PRIVACY POLICY – B2BONZA

Last updated: 22.2.2026

This Privacy Policy explains how eBonza s.r.o. (the “Controller” or “Operator”) processes personal data in connection with the operation of the website www.b2bonza.com (the “Platform”), in accordance with Regulation (EU) 2016/679 (GDPR).

The Platform currently operates as a pre-registration website for a future B2B marketplace connecting brands (“Brands”) and retailers (“Retailers”). This Privacy Policy also describes data processing principles applicable to later operational phases of the Platform.

DATA CONTROLLER

eBonza s.r.o. Křižovnická 86/6 110 00 Prague 1 Czech Republic

Company ID (IČO): 06570798 VAT ID (DIČ): CZ06570798

Email: info@b2bonza.com Website: www.b2bonza.com

DATA SUBJECTS

The Controller processes personal data of the following categories of data subjects:

• visitors of the Platform,
• users submitting a pre-registration request (“Users”),
• representatives of Brands and Retailers interested in joining the Platform.

PERSONAL DATA PROCESSED

During the pre-registration phase, the Controller processes only a limited scope of personal data, in particular:

• name and surname,
• email address,
• company name and business identification details (if provided),
• role or interest as Brand or Retailer (if indicated),
• information voluntarily submitted via pre-registration or contact forms,
• communication data arising from email or form-based communication.

The Controller does not intentionally process special categories of personal data within the meaning of Article 9 GDPR.

PURPOSES OF PROCESSING

Personal data is processed for the following purposes:

• handling pre-registration requests for the Platform,
• maintaining records of interest from Brands and Retailers,
• contacting Users in relation to the launch and development of the Platform,
• responding to inquiries sent via contact forms or email communication,
• taking preparatory steps prior to entering into contractual relationships under the Brand Terms of Use or Retailer Terms of Use.

Personal data is not used for automated decision-making or profiling.

LEGAL BASIS FOR PROCESSING

Personal data is processed based on the following legal grounds:

• Article 6(1)(b) GDPR – steps taken at the request of the data subject prior to entering into a contract (pre-registration),
• Article 6(1)(f) GDPR – legitimate interest of the Controller in operating, developing, and securing the Platform and communicating with interested Brands and Retailers,
• Article 6(1)(a) GDPR – consent, where explicitly granted by the User.

DATA RETENTION PERIOD

Personal data is retained:

• for the duration of the pre-registration phase of the Platform, and
• for a reasonable period following the launch of the Platform, unless a contractual relationship is established earlier or the data subject requests deletion.

Personal data may be deleted earlier upon request, unless further retention is required by applicable law.

DATA RECIPIENTS AND THIRD-PARTY SERVICE PROVIDERS

Personal data may be accessed only by:

• the Controller,
• authorized personnel or contractors involved in the operation and development of the Platform.

Personal data is not sold, rented, or shared with third parties for marketing purposes.

In later operational phases of the Platform, limited personal and business-related data may be shared with trusted third-party service providers solely for the purpose of providing Platform services, including:

• Stripe – for payment processing and payout management,
• Quaderno – for automated VAT-compliant invoicing generated on behalf of Brands,
• UPS and other logistics carriers – for shipping and delivery services initiated by Brands.

Such data sharing will be limited to the extent necessary and carried out in accordance with applicable data protection laws and the privacy policies of the respective service providers.

TRANSFERS OUTSIDE THE EUROPEAN UNION

During the pre-registration phase, personal data is not intentionally transferred outside the European Union.

If international data transfers become necessary in later phases of the Platform, the Controller will ensure appropriate safeguards in accordance with GDPR, including standard contractual clauses or other lawful transfer mechanisms.

RIGHTS OF DATA SUBJECTS

Data subjects have the right to:

• access their personal data,
• request rectification of inaccurate data,
• request deletion of personal data,
• request restriction of processing,
• object to processing based on legitimate interest,
• withdraw consent at any time, where processing is based on consent,
• lodge a complaint with a competent supervisory authority.

Requests may be submitted to: info@b2bonza.com

DATA SECURITY

The Controller implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, protecting personal data against unauthorized access, loss, misuse, or alteration.

CHANGES TO THIS PRIVACY POLICY

The Controller reserves the right to update this Privacy Policy, in particular in connection with:

• the launch of the full B2B marketplace,
• the activation of user accounts for Brands and Retailers,
• the introduction of payment, invoicing, or logistics services,
• changes in applicable legal regulations.

The current version of this Privacy Policy will always be available on the Platform.