GDPR & Data Protection Notice

Last Updated: January 2026

This GDPR & Data Protection Notice ("Notice") explains how Plegz collects, uses, stores, and protects personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.

This Notice is provided for transparency and compliance purposes and forms part of the Plegz legal framework.

1. Data Controller

The data controller responsible for processing personal data under this Notice is:

Big Blue Dot Project OÜ
Tööstuse tn 75-71
10416 Tallinn
Estonia

("Plegz", "we", "us").

2. Scope and Applicability

  • 2.1 This Notice applies to all users of the Plegz platform, including Buyers and Sellers (Professionals), regardless of their country of residence.
  • 2.2 Plegz is established in the European Union and applies GDPR standards to all users, including those located in:
    • The European Union / EEA;
    • Turkey; and
    • Other non-EU countries where the platform may be accessed.

3. Categories of Personal Data

Plegz may process the following categories of personal data:

  • Identification data (name, username, profile information);
  • Contact data (email address);
  • Account and transaction data;
  • Payment-related data (processed via Stripe);
  • Communications between Buyers and Sellers;
  • Technical data (IP address, device information, logs);
  • Compliance and verification data where legally required.

Plegz does not intentionally collect special categories of personal data unless strictly necessary and lawful.

4. Legal Bases for Processing

Plegz processes personal data based on one or more of the following legal grounds:

  • Performance of a contract;
  • Compliance with legal obligations;
  • Legitimate interests (platform security, fraud prevention);
  • User consent, where required.

5. Purpose of Processing

Personal data is processed to:

  • Operate and maintain the Plegz platform;
  • Facilitate Buyer–Seller transactions;
  • Process payments and payouts;
  • Prevent fraud and abuse;
  • Comply with legal and regulatory obligations;
  • Communicate with users;
  • Improve platform services.

6. Payment Processing

  • 6.1 Payments are processed by Stripe, acting as an independent data controller or processor, depending on the transaction.
  • 6.2 Plegz does not store full payment card details.
  • 6.3 Stripe processes personal data in accordance with GDPR and its own privacy policies.

7. International Data Transfers

  • 7.1 Personal data may be transferred outside the EU/EEA where necessary for platform operation.
  • 7.2 Where such transfers occur, Plegz ensures appropriate safeguards, including:
    • EU Standard Contractual Clauses (SCCs);
    • Adequacy decisions where applicable;
    • Other lawful transfer mechanisms under GDPR.

8. Data Retention

  • 8.1 Personal data is retained only for as long as necessary to fulfill the purposes outlined in this Notice.
  • 8.2 Data may be retained longer where required by law (e.g. accounting, tax, dispute resolution).
  • 8.3 Upon expiration of retention periods, data is securely deleted or anonymised.

9. Data Subject Rights

Users have the following rights under GDPR:

  • Right of access;
  • Right to rectification;
  • Right to erasure ("right to be forgotten");
  • Right to restriction of processing;
  • Right to data portability;
  • Right to object;
  • Right to withdraw consent at any time.

Requests may be submitted via the Plegz platform or by contacting us.

10. Security Measures

Plegz applies appropriate technical and organisational measures to protect personal data, including:

  • Secure infrastructure;
  • Access controls;
  • Encryption where appropriate;
  • Limited internal access on a need-to-know basis.

11. Complaints and Supervisory Authority

Users have the right to lodge a complaint with a supervisory authority.

The lead supervisory authority is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)

12. Updates to this Notice

Plegz may update this Notice from time to time.

Material changes will be communicated via the platform.

13. Contact

For GDPR-related inquiries, requests, or concerns, users may contact:

privacy@plegz.com

14. Relationship to Other Policies

This Notice supplements the Plegz Terms of Service and other policies.

In case of conflict, this Notice prevails with respect to data protection matters.