At 24SELLIO s. r. o. we take the protection of your personal data seriously. This policy explains what data we process, for what purposes, on what legal basis, and what rights you have. Processing is carried out in accordance with the GDPR (EU) 2016/679 and applicable law.
24SELLIO s. r. o.
Trnková 474/41, 040 14 Košice – mestská časť Košická Nová Ves, Slovenská republika
Company ID (IČO): 57 540 594
Tax ID (DIČ): 2122803210
The company has been VAT registered since 1 October 2026. VAT ID: SK2122803210.
Registration: Obchodný register Mestského súdu Košice, oddiel: Sro, vložka č. 65495/V
Managing directors: Ľuboš Bernáth, Peter Bernáth, Christian Mauritz
E-mail: support@24sellio.eu
The controller of personal data is 24SELLIO s. r. o., registered at Trnková 474/41, 040 14 Košice – mestská časť Košická Nová Ves, Slovenská republika. For data protection matters you can contact us at the email address below. The Operator has not appointed a data protection officer, as it is not required to do so under the GDPR. All questions and requests are handled directly by the Operator at the data protection e-mail address given below.
Account and profile — e-mail address, password (stored solely as an irreversible cryptographic hash generated with the bcrypt algorithm; we do not retain the original password and cannot recover it), name, phone number, avatar, profile description, account type, language and region.
Business data — company name, registration number, tax ID and VAT ID, and billing address for business accounts. To comply with tax and accounting duties we process billing details, declarations about location and business use, and the VIES VAT verification result, timestamp and available registry details. Legal basis: GDPR Article 6(1)(c). Access is limited to authorised staff, the accountant and competent authorities; the VAT ID is sent to VIES for verification. Tax records are retained for the statutory period, generally ten years following the year concerned.
Content — listings, photos, reviews and ratings. Messages between users are stored on our servers; we may access them for moderation, security and legal compliance.
Payment and accounting data — wallet credits (Coins), payments, invoices and billing details related to paid services. Payment card data is processed solely by the payment gateway provider; we do not store it.
Technical data — IP address, device and browser type, access time, operational logs and cookies.
Communications — notifications and push subscriptions, if you enable them on your device; e-mail communication with support.
Presence — the time of your last activity in the application. We always keep only the latest value, not a history of your movements, and we disclose it exclusively to the participants of your conversations — never on your public profile. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in enabling you to estimate, when communicating, when you can expect a reply. Communication works without this information as well, which is why we do not process it as necessary for the performance of the contract. You may object to this processing at any time, and switching this feature off has the same effect. You can switch presence display off at any time in your profile settings; once it is switched off we no longer store the time of your last activity and we delete the value stored so far.
We process personal data for the following purposes and on these legal bases under Article 6 GDPR:
Providing the service — performance of a contract (Art. 6(1)(b)) — creating and managing your account, publishing listings, communication and transactions between users.
Security and operations — legitimate interest (Art. 6(1)(f)) — security, prevention of fraud and misuse, operational logs and improvement of the service.
Consent — consent (Art. 6(1)(a)) — functional, analytics and marketing technologies on your device, measuring the effectiveness of advertising and an optional newsletter. You may withdraw consent at any time.
Legal obligation — legal obligation (Art. 6(1)(c)) — accounting and tax duties and handling requests from public authorities, as well as obligations under the DSA.
The provision of data marked as mandatory during registration and ordering is a contractual or, where applicable, statutory requirement necessary to conclude and perform the contract (in particular the e-mail address and, for business and paid services, billing and identification details). Without providing it, it is not possible to set up an account, publish a listing or provide paid services. Other data is provided voluntarily.
We obtain most personal data directly from you — during registration, when creating a listing, when ordering a service and when communicating with us. Some data, however, does not come from you but from other sources (Art. 14 GDPR): ratings and reviews given to you, messages and price offers sent to you, and reports about your content or conduct all come from other users of the portal; the payment gateway provider sends us the outcome of your payment. Technical data (for example your IP address and browser details) is generated automatically when you use the portal. The source of data received from other users is always a specific registered user of the portal; we disclose that user's identity only to the extent permitted by law and only where doing so does not jeopardise the rights of others or the purpose of the report.
Listings you publish are accessible to visitors who are not signed in and may be indexed by internet search engines and shown in their results or in social media previews. Your name or company name, avatar, profile description, region, received ratings and any contact details you include in the listing (phone, e-mail) are also public. Do not include in listings, photographs or descriptions any data you do not wish to make public, nor personal data of third parties without their consent. After a listing is removed, a copy may remain in search engine caches for some time, which is beyond our control.
