Privacy Policy

1. Scope

This policy applies when you use Sorisomun, including when you create or manage an account, apply to become a Seller, create a profile or listing, use Somun Community or messaging features, place or fulfil an order, contact support, submit a report, or otherwise interact with the platform.

Some third-party services used by Sorisomun may also process personal data under their own privacy terms when they act as an independent controller. This is particularly relevant to certain payment and authentication activities.

2. Data controller and privacy contact

Sorisomun Market, established in the Netherlands and trading as Sorisomun, is the controller for the personal data described in this policy where Sorisomun determines why and how that data is processed.

• • Country of establishment: Netherlands
• • KVK number: 42141357
• • VAT ID: NL005528645B67
• • Privacy contact: sorisomun.market@gmail.com

Privacy questions and requests can be sent to sorisomun.market@gmail.com.

3. Personal data we process

4. Where the data comes from

We receive personal data:

• • Directly from you when you create an account, profile, application, listing, order, message, post, report or support request
• • From other users where necessary for a transaction, conversation, report or dispute
• • From payment, authentication, hosting, email, shipping and other service providers when they provide information needed to operate the platform
• • Automatically through necessary technical logs and platform interactions

5. Why we process personal data

• • Create, authenticate and manage user accounts
• • Provide profiles, listings, community and messaging features
• • Review Seller applications and administer Seller accounts
• • Process orders, payments, shipping, delivery, cancellations, returns and refunds
• • Send service, order, security and account communications
• • Prevent fraud, abuse, spam and unauthorised access
• • Moderate content, investigate reports and handle claims or disputes
• • Maintain, debug, secure and improve the platform
• • Keep records and comply with tax, accounting, payment, reporting and other legal obligations
• • Establish, exercise or defend legal claims where necessary

6. Legal bases

Depending on the processing activity, we rely on one or more of the following legal bases under the GDPR:

• • Contract: processing necessary to provide the account, marketplace, communication, payment, order and Seller services you request.
• • Legal obligation: processing needed to comply with applicable tax, accounting, payment, reporting, regulatory or lawful-authority requirements.
• • Legitimate interests: protecting Sorisomun and its users, preventing fraud and abuse, moderating content, resolving disputes, keeping the service secure and reliable, and improving platform operation where those interests are not overridden by your rights and freedoms.
• • Consent: where we specifically ask for consent, for example for optional non-essential cookies, optional communications or device/browser permissions when consent is legally required.

Where processing is based on legitimate interests, you may have the right to object. Where processing is based on consent, you can withdraw that consent at any time without affecting processing that was lawful before withdrawal.

7. Public and private information

Information you intentionally publish in a public profile, artwork listing, Somun post or public comment may be visible to other users and visitors. Public content may also be shared through links or indexed by search engines where technically available.

Direct messages, saved shipping addresses, payment references, internal reports and other non-public account or order information are not intended to be public. They are accessed only where needed by the relevant users, Sorisomun administrators or service providers for the purposes described in this policy.

8. Service providers and recipients

We disclose personal data only where necessary for the platform or where required by law. Categories of recipients include:

• • Clerk for authentication and account services
• • Supabase for database, storage and backend infrastructure
• • Stripe for payment processing, payment status, refunds and related payment services
• • Sendcloud for shipping options, pickup points, shipping labels, shipment data and tracking. For end-customer shipping data processed through the integration, Sendcloud acts as a processor on Sorisomun's instructions under its data-processing terms.
• • Carriers and delivery partners that receive the recipient, address, contact and shipment information necessary to perform delivery
• • Resend for transactional and service email delivery
• • Vercel for website hosting, delivery and infrastructure services
• • Buyers and Sellers where information is necessary to complete a transaction, delivery, return, dispute or communication
• • Professional advisers, insurers, auditors or authorities where reasonably necessary or legally required

Some providers, including payment or authentication providers, may act as an independent controller for specific processing they carry out under their own legal obligations and privacy terms.

