Privacy Policy

This Privacy Policy explains how TRAMETE ("we", "us") collects and processes personal data when you use our website, mobile apps and services (the "Service"). We comply with the Swiss Federal Act on Data Protection (FADP) and, where and insofar as it is applicable, the EU General Data Protection Regulation (GDPR). This Privacy Policy applies to all processing of personal data in connection with TRAMETE.

The controller responsible for data processing is: TRAMETE (owned by Fud Eel) Hohlstrasse 304090, 8004 Zürich, Switzerland Switzerland Owner: Fud Eel For privacy-related questions or to exercise your rights, you can contact: - Email (privacy): privacy@tramete.ch - Email (legal): legal@tramete.ch - Email (support): support@tramete.ch Data Protection Officer (DPO): We have appointed a data protection contact for TRAMETE. You can reach our data protection contact at privacy@tramete.ch. Supervisory authority: If you believe that your personal data is being processed unlawfully, you may lodge a complaint with the Swiss supervisory authority: Federal Data Protection and Information Commissioner (FDPIC) Feldeggweg 1, 3003 Bern, Switzerland Website: https://www.edoeb.admin.ch

This Privacy Policy applies to all users of TRAMETE, including: - Visitors to our website; - Registered users of our marketplace; - Users of our iOS and Android mobile applications; and - Individuals located in Switzerland who interact with us as part of our services. Our marketplace and registration process are designed for users in Switzerland and protected by Swiss phone number verification.

We collect the following categories of personal data: 4.1 Account data If you create an account, we process in particular: - Name - Email address - Phone number - Postal address (e.g. for shipping and billing) - Date of birth - Password (stored only as a cryptographic hash, not in plain text) 4.2 Technical and usage data When you use the Service, we automatically collect technical data, such as: - IP address - Device and browser information - Operating system - Access timestamps - Basic log data about how you use the Service (e.g. pages viewed, actions performed) 4.3 Marketplace and content data When you use the marketplace, we process: - Listings you create (title, description, photos, price, category, timestamps) - Internal messages and chats with other users via the Service - Your settings and preferences (e.g. notification choices) 4.4 Payment data Payments are processed by Stripe. We do not store full credit card numbers or CVV codes. We receive from Stripe in particular: - Payment status (success / failure) - A transaction or payment ID - The amount and currency - Limited billing details (e.g. billing address) 4.5 Communications data When you communicate with us or other users, we process: - Emails sent to our addresses (handled via Zoho Mail) - Messages via our internal chat - Support messages, including those handled via our Discord support server (your Discord username and any information you voluntarily share there) - Subscriptions and interactions with newsletters and marketing emails 4.6 Mobile app data (iOS and Android) If you use our mobile apps, we may also process: - Device identifiers used for push notifications (push tokens) - App version and basic device information We do not use separate analytics SDKs such as Google Analytics for Firebase or Appsflyer at this stage unless explicitly specified otherwise.

We process personal data for the following purposes, based primarily on Swiss data protection law (FADP) and, where applicable, the GDPR: 5.1 Providing and operating the Service We process your data to: - Create and manage your user account; - Enable you to publish listings and browse other listings; - Facilitate communication between buyers and sellers; - Process payments via Stripe; - Provide customer support. 5.2 Security, abuse prevention and fraud prevention We process data to: - Protect our infrastructure and users from misuse, fraud and security risks; - Detect suspicious activities and enforce our Terms and Conditions; - Prevent and investigate misuse of the marketplace and payment system. For this, we may use automated systems and manual checks. 5.3 Communication and support We use your contact details to: - Respond to your enquiries; - Provide technical support; - Inform you about changes to our services or policies. 5.4 Personalisation and improving the Service We may analyse how users interact with the Service to: - Improve usability and performance; - Fix errors and improve stability; - Develop new features and offerings. 5.5 Marketing and newsletters If you have an account with us or have consented to receive marketing communications, we may: - Send you newsletters, product updates and offers; - Inform you about changes, promotions and relevant services. You can unsubscribe from newsletters at any time, e.g. via the unsubscribe link in the email. 5.6 Online advertising We may use data (such as basic usage data or hashed identifiers) to operate advertising campaigns via: - Google Ads - Meta (Facebook / Instagram) - TikTok The aim is to show relevant ads to users in Switzerland who might be interested in our marketplace. 5.7 Legal obligations and enforcement of rights We may process personal data to: - Comply with legal obligations (e.g. accounting and tax laws); - Cooperate with Swiss authorities where legally required; - Enforce or defend legal claims (e.g. in case of disputes or fraud).

We use AI services from providers such as OpenAI and Anthropic (Claude) for the following purposes: - Automatic detection of spam, scams and other malicious or illegal content; - Automatic translation of listing titles and descriptions into different languages (e.g. German, French, Italian, English) to improve usability. Where technically feasible, we pseudonymise or reduce personal identifiers before sending text to these providers (e.g. removing phone numbers or email addresses in some contexts). According to the applicable enterprise terms of these providers, the text we send is not used to train their public models. We use these services strictly for moderation and translation in connection with TRAMETE.

