PeerBag GDPR Information

1. Contact

For questions about your personal data or to exercise your rights: contact@peerbag.com.

2. Data processed

Depending on how PeerBag is used, the Platform may process the following categories.

To create an account, you must provide a username, email address, country, city and password with confirmation. You must accept the Terms of Use, acknowledge the Privacy Policy and confirm that you are at least 18 years old. Without the required information, you cannot create an account or use member-only features. The phone number in your profile is optional.

3. Purposes

This data is used to:

• create, verify, secure, and administer accounts;
• display and update profiles;
• publish, present, revise, and moderate listings;
• store and display associated images;
• manage favorites;
• enable conversations and display their read status;
• send notifications required for the service;
• prevent abuse, protect members, and apply the Terms of Use;
• diagnose errors and maintain security;
• comply with a legal obligation and defend the rights of PeerBag or a member.

PeerBag does not currently use this data for targeted advertising, marketing outreach, or optional audience measurement.

4. Legal bases

Depending on the purpose, PeerBag relies on:

• performance of the contract, to provide the account and requested functions;
• legitimate interests, to secure the service, prevent abuse, provide moderation, and defend the rights of PeerBag and its members;
• a legal obligation, when the law requires information to be retained or disclosed;
• consent only when optional processing requires it.

Acceptance of the Terms of Use is not blanket consent to all personal-data processing. Acknowledging this Privacy Policy confirms that the information was presented; it does not replace specific consent when that consent is required.

5. Email-address verification

The email address is used to create and secure the account, verify that the address is accessible, and send communications required for the account to function.

Validating an email address does not constitute complete verification of a member's identity.

6. Visibility and sharing between members

Depending on the context, other members may see:

• the username, picture, country, and city;
• email-verification status and account age;
• listings, images, and location information chosen for publication;
• information required for a conversation in which they participate.

The email address, phone number, precise geographic coordinates, identity identifiers, and internal roles are not intended to appear in public profiles.

Members must not publish unnecessary personal data in a listing or message.

7. Recipients

Data may be accessible to:

• other members for public information and conversations in which they participate;
• persons authorized to operate, secure, or moderate PeerBag;
• technical providers strictly required for hosting, identity, email delivery, and backups;
• authorized authorities or advisers when justified by a legal obligation or the defense of a right.

Providers receive only the data required for their assignment.

8. Retention

Data is retained only for as long as needed for its purpose, compliance with a legal obligation or the establishment, exercise or defence of legal claims. The periods below describe deletion rules within the app.

Automatic cleanup, enabled by default, is scheduled each day. An administrator can suspend and re-enable it. An administrative suspension or technical interruption does not change the applicable retention periods or your rights.

Cleanup applies to the following data once these periods have elapsed, subject to the exceptions explained below:

• a published listing becomes outdated when its travel date or request deadline has passed; its owner and participants in an existing conversation can still view it and continue exchanging messages, and it becomes eligible for permanent deletion 30 days after it becomes outdated; its conversations, messages, related data and files that are not shared are also deleted;
• a conversation made unavailable is permanently deleted with its messages and read information 7 days after access is restricted in this way;
• a listing deleted by its owner is permanently erased 30 days after that deletion, with its related data and files that are not shared;
• an obsolete listing version is deleted when it is no longer used and was last changed at least 90 days earlier;
• a read notification is deleted 90 days after it is read; an unread notification is deleted 180 days after it is created;
• an expired session is deleted during the next daily cleanup after its expiry;
• expired email-verification secrets are deleted during the next daily cleanup after their expiry; this does not automatically delete the account;
• a file no longer linked to an attachment is deleted when it has not been modified for at least 48 hours.

The cleanup described above does not automatically delete accounts, reports, their copies or blocking and moderation decisions. Retaining this data must remain necessary for account management, handling a report, preventing abuse, complying with a legal obligation or establishing, exercising or defending legal claims. You can request erasure at contact@peerbag.com.

Retention beyond the periods above must be justified by a specific need, such as a legal obligation, protecting people or handling a legal dispute, and limited to that need. A moderation measure or account block does not, by itself, justify indefinite retention.

Cleanup does not create a temporary archive. Copies that may remain in disaster-recovery backups follow a separate cycle: 7 daily, 5 weekly and 12 monthly backups. Deletion in the app therefore does not immediately erase every backup copy.

To exercise your rights or ask about retained data and the reasons for its retention, contact contact@peerbag.com.

9. Account deletion

To request account deletion and erasure of your data, write to contact@peerbag.com. Deletion from settings is not available. The right to erasure applies under the conditions set by the GDPR.

Data that is no longer required will be deleted or anonymized. Some information may be retained where justified by a legal obligation, security, fraud prevention, or the establishment, exercise, or defense of legal claims.

10. Rights

Subject to the conditions set by applicable regulation, a person may request:

• access to their data;
• rectification of their data;
• erasure of their data;
• restriction of processing;
• objection to certain processing;
• portability where that right applies;
• withdrawal of consent for processing based on consent.

Write to contact@peerbag.com to exercise your rights. Proportionate identity checks may be requested where there are reasonable doubts. You must receive a response without undue delay and within one month at the latest. The deadline may be extended by up to two months depending on the complexity and number of requests; you must be told why within the first month. A refusal must explain the reasons and your complaint and appeal options.

You can object to processing based on legitimate interests for reasons relating to your particular situation. The controller must then stop that processing unless there are compelling legitimate grounds or it is needed for legal claims. You can object to direct marketing at any time without giving a reason. Withdrawing consent does not affect the lawfulness of processing before its withdrawal.

11. Complaint

You can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, workplace or the alleged infringement. In France, you can contact the CNIL: https://www.cnil.fr/fr/adresser-une-plainte. This right does not prevent you from seeking a judicial remedy.

12. Security

PeerBag implements technical and organizational measures designed to protect data against unauthorized access, loss, alteration, disclosure, or destruction.

No system guarantees absolute security. Protect your credentials and report suspicious activity to contact@peerbag.com.

13. Cookies and local storage

PeerBag uses cookies and local storage for authentication, security, coordinating sign-out across tabs, and your language and appearance preferences.

No advertising cookie or optional audience-measurement tool is used in the current version. No consent banner for optional cookies is therefore displayed. If such technologies are added, appropriate information and choices will be provided before their use where required by law.

14. Communications

PeerBag may send emails required for verification, security, and account operation. Creating an account does not subscribe the member to advertising communications.

PeerBag does not currently send marketing communications. Any future outreach processing subject to consent will use a separate choice.

15. Moderation and abuse prevention

Information relating to the account, listings, and exchanges may be used to identify conduct contrary to the Terms of Use, protect members, and apply a moderation measure.

Current moderation decisions are made by authorized persons. PeerBag does not implement fully automated decisions that produce legal or similarly significant effects on a member.

16. Minors

PeerBag is reserved for people aged 18 or over. A minor may not create an account.

17. Changes to this Privacy Policy

PeerBag may change this Privacy Policy to reflect developments in the service, security, or the applicable framework. Members will be informed by an appropriate means if a significant change is made.

The displayed date and version identify the text currently in force.

18. Contact

For questions about this policy or your personal data: contact@peerbag.com.