Sorisomun does not sell personal data.

9. International data transfers

Some of our service providers or their subprocessors may process personal data outside the European Economic Area. Where GDPR transfer rules apply, Sorisomun relies on the transfer safeguards made available under the relevant provider arrangements, such as an applicable adequacy decision, the EU-U.S. Data Privacy Framework, or European Commission Standard Contractual Clauses, as appropriate.

You may contact us if you want more information about the safeguards used for a particular category of transfer.

10. Retention periods and criteria

We keep personal data only for as long as it is needed for the purpose described below, unless a longer period is required by law. Where an exact period is not possible, we use the stated criteria and remove or anonymise the data when that purpose ends.

• • Account, profile and optional demographic data: retained while the account is active or until you edit or clear the optional field. When account deletion completes, the current deletion flow removes or anonymises direct profile data such as name, email, country, public Based in choice, birth year, gender, affiliation, profile images, portfolio data and saved delivery addresses. A minimal deleted-account or security record may remain only while needed to prevent abuse, enforce restrictions, handle disputes or meet legal duties.
• • Community content and messages: Somun posts, comments, likes and associated uploaded content are removed through the account-deletion flow. Direct messages may remain in the other participant's conversation with the sender shown as a deleted user where needed to preserve conversation, transaction, safety or dispute context; they are kept only while those purposes remain relevant.
• • Seller application and compliance records: portfolio assets are removed through account deletion. Application, eligibility, approval, fraud-prevention or compliance records are kept while the Seller relationship or a related review is active and afterwards only while needed for repeat-abuse prevention, legal claims or a legal duty.
• • Orders, payments, refunds and accounting records: retained for 7 years where Dutch fiscal administration rules apply. Where a 10-year statutory record period applies, including qualifying One Stop Shop records, the longer period is used.
• • Shipping and delivery data: saved delivery addresses are removed through account deletion. Recipient, label, tracking and delivery data that forms part of an order is retained with the relevant transaction only as long as needed for fulfilment, claims, accounting or another legal duty. Sendcloud and carriers may also retain data under their own processor or legal retention schedules.
• • Reports, moderation and disputes: retained while the matter is open and afterwards only while needed to enforce a decision, identify repeated abuse, satisfy a legal requirement or establish, exercise or defend a legal claim.
• • Technical and security data: retained for the configured operational or security period of the relevant system or infrastructure provider. If a log is isolated for a security, fraud or abuse investigation, the relevant copy may be kept until that investigation and any directly related claim or legal duty ends.
• • Optional acquisition attribution: browser attribution is kept for up to 90 days. With separate optional 16+ analytics permission, we also record browser-scoped pseudonymous visit sessions: acquisition source/medium/campaign, whether a product detail or community post was opened, and whether active engagement was observed. With fresh consent, pseudonymous unique artwork and Somun community post views also contribute to community and artwork discovery rankings. These session records exclude account ID, email, IP address, full page contents, and advertising cookies. They are retained for no longer than 90 days, with daily deletion of expired sessions and consented guest artwork and community-post views. Withdrawing permission also requests removal of this browser's identifiable session and guest artwork and Somun-post view history. Session counts cannot identify the same visitor across devices. If you sign in while optional attribution is enabled, the consented first- and last-touch attribution may be linked to your account for acquisition analytics while consent remains active. When a paid order is created, Sorisomun may also preserve a transaction-specific copy of the consented acquisition source so later campaign reporting does not change when your account attribution changes. Account-linked attribution and these optional order attribution snapshots are removed when you withdraw this consent while signed in or through the account-deletion flow.

11. Your GDPR rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• • Request access to your personal data
• • Correct inaccurate or incomplete personal data
• • Request erasure of personal data
• • Request restriction of processing
• • Object to processing based on legitimate interests
• • Receive certain data in a portable format
• • Withdraw consent where processing relies on consent
• • Lodge a complaint with a competent data-protection authority

To exercise a privacy right, email us at sorisomun.market@gmail.com. We may need to verify your identity before completing a request.

