
- if you register using your Facebook account: we receive the email address connected to your Facebook account (to create your OLX account and to send you system notifications and marketing messages) and your public profile information including your Facebook ID, first name and last name (used as your user name when you are using our Services) and the URL to your Facebook profile picture (to create your OLX account profile picture);
- Certain technical and usage information from analytics providers, such as Google Analytics 360, for statistical purposes and to analyze the usage of our Services, to improve our Services, and for online marketing (more on this in Section 8);
- Push/SMS notifications from providers such as Pushcrew, Sendgrid;
- Browsing and conversion data from advertising networks such as Doubleclick for Publishers, Adsense, Criteo, Facebook, Google; and
- Seller and listing information from our corporate affiliates.
Do we collect data from children?
Our Services are not intended for children under 16 and we do not knowingly collect data from anyone under 16. If we become aware that a person under 16 has provided us with personal data, we will delete it immediately.
Why do we process your personal information?
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter into or have entered into with you.
- Where it is necessary for our legitimate interests and we believe that our legitimate interests are not overridden by your or other data subjects’ interests or fundamental rights and freedoms, for example to improve our Services and to make our Services safe and secure.
- Where we need to comply with a legal or regulatory obligation.
In certain circumstances, we may also process your personal data based on your consent. If we do this, we will let you know the purpose and the category of personal data to be processed at the time we seek your consent.
We have set out below a description of the reasons for which we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
- For providing access and delivering Services
- If you log in using your mobile number or email ID, we use your first name and last name, mobile number and/or e-mail address to identify you as a user and provide access to our Services.
- We use third party payment service providers to process any payment you make for our Services. Depending on the method of payment, you may be requested to provide us with your payment and credit card details which we will then provide to the payment service provider in order to process your payment. We do not store your credit card information, unless you choose the option to save such information in order to make recurring payments easier without having to re-enter your details each time. In such cases, we only store your card holder name, the card expiry date, your card type and the last four digits of the card number. We do not store any credit card code verification values and merely forward such values and your credit card number in an encrypted manner for the purpose of processing your payment by our payment service provider.
We process the above information for adequate performance of our contract with you.
- For improving your experience of our Services
- We use clickstream data to:
- offer you tailored content, such as giving you more relevant search results when using our Services.
- to determine how much time you spend on our Services and in what manner you navigate through our Services in order to understand your interests and to improve our Services based on this data. For example, we may provide you with suggestions on content that you can visit based on the contents you have clicked.
- If you choose to provide us with your location data, we use your location data for the following purposes:
- to compile anonymous and aggregated information about the characteristics and behaviour of OLX users, including for the purposes of business analysis, segmentation and development of anonymous profiles.
- With the help of your account contact information which includes your email and your mobile number, we map the different devices (such as desktop, mobile, tablets) used by you to access our Services. This allows us to associate your activity on our Services across devices and helps us in providing you a seamless experience no matter which device you use.
- If you have chosen to provide us with information about your business needs and buying preferences as a buyer on our Services, we will display such information together with your contact details to the sellers using our Services whenever you send a seller a message about a certain listing as an interested buyer. We process this information based on our legitimate interest in creating a better customer experience as we will be able to show more interesting listings to buyers and to create a higher lead reply for sellers and enhance our Services. If you have provided us with this information but you no longer wish to share this information with us and sellers using our Services, you may opt-out at any time by contacting us through our Contact Form.
- We use the images you upload, the descriptions and prices you provide in your ad listings to train machine learning models to personalize search results in relation to ad ranking and user interest, to improve the identification and presentation of ad items, to improve the search function and to increase the likelihood of a successful sale. This helps us to improve our Services and to provide you with a better user experience.
- To show and recommend ad listings on our Services that may be of interest to you, we make use of algorithms that use information related to your browsing behaviour, items you bought, clickstream data, your user ID and your location data if you have given us permission to use this. We use this form of automated decision-making on the basis of our legitimate interest in improving our Services and provide a better user experience by offering you more relevant ad listings.
- We access and analyze your messages with other users conducted through the communication function on our Platform for product enhancement and to provide you with a better user experience (e.g. to identify sold items and to provide you with active listings only or to upgrade user communication). Therefore we develop and train machine learning models and algorithms to automatically analyze your communication content. To build and train our machine learning models our machine learning specialists may review exemplary communication content manually. In these circumstances highly restricted access rights apply to selected machine learning specialists analyzing the communication content. During this analyzation process, we are de-identifying communication content as much as possible by applying a scanning filter to detect and hide personal data such as names, phone numbers, e-mail addresses. However, there may still be cases beyond our control in which the communication content may show certain personal data that you have chosen to provide.
