Privacy Policy
How we handle personal data on UsedMachinery24
Last updated: 2026-10-04 · See also our Cookie Policy.
1. Who is responsible for your data
The controller of your personal data is:
| Controller | UAB UsedMachinery24 |
|---|---|
| Registration code | 000000000 |
| VAT number | LT100000000000 |
| Registered address | Vilnius, Lithuania |
| E-mail for data protection matters | [email protected] |
| Phone | +370 600 00000 |
| Website | usedmachinery24.com |
We operate a marketplace for used industrial machine tools. This policy explains what we do with personal data when you browse the site, send us an inquiry, or register an account to list machines.
2. What data we collect and why
2.1 Visiting the site
- Technical data from our web server logs: IP address, date and time of the request, the page requested, HTTP status, referring page and browser identification (user agent). This is created automatically by the web server and is used to keep the site running and to detect abuse.
- Cookies and similar storage: described separately in the Cookie Policy, which lists every cookie actually in use, what it is for and how long it is stored. That list is rebuilt automatically every day by an audit script.
- Aggregated statistics: how many times a listing or an article has been opened. This is a counter on the listing, not a profile of you.
2.2 Sending an inquiry about a machine or using the contact form
- Your name, e-mail address and — if you choose to provide them — telephone number and country.
- The content of your message and which listing it concerns.
- The IP address from which the message was sent, kept as a safeguard against abuse of the form.
We use this only to answer you and, where the listing belongs to another seller on the platform, to pass your message to that seller so they can reply. The seller sees the details you entered in the form, because that is how they contact you back.
2.3 Registering an account
- Name, e-mail address and password (stored only as a cryptographic hash — we never see or store the password itself).
- Optional company name, telephone number and country.
- Account status, role, the time your e-mail address was confirmed and the time of your last sign-in.
- Records of failed sign-in attempts (e-mail address and IP address), used to slow down password guessing.
- A log of significant actions in your account — for example creating or editing a listing, or an administrator approving it — including the IP address from which the action was taken.
2.4 Publishing a listing
The listing content you enter — machine description, specifications, photographs, price, location — is published on the site and is visible to everyone. Your name or company name is shown next to the listing as the seller. Do not put personal data into the description or photographs that you do not want to be public.
2.5 E-mail we send
We log the recipient address, subject and the result of every message the site sends (account confirmations, password resets, inquiry notifications, decisions on listings) so that we can tell whether mail is being delivered. The content of inquiry messages is stored with the inquiry itself.
3. Legal grounds
| Purpose | Legal ground (GDPR) |
|---|---|
| Answering your inquiry and the pre-contractual communication that follows | Art. 6(1)(b) — steps prior to a contract; Art. 6(1)(f) — our legitimate interest in responding to business enquiries |
| Running your account and publishing your listings | Art. 6(1)(b) — performance of the contract (our terms of use) |
| Security: server logs, login throttling, action log, anti-abuse measures | Art. 6(1)(f) — legitimate interest in a secure service |
| Non-essential cookies and any statistics or marketing tools | Art. 6(1)(a) — your consent, which you may withdraw at any time |
| Accounting and tax records where a transaction takes place | Art. 6(1)(c) — legal obligation |
4. How long we keep it
| Data | Retention |
|---|---|
| Account data and listings | While the account exists. If you delete your account, the account data is erased immediately and your listings are either removed or detached from your identity. |
| Inquiries you send us | Up to 24 months after the last correspondence, unless a longer period is needed for a concluded transaction. |
| Failed sign-in records | 90 days. |
| Account action log | 12 months. |
| Mail delivery log | 12 months. |
| Web server logs | Up to 12 months. |
| Record of your cookie consent | Up to 24 months, as evidence of the choice you made. |
| Accounting documents | As required by Lithuanian law (normally 10 years). |
A daily maintenance task deletes records that have passed these periods.
5. Who else sees it
- The seller of a machine you write to, where the listing belongs to another user of the platform.
- Our hosting provider, which operates the server and the mail server on our behalf as a processor.
- Transport, customs and service partners, but only the details necessary for a specific job you have asked us to arrange.
- Accountants, auditors and legal advisers, where required.
- Public authorities, where we are legally obliged to disclose information.
We do not sell personal data and we do not share it for someone else's advertising.
6. Transfers outside the EEA
Our website and mail are hosted in the European Union. We do not routinely transfer personal data outside the European Economic Area. If a transfer becomes necessary — for example because you ask us to arrange shipment to a non-EEA country — it takes place under the safeguards allowed by Chapter V of the GDPR, such as standard contractual clauses.
7. Your rights and how to use them
Under the GDPR you have the right to: access your data; have inaccurate data corrected; have data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect processing that already took place.
7.1 Directly in the system
If you have an account, you can do most of this yourself, immediately:
- Account → Profile — correct your name, company, telephone and country, or change your password.
- Account → My data — download everything we hold about you as a single machine-readable file, or delete your account and its data.
- Account → My listings — edit or delete your listings at any time.
- Cookie settings — change or withdraw your cookie consent.
7.2 By e-mail
You do not need an account to exercise your rights. Write to [email protected] and tell us what you want — a copy of your data, a correction, erasure, restriction, or an objection. Please write from the e-mail address we have on file, or describe your request well enough for us to find the data (for example the inquiry you sent and roughly when).
We answer within one month of receiving the request. If the request is complex we may extend this by two further months and will tell you if we do. We may ask for additional information to confirm your identity before we act — not to obstruct you, but to avoid giving your data to somebody else. There is no charge for a normal request.
7.3 Complaints
If you believe we are handling your data unlawfully, please tell us first — most problems are a misunderstanding we can fix quickly. You also have the right to lodge a complaint with the supervisory authority:
| Authority | Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of Lithuania) |
|---|---|
| Address | L. Sapiegos g. 17, 10312 Vilnius, Lithuania |
| [email protected] | |
| Website | vdai.lrv.lt |
If you live in another EU or EEA country, you may also complain to your local supervisory authority.
8. Security
The site is served over an encrypted connection (HTTPS). Passwords are stored as bcrypt hashes. Forms are protected against cross-site request forgery, uploaded images are re-encoded and stripped of embedded metadata, repeated failed sign-ins are throttled, and the database credentials and configuration files are kept outside the public web directory. Access to the server and to administrative pages is limited to the people who need it. No system is perfectly secure; if a breach ever affects your rights we will notify you and the supervisory authority as required by law.
9. Children
The site is aimed at businesses and professionals. It is not intended for children, and we do not knowingly collect data from them. If you believe a child has provided us with personal data, write to us and we will delete it.
10. Changes to this policy
We update this policy when the site or the law changes. The date at the top shows the current version. Material changes that affect cookies will also bring the consent banner back, so you can review your choice.
Questions about anything on this page? Write to [email protected].