Sorisomun is established in the Netherlands. You may lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, without affecting any other administrative or judicial remedy available to you.

12. Cookies and similar technologies

Sorisomun uses cookies and similar technologies that are necessary to provide authentication, session continuity, security, payments and core platform functionality. Some service providers may also use necessary technologies when providing those services.

With your consent, Sorisomun uses optional first-party acquisition attribution to understand how people find the marketplace. This may store an anonymous visitor identifier, UTM source, medium and campaign labels, referring-site hostname, landing path and attribution timestamps in your browser for up to 90 days. If you sign in while optional attribution is enabled, Sorisomun may link the consented first- and last-touch attribution to your account and may preserve a transaction-specific snapshot when a paid order is created. Sorisomun does not use advertising cookies or fingerprinting for this feature. With your additional consent, the same pseudonymous browser visitor key counts at most one recorded view per artwork or Somun post and contributes to discovery rankings, without storing IP addresses or browser fingerprints in the artwork-view record.

Before you choose, Sorisomun may keep only a sanitized acquisition candidate in temporary page memory so the original landing source can be honored if you opt in. It is not written to browser storage or sent to Sorisomun's database before consent, and it is discarded on a page reload or when you decline.

Optional acquisition analytics is available only from age 16 and remains inactive until the user explicitly confirms that they are 16 or older and chooses to allow it. Birth year is optional. If no birth year is provided, the separate 16+ consent action is the user's age self-attestation. If a saved birth year or legacy age value clearly shows that a signed-in user is under 16, Sorisomun blocks the feature, overrides any prior browser opt-in on that device while signed in, and deletes linked account attribution and optional order-attribution snapshots. A birth year that reaches the 16-year boundary during the current calendar year still relies on the explicit 16+ self-attestation because birth year alone does not reveal the birthday. This rule does not affect processing necessary to provide the account or other platform features under a different lawful basis.

Eligible users can change or withdraw their analytics choice at any time in Privacy choices. Withdrawing consent removes attribution data stored by this feature in the current browser, requests deletion of consented guest artwork and Somun-post views, and, when signed in, removes the account-linked attribution record and optional order attribution snapshots.

13. Security

We use reasonable technical and organisational measures designed to protect personal data, including access controls, authenticated administrative functions, secure hosted infrastructure and encrypted network transport where supported by the relevant services.

No online system can be guaranteed to be completely secure. If we identify a personal-data breach, we will assess and handle it in accordance with applicable legal requirements.

14. Automated processing

Sorisomun uses automated processes for ordinary platform operation, such as rate limits, security controls, notifications and order-state changes. Sorisomun does not currently use solely automated decision-making that produces legal effects or similarly significant effects on users within the meaning of Article 22 GDPR.

15. Children's data

Sorisomun account onboarding requires a separate confirmation that the user is at least 13 years old. Birth year is optional and is not used as a substitute for that account-age confirmation.

Optional acquisition analytics is consent-based and is not available to users under 16. Users aged 13–15 may keep an account but must not enable this optional analytics feature. The analytics action separately requires a 16+ confirmation, and saved demographic age information that clearly indicates under 16 blocks the feature. Necessary account, security, transaction and platform processing may still occur under other applicable lawful bases.

If you believe personal data relating to a child has been processed incorrectly, contact us so we can review the situation and take appropriate steps.

16. Changes to this policy

We may update this Privacy Policy when our services, providers or legal obligations change. We will update the effective date and, where required, provide additional notice of material changes. A privacy notice does not turn processing that requires consent into valid consent merely because you continue using the platform.

17. Contact

Privacy requests and questions can be sent to sorisomun.market@gmail.com. Please identify the account or request clearly enough for us to respond without sending unnecessary personal data.