- By using your session long (a random identifier assigned to you when you are downloading our mobile app or visit our website), we will occasionally provide you with user surveys meant to determine your satisfaction with the quality of our Services. When providing you with a survey, we may also request your email or mobile number in order to contact and invite you to attend one of our user experience (UX) tests or an interview with our team.
We process the above information for adequate performance of our contract with you and on the basis of our legitimate interest to improve your experience of our Services.
- To provide you safe and secure Services
- We use your mobile number, log data and unique device identifiers to administer and protect our Services (including troubleshooting, data analysis, testing, fraud prevention, system maintenance, support, reporting and hosting of data).
- We access and analyze your chat messages with other users conducted through the communication function on our Platform for customer satisfaction, safety and for fraud prevention purposes (e.g. to block spam or abusive messages that may have been sent to you by other users). Therefore we develop and train machine learning models and algorithms helping us to automatically detect and prevent inappropriate and fraudulent user behaviour. Only in limited cases and circumstances our customer safety and security specialists review communication content manually. In these circumstances highly restricted access rights apply to selected customer safety and security specialists analyzing the communication content. During the analyzation process, we are de-identifying communication content as much as possible by anonymizing the unique identification values assigned to users. However, there may still be cases beyond our control in which the communication content may show certain personal data that you have chosen to provide.
- To prevent and detect fraud on our Services, we make use of algorithms that recognize suspicious or fraudulent user behaviour based on certain information such as user activity and posted content, which may lead to us banning certain user accounts. Automated banning happens when there is a very high degree of certainty that an account or action is fraudulent. Otherwise human review takes place by selected customer safety and security specialists on the basis of highly restrictive access rights. We use this form of automated decision-making on the basis of our legitimate interest to detect and prevent fraud and to keep our Services safe and secure for our users. If you think that your account was wrongfully banned, you can contact us through our Contact Form in which case our team will review the decision to ban your account.
- We collect certain information from and in relation to the electronic device from which you are accessing our Services on the basis of our legitimate interest in preventing fraud on our Services. The information we collect includes your user ID (depending on whether you are logged in), OLX country domain, IP address, device language settings, device brand and type, device operating system and version, browser type and version, and device specific software information such as fonts, system and browser timezone, available video and audio formats. The device related information is used to determine whether the same device is being used when users interact with our Services. We associate such information with a user fraud score on the basis of which we may ban certain users. For more information on this please be referred to our Policy for Cookies and Similar Technologies. If you think that your account was wrongfully banned, you can contact us through our Contact Form in which case our team will review the decision to ban your account.
We process the above information for adequate performance of our contract with you and on the basis of our legitimate interest in preventing fraud and in improving the overall quality and effectiveness of our Services.
- To promote and offer you Services that may be of your interest
- We use your email address and mobile number (by SMS) to make suggestions and recommendations to you about our Services that may be of interest to you.
- To send you communications via email to make suggestions and recommendations to you about ad listings or about our Services, we make use of algorithms that use information based on your clickstream data. We will always provide you with the possibility to opt-out of such communications by including a link to unsubscribe. We use this form of automated decision-making on the basis of our legitimate interest in improving our Services, increase the number of transactions on our Services and provide a better user experience by offering you more relevant ad ad listings.
iii. We use clickstream data to monitor and report the effectiveness of the campaign delivery to our business partners and for internal business analysis.
We process the above information on the basis of our legitimate interest in undertaking marketing activities to offer you Services that may be of your interest. Specifically, you may receive certain marketing communications from us:
- by any preferred means of communication, if you have requested such information from us;
- by email, regarding similar products and services, if you already use our Services or acquired some of our products;
- by phone or email, if you provided us with your details when you entered a competition; or
- by phone or email, if you registered for a promotion.
You can ask us to stop sending you such marketing communication at any time by clicking on the opt-out link in the email sent to you or by changing your notification settings in your account.
In other cases than those mentioned above, we will only use your email and mobile number to send you direct marketing communications (by way of email, push notifications, SMS or phone calls) if you have given us your consent to do so by ticking the relevant box when registering on our Services. You may always change your mind and withdraw your consent in the notification settings of your OLX account.
