Privacy policy

The data controller is

Younes AIMEUR Email: younes.aimeur@getredress.com

In accordance with Law No. 25-11, a data protection officer has been appointed.

Any request about personal data may be sent to younes.aimeur@getredress.com

3.1 Data provided by the user

When creating an account

• username
• email address
• password (stored encrypted and never available in clear text)
• phone number
• wilaya of residence

When completing the profile

• first and last name
• profile photo
• language preference

When placing an order

• delivery address: wilaya, commune, detailed address, recipient phone number

When requesting a withdrawal

• bank or postal details (account holder, institution, account number)

When publishing a listing

• item photos
• title, description, category, size, condition, price

3.2 Data generated by use

• history of orders, offers, cancellations, and disputes
• wallet movements and transaction history
• messages exchanged with other users
• reviews given and received
• reports and blocks made
• favourited items and followed profiles

3.3 Technical data

• push notification identifier (device token)
• operating system and app version
• error and crash logs
• IP address, for security and fraud prevention

3.4 Data not collected

Redress does not collect

• payment card data (card number, security code): these are entered and processed solely by the payment provider
• precise geolocation data
• biometric data
• health data, political, religious, or trade-union opinions, or any other sensitive data within the meaning of Article 3 of Law 18-07
• data for advertising or tracking on third-party apps or sites

Processing is carried out for the following purposes

• Account creation and management: performance of the contract
• Publishing and browsing listings: performance of the contract
• Processing orders and payments: performance of the contract
• Delivery of items: performance of the contract
• Messaging between users: performance of the contract
• Wallet and withdrawals management: performance of the contract
• Handling disputes and claims: performance of the contract / legitimate interest
• Notifications about orders and messages: performance of the contract
• Fraud prevention and Platform security: legitimate interest
• Content moderation and handling reports: legitimate interest
• Fixing technical issues: legitimate interest
• Keeping accounting records: legal obligation

Promotional notifications, if introduced, would require separate consent that can be withdrawn at any time.

Data is accessible to authorised Redress staff, within the scope of their roles.

Some data is shared with processors acting only for the purposes below:

• Hosting provider: database hosting and authentication (account and transaction data)
• Content storage provider: storage and delivery of images (listing, profile, and dispute photos)
• Payment provider: card payment processing (amount, order reference, payment ID)
• Carrier: parcel delivery (recipient name, phone, and address)
• Notification provider: delivery of notifications (device ID, notification content)
• Technical monitoring provider: detecting issues (technical logs)

Technical logs sent to the monitoring provider are filtered beforehand to remove identifying personal information.

The payment provider and carrier are identified to the user when used. The identity of other processors can be provided on request to the data protection officer.

No data is sold, rented, or transferred to third parties for commercial purposes.

Data may also be disclosed to competent judicial or administrative authorities on a lawful request.

Some providers mentioned in Article 5 host infrastructure outside Algeria, including in the European Union.

In line with Law No. 18-07 as amended on cross-border transfers, these transfers are made:

• to countries offering an adequate level of protection
• under contractual commitments imposing confidentiality and security duties on providers
• subject to any authorisations required from the national personal data protection authority

Users are informed of these transfers by this policy.

Data is retained for the following periods

• Account data: for the life of the account
• Published listings: until deleted by the seller or account closure
• Orders and accounting records: ten (10) years from the transaction, under legal retention duties
• Messages: for the life of the conversation, subject to retention linked to a dispute
• Reviews: kept in anonymised form after account closure
• Disputes and reports: five (5) years from closure
• Technical logs: thirty (30) days
• Notifications: ninety (90) days
• Notification tokens: deleted on logout or after a long period of inactivity

After these periods, data is deleted or irreversibly anonymised.

Under Articles 34 et seq. of Law No. 18-07 as amended, users have the following rights:

Right to information to be informed of processing, its purposes, and its recipients.

Right of access to obtain the data concerning them.

Right of rectification to have inaccurate or incomplete data corrected. Most information can be edited directly in the app.

Right to object to object, on legitimate grounds, to processing of their data.

Right to erasure to obtain deletion of their data. This is exercised by deleting the account in app settings.

Right to withdraw consent where processing is based on consent, it may be withdrawn at any time.

Exercising rights

These rights may be exercised

• directly in the app, for viewing, editing, and deletion
• by request to younes.aimeur@getredress.com, with proof of identity

Redress responds within a maximum of thirty (30) days.

Limits

Some data cannot be deleted on request

• data linked to an order, kept for accounting duties and the other party's rights
• received reviews, kept anonymised to preserve trust system reliability
• data needed to establish, exercise, or defend a legal claim

Complaint

A user who believes their rights are not respected may contact the national personal data protection authority (ANPDP).

Account deletion is available in app settings. It is final and irreversible.

It results in

• deletion of email, phone number, name, profile photo, delivery addresses, and bank details
• deletion of published listings and their photos
• deletion of notification tokens

Kept in anonymised form

• order history, for accounting needs and the other party's rights
• conversations linked to an order
• received reviews

Deletion is not possible while an open order, a non-zero balance, a pending withdrawal, or an open dispute remains.

Redress implements appropriate technical and organisational measures to protect data security, integrity, and confidentiality, including:

• encryption of communications between the app and servers
• irreversible password encryption, never available in clear text
• limiting data access to authorised persons within their roles
• access logging and monitoring
• regular security reviews

No system can guarantee absolute security. Users should choose a strong password and not share it.

If a personal data breach may create a risk for the rights and freedoms of data subjects, Redress notifies the national personal data protection authority within the five (5) days set by Law No. 25-11.

If the breach may create a high risk, affected users are informed individually as soon as reasonably possible.

Redress does not take decisions producing legal effects for a user based solely on automated processing.

Automated mechanisms rely on objective rules disclosed to users in the Terms of Use, and involve no profiling.

Moderation and dispute decisions are subject to human review.

The app uses no advertising trackers, no third-party audience cookies, and no tracking on third-party apps or sites.

The only data stored locally on the device is what is strictly needed for the app to work, including session continuity and display preferences.

The Platform is limited to persons aged at least eighteen (18).

Redress does not knowingly collect data about minors. If an account is identified as belonging to a minor, it is closed and related data deleted.

Anyone who finds that a minor created an account is invited to report it to younes.aimeur@getredress.com.

Redress may change this policy to reflect legal, technical, or functional developments.

Material changes are brought to users' attention by in-app notification. The last update date appears at the top of the document.

For any question or request about this policy

Younes AIMEUR Data protection officer younes.aimeur@getredress.com