Ratings you give or receive are published together with your name and avatar on your public profile. We store messages and attachments from conversations so that we can deliver and display them, while image attachments are deleted automatically 3 days after they are sent and only a note that the attachment is no longer available remains in the conversation; we access them only to the extent necessary for moderation, dispute resolution, fraud prevention and compliance with legal obligations. The legal basis is performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).
On JOBS, the job offer is published by the employer; data you send them as a candidate (for example a CV in a message) is processed by the employer as a separate controller, who is responsible for its lawful processing — we process it only to the extent necessary for the technical storage, security and delivery of the message. On REALITY we publish property data including location and energy class exactly as entered by the advertiser. On SHOWROOM, MARKETPLACE and ATELIER we publish the description, attributes and photographs of the advertised item. In all cases the extent of published data is determined by the advertiser through the content of their listing.
We use cookies and data in browser storage only to the extent described in the separate policy. Without your consent we store solely what is strictly necessary for the secure operation of the portal or for providing a feature you explicitly request. Functional, analytics and marketing technologies are activated only once you have given your consent, which you may withdraw at any time. Details can be found in our Cookie Policy
If you tick the consent to receiving discounts, news and the newsletter during registration or later in your profile settings, we will send marketing messages to the e-mail address you provided; for this purpose we process your name and e-mail address; we do not use your phone number for marketing. The legal basis is your consent under Art. 6(1)(a) GDPR. Consent is voluntary, it is not a condition of registration and not granting it has no effect whatsoever on the use of the portal. We keep a record of the granting and of the withdrawal of consent, including the date, the version of the wording and the manner in which it was obtained, so that we can demonstrate it under Art. 7(1) GDPR. You can withdraw consent at any time in your profile settings; withdrawal does not affect the lawfulness of processing carried out before its withdrawal. We process the data for this purpose until consent is withdrawn or until the account is deleted.
We disclose personal data only to the extent necessary. The following process them on our behalf as processors under a contract pursuant to Art. 28 GDPR: Websupport, s. r. o. (Slovak Republic) — server hosting of the portal and sending e-mails from our mailboxes via SMTP; Twilio Ireland Limited — verification of the phone number by SMS; as regards data about our own account and about the use of the service, Twilio acts as a separate controller under its own policies. Should we deploy a specialised service for e-mail delivery, we will update this policy in advance. We operate both search and image storage on our own server without involving any third party. The payment gateway provider Comgate, a.s. (Czech Republic) processes payment data as a separate controller under its own policies; payment card details never reach us at all. The following tools are loaded only if they are activated on the portal and you have at the same time granted consent for the relevant category; if a tool is not activated, no data are sent to it and its cookies are not stored on your device. We always state the current status of the individual tools in the Cookie Policy, which is displayed according to the actual configuration of the portal. These are the following tools, whereby the position of the individual providers is not the same: in the case of Google Analytics 4, Google Ireland Limited processes ordinary analytics data as our processor under Art. 28 GDPR on the basis of the Google Ads Data Processing Terms; it becomes a separate controller only to the extent of data that we would share with it beyond that service (for example when choosing to share data with Google products and services), which we do not use. In the case of Microsoft Clarity, Microsoft Ireland Operations Limited acts as a separate controller. In the case of the Meta Pixel tool and server-side conversion measurement (Conversions API), Meta Platforms Ireland Limited is our joint controller under Art. 26 GDPR for the collection and transfer of event data, on the basis of the Controller Addendum; after the transfer it processes the data for its own purposes already as a separate controller. We will make the essence of the joint controllership arrangement available to you on request and you may exercise your rights under the GDPR with any of the joint controllers. We use the Google Search Console service only for aggregate statistics on how the portal appears in search results; that service does not store data on your device and we do not pass any visitor data to Google through it, and therefore Google is not a recipient of your personal data within it. Your public advertisements and profile are visible to other users. We may provide data to public authorities where required by law, and to accounting, tax or legal advisers bound by confidentiality. We will provide you with a current list of recipients on request. For the optional AI Agent feature, the text of the page whose link you submitted is processed by the language model provider Z.ai (Zhipu AI, People's Republic of China), solely in order to propose how to fill in the Listing form. Telephone numbers and e-mail addresses are removed from the text before it is sent. We do not pass on your account data or anything we have collected about you elsewhere. We keep the result for no more than 24 hours so that a repeated attempt at the same link does not have to run again.
If you grant us marketing consent and the relevant marketing tool is activated on the portal, the recipients of your data are Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for Google Ads and Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) for the Meta Pixel tool and server-side conversion measurement. Which of these tools are actually deployed at any given time is stated in the Cookie Policy. The purpose is measuring advertising effectiveness and marketing, and the legal basis is your consent under Art. 6(1)(a) GDPR. They retain the data under their own policies, as a rule for a maximum of 13 months from the last interaction. You can withdraw consent at any time in your privacy settings.