In case you have problems changing your notification settings please contact us using our Contact Form.
How will we inform you about changes in our privacy statement?
We may amend and update this privacy statement from time to time. We will notify you of material changes to this privacy statement as appropriate under the circumstances and as required by applicable laws, e.g. by placing a prominent notice within our Services or by sending you a message via our Services or by sending you an email. If you do not agree with the way we are processing your personal data and the choices we are providing to you, you may close your account at any time by going into your account settings and select delete account.
Under certain circumstances, you have rights under data protection laws in relation to your personal data. If you wish to exercise any of the rights set out below, please go to your account/privacy settings or contact us using our Help Center:
- Right to request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Right to request correction of any of the data we have about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
- Right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Please note that for certain purposes we may be legally obligated to retain your data. Please also see section 10.
- Right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. You can exercise your right to object in the following ways, depending on the processing activity you would like us to cease:
- for marketing emails, click on the unsubscribe link in our emails;
- for marketing SMS, push notifications or phone calls, change your notification settings in your account to opt-out;
- for cookies, click on “opt-out” in our consent management platform, and;
- for any objection to processing your data in general, you can contact us through the Contact Form.
- Right to request for the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
- Right to withdraw your consent to the processing of your personal data at any time. This does not affect the legality of any processing we have already carried out based on the consent given previously.
Usually no fee required: You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
Time limit to respond: We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.
In addition, you have the right to make a complaint at any time to the data protection authority responsible for you as outlined in section 13.
However, before you make a complaint to the data protection authority, we would appreciate the chance to deal with your concerns in the first instance, please reach out to our Privacy Office using our Contact Form.
We will communicate with you by email, SMS or in app notification in connection with our Services to validate your account with us, to inform you in case your ad listing has become live/expired and for other transactional messages in relation to our Services. As it is imperative for us to provide you with such transactional messages you may not be able to opt -out of such messages.
Who do we share your data with?
We may have to share your personal data with the parties set out below for the purposes set out in section 4 above.
Third-Party Service Providers: We use third-party service providers to help us deliver certain aspects of our Services and to maintain and monitor our Services. In this context, your personal data may be shared with the following recipients, or categories of recipients:
- payment service providers, such as Stripe, Inc., PayPal, Inc. may receive depending on payment method and flow: card holder name, card holder email address, credit card expiry date, credit card CVC. for the purpose of processing payments you wish to make through our Services;
- cloud service providers, such as Amazon web Services, Inc., Google Cloud, who may receive all your shared personal data with Tradus for the purpose of running our platform;
- integrated third party tool providers, such as Google Ireland Limited (Google Maps), who may receive geolocation data for the purpose of enabling search by location on the platform;
- customer support tool providers, such as Zendesk, Inc., who may receive user account details: name, email address, phone number, address, customer service requests, message contents for the purpose of communication with and support of our customers; and
- marketing communication service providers, such as Google Ireland Limited (Google Ads) and Facebook Ireland Limited (Facebook Ads), who may receive email address and phone number for the purpose of providing tailored marketing communications.
These third-party service providers may be located inside or outside of the EEA.
We conduct checks on our third-party service providers and require them to respect the security of your personal data and to treat it in accordance with the law. We do not allow them to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Advertising and analytics providers: In order to improve our Services, we will sometimes share your information with analytics providers, such as Google Analytics 360, that (i) help us analyse how people are using our Services, in order to improve our Services and (ii) assist us in online marketing and interest-based advertising. For the most part, we share your information with them in non-identifiable form for monitoring and reporting the effectiveness of the campaign delivery to our business partners and for internal business analysis. This information will typically include a cookie ID, a (shortened) IP address, the referral URL as well as browser and device information. Through the analysis of your browsing behaviour on our Services via cookies with the help of analytics providers, we are able to better understand the use of our Services and improve our product and we will be able to show you more relevant OLX advertisements when you visit other websites. For advertising purposes, we partner with advertising providers that are organised under the Interactive Advertising Bureau (IAB) and are listed here: https://iabeurope.eu/vendor-list/. We may share with our advertising partners your cookie ID (first and third party cookies) which enables us to show you more relevant third party advertisements on our Services based on your browsing behaviour outside our Services. For further details about our advertisers and analytics providers please refer to our Policy for Cookies and similar Technologies.
