EEA & UK Privacy Notice
Lawful bases, representatives, transfers and your GDPR rights.
This notice supplements the Privacy Policy for people in the European Economic Area, the United Kingdom and Switzerland. Where it differs from the general policy, this one applies to you.
1. Who the controller is
Pontelon LLC, of 306 W Redwood St, Ste 201, Baltimore, MD 21201 (United States), is the controller of your personal data.
| EU representative (GDPR Art. 27) | [not yet published: EU representative (GDPR Art. 27)] |
|---|---|
| UK representative | [not yet published: UK representative] |
| Data protection officer | Not appointed. We are not a public authority, and our core activities are not large-scale monitoring or large-scale processing of special category data, so Art. 37 does not require one. Write to legal@whinchat.app and it reaches the person who does this work. |
2. Our lawful basis for each purpose
Article 6 requires a basis for every purpose, not one for the service as a whole.
| Purpose | Lawful basis |
|---|---|
| Carrying your messages, calls and files | Art. 6(1)(b) — performance of the contract you entered into |
| Account, sign-in and security | Art. 6(1)(b) — contract |
| Marketplace orders, escrow and payouts | Art. 6(1)(b) — contract |
| Keeping tax and payment records | Art. 6(1)(c) — legal obligation |
| Sanctions screening | Art. 6(1)(c) — legal obligation |
| Preventing abuse, fraud and spam | Art. 6(1)(f) — legitimate interests. Ours and other users’ interest in a service that is not used to defraud or harass them. Balanced against your interests and recorded; you may object under Art. 21. |
| Diagnosing faults from error reports | Art. 6(1)(f) — legitimate interests in a service that works |
| Measuring how the app performs and which parts are used | Art. 6(1)(f) — legitimate interests in a service that works and is worth using. No advertising or profiling; no third-party analytics; nothing you typed. You can switch it off in Settings, we honour Global Privacy Control and Do Not Track, and you may object under Art. 21. |
| Reporting child sexual abuse material | Art. 6(1)(c) and Art. 6(1)(d) — legal obligation and the vital interests of another person |
We do not process your data for advertising or profiling, so no basis is claimed for it. Special category data (Art. 9) is not requested and not inferred.
3. Your rights
You may ask for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable form. Access, export and deletion are built into the app under Settings — you do not have to ask us. Write to legal@whinchat.app for the rest.
You may complain to your supervisory authority. In the UK that is the Information Commissioner’s Office; in the EEA it is the authority for the country you live in. We would rather you told us first, but that is your right and not a precondition.
4. Sending data outside the EEA and the UK
Our servers and subprocessors are listed in Subprocessors & Transfers, with the country each one holds data in. Transfers outside the EEA or the UK rely on the European Commission’s Standard Contractual Clauses together with the UK Addendum, and on an adequacy decision where one is in force for that country.
5. How long we keep it
Every category and its period is in Data Retention. Nothing is kept “indefinitely” without a period being stated there.
6. Automated decisions
These automated checks can act before a person has looked:
- the age gate and sanctions screening, which can refuse an account;
- a new account is refused if its email belongs to an account we have banned;
- a shop stops taking new orders if, over the last 90 days and at least 10 orders, many were disputed or refunded or its ratings are very low. The seller is told why at once; orders already placed, returns and payouts carry on; and our staff review every pause.
Two more only put something in front of a person: a new account that shares a device or phone number with a banned account is held from buying and selling until staff look, and the photo check of listings, lives and shared places only flags a picture. None of these produces an effect that cannot be reviewed by a person — reply in your chat with us, or write to legal@whinchat.app, and a human will look. We do not profile you for advertising.
7. Digital Services Act contact
Our point of contact for users, and for authorities acting under the DSA, is legal@whinchat.app. Notices may be sent in English. How we handle reports of illegal content, and how to challenge a decision about your own content, is described in Acceptable Use and Dispute Resolution.
What has changed
9 October 2026 · version 2
- §6 Automated decisions — lists every automated check that can act before a person looks: refusing a new account whose email belongs to a banned account, and pausing new orders to a shop with many disputes or refunds or very low ratings (the seller is told why and staff review every pause); and the two that only flag for a person (a device or phone shared with a banned account; the photo check).
30 August 2026 · version 1
- First published.