Once you have given marketing consent, we also send data about your activity to Meta Platforms Ireland Limited directly from our server (Conversions API). If you are signed in, we send your contact details (e-mail, phone number, first name, surname, country code) and your internal identifier solely in the form of an irreversible SHA-256 cryptographic hash — Meta does not receive them in readable form and cannot derive them back from the hash. Regardless of whether you are signed in, we send your IP address, your browser identifier and the _fbp and _fbc cookies. We never send listing content, message content, payment data, an exact address, date of birth or gender. Nothing is sent without your consent. You may withdraw your consent at any time in the privacy settings.
We process the data primarily within the EU/EEA: server hosting and e-mail mailboxes are in the Slovak Republic, the payment gateway is in the Czech Republic and the analytics and marketing service providers referred to above are contractually represented towards us by Irish companies. With some of them, however, data may be transferred to the United States to their parent companies, and only to the extent of the tools that are activated: Twilio (phone number verification), Google (Analytics 4, Google Ads), Microsoft (Clarity) and Meta (Pixel and server-side conversion measurement). Such a transfer takes place on the basis of the European Commission decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework, where the company concerned is certified on its list, and otherwise on the basis of standard contractual clauses approved by the European Commission, supplemented by technical and organisational measures. We will provide you with information on which mechanism applies to a particular provider, as well as a copy of the safeguards or a reference to the place where they are available, on request at the data protection e-mail address given below; the transfer conditions are also published by the providers themselves in their privacy policies. Using the optional AI Agent feature involves a transfer to the People's Republic of China, for which the European Commission has not issued an adequacy decision. The transfer takes place on the basis of standard contractual clauses approved by the European Commission and a transfer impact assessment. The feature is optional — if you do not use it, this transfer does not occur in your case.
We keep the data only for the necessary time: account and profile data for the duration of the account; advertisements for the period of publication (30 to 60 days depending on the portal) and subsequently for a protection period of 30 days, after which they are permanently removed together with the photographs; ratings for the duration of the account of both the rated and the rating user — once either of those accounts is deleted, the rating, including the name and avatar of its author, is removed; messages in conversations for the duration of the accounts of their participants, however image attachments to messages only for 3 days from sending, after which they are automatically removed from the server and from the database; accounting and tax documents (invoices and payments) for 10 years under the Accounting Act; operational and security logs of the application for a maximum of 8 weeks and web server records for 14 days. If you request deletion of your account, the account is deactivated immediately and, after a period of 14 days — during which you may cancel the deletion — the data are erased or anonymised, with the exception of data that we must retain by law or for the establishment, exercise and defence of legal claims. Data needed to establish, exercise or defend legal claims are kept for the duration of the limitation periods under the Civil and Commercial Codes, as a rule 3 to 4 years from the end of the contractual relationship or from the disputed event.
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), storage of passwords solely as a cryptographic hash (generated with the bcrypt algorithm), access control and continuous monitoring. However, no transmission of data over the internet can be guaranteed to be entirely secure.
You have the right to access your data, to rectification, erasure, restriction of processing, data portability and the right to object to processing, including processing for direct marketing purposes. Where we process data on the basis of consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. You can download a copy of your data at any time directly in your account settings (Data export) and close your account using the account closure button. You may also exercise your rights at privacy@24sellio.eu; we will respond within one month at the latest.
If you believe we process your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority — in Slovakia the Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, dataprotection.gov.sk.
The Portal is intended for persons over 18 years of age; registration and publication of listings by persons under 18 are not permitted. We do not knowingly process children's personal data; if we find that we have obtained such data, we will delete it without undue delay.
We do not carry out automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 GDPR. We may rank the content and order of listings automatically in order to improve relevance and your experience of the service; this ranking has no legal or similarly significant effect on you.
We may update this policy from time to time. The current version is always available on this page; we will inform you of any material changes in an appropriate manner.
For questions about data protection, contact us at: privacy@24sellio.eu
We process business and contact details, IBAN, terms acceptance, pseudonymous customer attribution and commission transactions. Applications and the partner contract: GDPR Article 6(1)(b); employee contacts, ongoing attribution and commission verification: legitimate interests under (f); accounting records: (c); referral cookies: separate consent under (a). Partners see customer ID, date, service and commission, never the customer’s name or email. Attribution remains for the account and related claims; accounting records follow statutory retention, generally 10 years. Cookie withdrawal does not erase lawful accounting records. Rights including objection and contact details are in this policy.
Affiliate programme terms3. 10. 2026