OLX Group Companies: We will sometimes share your information with other “OLX Group Companies” meaning the legal entities or subsidiaries directly or indirectly controlled by OLX Global B.V., where OLX Global B.V. owns more than 50% of the voting rights or has the right to control the entity (altogether the “OLX Group”). The OLX Group consists of entities and subsidiaries across the globe. Many of these subsidiaries are providing a great variety of classifieds Services to you in many different countries. You can see all our classifieds brands under which we are providing our Services at https://www.olxgroup.com/brands. For certain business operations we are leveraging our global experience by using shared resources within the various subsidiaries to provide the best possible Services to you including product enhancements, customer support, security and safety and business intelligence activities. This means that we may need to share your personal data within the OLX Group Companies, which are located within as well as outside the European Economic Area (“EEA”).
Any sharing of personal data between OLX Group Companies will always be subject safeguards as described in section 9 which we have manifested in an internal data transfer agreement between all OLX Group Companies. Such agreement clearly defines the rights and obligations for all OLX Group Companies to ensure appropriate technical and organisational measures to protect your personal data.
Mergers and Acquisitions: If (part of) our business or our assets are reorganised, sold, transferred or merged with another business, your personal data will be disclosed and transferred to the new owners of the business. In such cases we will take all actions required by law which may include to notify you and provide you with a choice as to whether or not you wish to continue using our Services.
Law enforcement authorities, regulators and others: We may disclose your personal data to law enforcement authorities, regulators, governmental or public bodies and other relevant third parties to comply with any legal or regulatory requirements.
Publicly available information: When you post an item for sale using our Services, you may choose to make certain personal information visible to other OLX users. This may include your first name, last name, your email address, your location and your contact number. Please note, any information you provide to other users can always be shared by them with others so please exercise discretion in this respect.
Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
- Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
You can receive the copy of relevant and implemented safeguards by contacting us using our Contact Form.
Where do we store your data and for how long?
The data we collect about you will be stored and processed inside as well as outside the EEA in secure servers in order to provide the best possible user experience. For example for a fast website or mobile application build up. The data of OLX users in the EEA are stored on cloud servers provided by Amazon Web Services, Inc. which are located in Dublin, Ireland.
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, tax and accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
We keep the personal data related to your account for as long as you are a registered user or until you delete your account, in which case we will ensure that your data is deleted without undue delay and as soon as technically feasible. Depending on the Service you used and the systems your data is stored the deletion of your data may take a maximum period of 3 months from the date of your request. During this period all access to your data will be restricted or blocked immediately.
Once your account has been closed we may retain certain data to the extent that this is necessary (i) to fulfill our legal obligations such as for tax, accounting and auditing purposes or (ii) to settle a legal claim or dispute or to comply with an authority request e.g. in relation to law enforcement. We will keep only the data that are relevant for such purposes and delete such data once the applicable retention or statutory limitation periods have expired or once the respective legal purpose has been fulfilled.
For the purposes of customer safety and security and fraud prevention we may keep certain data related to your closed account, such as your ad listings, your IP address, moderation information and user experience information, for a maximum period of 14 months after closure.
Personal data related to cookies are stored for the period corresponding to the life cycle of the cookie type, or until deleted by you. You can read more about this in our Policy on Cookies and Similar Technologies.
In case you have any queries in relation to the retention period of your data please contact us using our Contact Form.
Technical and organisational measures and processing security
All the information we receive about you are stored on secure servers and we have implemented technical and organisational measures that are suitable and necessary to protect your personal data. OLX continually evaluates the security of its network and adequacy of its internal information security program which is designed to (a) help secure your data against accidental or unlawful loss, access or disclosure, (b) identify reasonably foreseeable risks to the security of the OLX network, and (c) minimize security risks, including through risk assessment and regular testing. In addition, we ensure that all payment data are encrypted using SSL technology.
Please note, despite the measures we have implemented to protect your data, the transfer of data through the Internet or other open networks is never completely secure and there is a risk that your personal data may be accessed by unauthorised third parties.
Links to third-party websites
For any additional information or to exercise your rights, please check your account/privacy settings or contact our Privacy Office by using our Contact Form or through the Help Center. You can also alternatively contact the data controller for your local services at Tradus B.V. at Wibautstraat 137-C, 1097 DN Amsterdam, the Netherlands.
Data Protection Authority
For data protection complaints, you may contact the responsible data protection authority. You may exercise this right by contacting the authority of your residency or workplace or the location of the data controller.
For cross border data processing, our lead supervisory authority is the Dutch Data Protection Authority in The Netherlands: