This Privacy Policy explains how WarSales ("we", "us", "the Platform") collects, uses and protects your personal data. We are committed to handling your data responsibly and in compliance with applicable law, including the EU General Data Protection Regulation (GDPR) and Slovenian data protection legislation.

1. Data Controller

The data controller for personal data processed on WarSales is the operator of the Platform, based in Slovenia. For data-related enquiries, contact us at support@warsales.com or use our contact form.

2. What Data We Collect

Account data (registered users)

Data	Why We Collect It	Legal Basis
Username	Account identity, displayed publicly on listings and profile	Contract
Email address	Account login, notifications, password reset	Contract
Password (hashed)	Authentication — stored as a one-way bcrypt hash, never in plain text	Contract
Registration date and last login	Account security and activity monitoring	Legitimate interest

Listing data

When you post a listing, the content (title, description, photos, price, category) is stored and publicly displayed. This data is associated with your account.

Messaging data

Messages sent through the Platform's inbox are stored to enable the conversation. Both parties can see messages; we may access them in the event of a reported dispute or moderation investigation.

Contact form submissions

When you contact support, we store your name, email address, subject and message. This is used solely to respond to your enquiry.

Session and technical data

We use server-side sessions (stored as a cookie containing only a session ID) to keep you logged in. Standard server access logs may record IP addresses, browser type, and pages visited. These are retained for up to 30 days for security purposes.

3. Cookies

We use the following cookies:

• Session cookie (essential) — keeps you logged in during your visit. Expires when you close your browser or log out.
• Language preference cookie (ws_lang) — remembers your language choice for 1 year. No personal data.

We do not currently use advertising cookies, analytics cookies from third-party providers, or tracking pixels on the Platform. If this changes, this policy will be updated and you will be notified.

4. How We Use Your Data

• To provide and operate the Platform and your account
• To display your listings and profile to other users
• To facilitate messaging between buyers and sellers
• To send transactional emails (if email notifications are enabled in your preferences)
• To respond to support requests
• To enforce our Terms of Service and Seller Guidelines
• To investigate reported violations and prevent fraud

We do not sell your personal data to third parties.

5. Data Sharing

We share your data only in the following circumstances:

• With other users — your username and listing content are public. If you send a message, the recipient can see your username.
• Service providers — our web hosting provider processes data on our behalf under a data processing agreement. We use providers based in the EU or with appropriate safeguards.
• Legal requirements — we may disclose data if required to do so by law or in response to a valid legal order.

6. Data Retention

• Active accounts — retained for as long as the account exists.
• Listings — retained after deletion for up to 12 months for audit and dispute purposes, then permanently deleted.
• Messages — retained for 24 months from the date of the last message in a conversation.
• Support messages — retained for 12 months after the enquiry is resolved.
• Deleted accounts — personal data is anonymised or deleted within 30 days of an account deletion request, except where retention is required by law.

7. Your Rights Under GDPR

If you are in the EU, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure ("right to be forgotten") — request deletion of your data, subject to retention obligations
• Right to restriction — request that we limit processing of your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact our support team. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (ip-rs.si) or your local supervisory authority.

8. Security

We take reasonable technical and organisational measures to protect your data, including:

• Passwords stored as bcrypt hashes (never in plain text)
• CSRF token protection on all forms
• Parameterised database queries to prevent SQL injection
• HTTPS encryption for all data in transit (when SSL is configured on the server)

No system is perfectly secure. In the event of a data breach that affects your rights, we will notify you and relevant authorities as required by GDPR.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. The "last updated" date at the top of this page will always reflect the current version.

10. Contact

For privacy-related questions or to exercise your rights: Contact Support or email support@warsales.com.