privacy
Do I need a privacy policy when selling on a shopping platform commercially?
<p>I am selling 5 articles per month commercially (not privately) on the internet.</p>
<p>I am doing this on <a href="https://ebay-kleinanzeigen.de" rel="nofollow noreferrer">eBay Kleinanzeigen</a> in Germany. The English translation is eBay small advertisements. It's like Vinted, Shpock or Etsy.</p>
<p>I already have a text for <a href="https://en.wikipedia.org/wiki/Standard_form_contract" rel="nofollow noreferrer">terms and conditions</a>. I wonder if I also need a privacy policy which tells the buyer how long I will save his address (for example)?</p>
<p>I also have the PayPal address or the IBAN of the buyer. Do I need a privacy policy which tells the buyer how long I will store this information?</p>

<p>If you process any personal data, you do need to provide notice to the data subjects per Art 13 or Art 14 GDPR. Personal data is any information relating to a (directly or indirectly) identifiable natural person.</p>
<p>It seems you are processing personal data including as addresses, PayPal accounts, and IBANs. Thus you're in scope of the GDPR. The GDPR does have an exception when data is processed for “purely personal or household purposes”, but that very likely does not apply to you.</p>
<p>The German Datenschutzkonferenz (DSK), a cooperation of the German supervisory authorities, has published a handout on information obligations, listing which information has to be provided in a privacy notice: <a href="https://datenschutzkonferenz-online.de/media/kp/dsk_kpnr_10.pdf" rel="nofollow noreferrer">https://datenschutzkonferenz-online.de/media/kp/dsk_kpnr_10.pdf</a></p>
<p>Such a privacy notice can be fairly short if you're don't doing anything special, in particular if you only use the data as necessary to fulfil the sale contract and then as legally required (e.g. for keeping financial records). There are privacy notice generators that can help with the boilerplate, but be aware that some are significantly outdated, and that in any case you have to fill in the information about your concrete processing activities. You have guessed correctly that you will need to inform your customers about your data retention periods.</p>
<p>Your privacy notice will get more complicated if you also want to use this data in other ways, for example for marketing purposes. That would also require you to think about appropriate legal bases (e.g. legitimate interests, or consent).</p>