We use cookies and similar technologies on our website and apps to: - Ensure the technical functionality and security of the Service (necessary cookies); - Remember your preferences (functional cookies); - Run and measure advertising campaigns (marketing cookies). We use a Consent Management Platform (CMP) that allows you to choose which categories of cookies you wish to allow or reject. You can change your preferences at any time via the cookie settings on our website or in the app, where available. You can also adjust your browser or device settings to block or delete cookies. However, if you block necessary cookies, some parts of the Service may not function properly.

We may use the following platforms for advertising: - Google Ads - Meta (Facebook / Instagram) Ads - TikTok Ads These providers may place cookies or use similar technologies to measure and optimise campaigns and to show ads to users who might be interested in our services. We aim to configure these tools in compliance with Swiss data protection law. You can usually manage your preferences directly on the respective platforms (e.g. Google, Meta, TikTok) in addition to our own cookie and privacy settings.

We may share personal data with the following categories of recipients, to the extent necessary for the purposes described in this Privacy Policy: 9.1 Infrastructure and hosting - Google Cloud Platform / Firebase (hosting, backend services) - MongoDB-managed cloud database (storage of application data) 9.2 Payment processing - Stripe for processing payments and refunds. We do not receive your full card data; we receive only what is required to confirm payments and manage transactions (status, amount, reference IDs). 9.3 Email and communication - Zoho Mail for sending emails (e.g. confirmations, notifications, newsletters). - Discord for support communication in our external support channels (if you contact us via Discord). 9.4 Shipping - Swiss Post (https://www.post.ch) if you use shipping options that require label creation or parcel tracking through our integration. In this case, we may transmit necessary shipping data (such as your name, address and contact details) to Swiss Post to fulfil delivery. 9.5 Advertising and marketing - Google, Meta, TikTok and similar networks for campaign management and measurement. We require our service providers to process personal data only on our behalf and in accordance with our instructions, unless they act as independent controllers under their own terms and privacy policies.

We primarily store and process personal data in Switzerland and, where appropriate, in data centres within the European Economic Area (EEA). However, some of our service providers (for example cloud, payment, AI or advertising providers) may process data in other countries. In such cases, we ensure that an adequate level of data protection is in place, for example through: - An adequacy decision by the Swiss authorities or the EU; or - Contractual safeguards such as standard contractual clauses. If you have questions about international data transfers, you can contact us using the details provided in section 2.

We process personal data only for as long as necessary for the purposes described in this Privacy Policy or as required by law. In particular: - Account and profile data are stored while your account is active. - If you request deletion of your account, we typically delete your account-related data from our MongoDB and Firebase systems without undue delay, subject to necessary retention. - We retain limited transaction-related data as required for **fraud prevention** and **tax / accounting obligations**. This may include records of payments and the fact that a transaction took place (but not card details). We do not keep separate long-term archives of: - full transaction logs for behavioural analysis beyond what is necessary; - chat logs purely for marketing purposes; - shipping labels or ID verification documents, unless required in a specific case for legal reasons. Backups may contain personal data for technical reasons, but these are only used for system recovery and are deleted or overwritten according to our backup rotation policies.

Under the Swiss Federal Act on Data Protection, you generally have the following rights in relation to your personal data: - **Right of access**: You can request information about whether we process personal data about you and, if so, which data. - **Right to rectification**: You can request the correction of inaccurate or incomplete personal data. - **Right to deletion**: You can request deletion of your personal data, for example if it is no longer necessary for the purposes for which it was collected or if you withdraw consent. - **Right to object**: Where we process data based on legitimate interests, you may object to such processing if your situation justifies it. - **Right to withdraw consent**: If we process data based on your consent, you may withdraw that consent at any time with effect for the future. To exercise these rights, please contact us at privacy@tramete.ch. We may request proof of identity to protect your data. Please note that legal retention obligations or overriding interests may require us to retain certain data despite a request for deletion.

We take appropriate technical and organisational measures to protect personal data against unauthorised access, misuse, loss or destruction. These measures include, in particular: - Encrypted communication (HTTPS) between your device and our services; - Use of reputable cloud providers such as Google Cloud / Firebase and managed databases with appropriate security standards; - Access controls and permissions so that only authorised persons can access personal data; - Regular updates and monitoring of our systems. Despite these measures, no method of transmission or storage on the internet is completely secure. We cannot guarantee absolute security, but we continuously work to maintain and improve our security measures.

We may amend this Privacy Policy from time to time, for example if we introduce new services or technologies or if legal requirements change. The current version published on our website or in our app applies. If the Privacy Policy is part of an agreement with you, we will inform you by suitable means in the event of significant changes (for example by email or notification in the app).

If you have any questions about this Privacy Policy or about how we process your personal data, you can contact us at: - Email (privacy): privacy@tramete.ch - Email (support): support@tramete.ch - Postal address: Hohlstrasse 304090, 8004 Zürich, Switzerland We will do our best to respond to your request within a reasonable period.