Privacy Policy
General provisions
next2u S.à r.l. - S. ("Company" or "we") processes and protects personal data of registered and unregistered users of next2u: everyone who accesses our website, as well as those who contact the Company via all the means listed on the website ("users" or "you").
This Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and the laws of the Grand Duchy of Luxembourg. We are committed to protecting your privacy and ensuring your personal data is processed lawfully, fairly, and transparently in accordance with GDPR principles.
By providing us with personal data, you consent to its processing in accordance with this policy and applicable GDPR requirements.
Personal Data: any information related to a directly or indirectly identified or identifiable individual (data subject).
Processing of Personal Data: performing actions or a set of actions on personal data, including collection, recording, systematization, accumulation, storage, refinement, updating, modification, retrieval, use, provision, access, blocking, deletion, and destruction, with or without automated data processing tools.
Personal Data Operator: a body or person that, alone or jointly with others, determines the purposes and means of processing personal data. The Company is the operator with respect to the personal data we receive in connection with your use of next2u.
What data we process
You provide us with personal data when:
- Registering on next2u;
- Using next2u services (i.e. posting listings, etc);
- Enabling push notifications;
- Participating in events, research, and surveys;
- Writing or calling us (e.g., contacting support or using the rights holder claim form);
- Communicating with other users;
- Exercising rights or fulfilling obligations under our terms and conditions.
Your device automatically transmits technical data: information stored in cookies, browser information, settings, access dates and times, requested page addresses, website or app activities, device specifications, and IP address.
We also collect the following data as part of our services:
- Link analytics (when using shortened links for sharing): IP address (used for geographic statistics, not stored long-term), browser user agent, referring website
- Saved listings and preferences (your favorites)
- Push notification subscriptions (if you opt in, the browser subscription details we need to deliver web push notifications)
- Reviews you write and receive
- Payment transaction references (processed by Stripe; we never see or store your card details)
- Error reports (technical errors are sent to our error tracking service to help us fix bugs)
- Content processed by AI features (listing text and photos, your username and profile picture, and search queries may be processed by an AI provider for content moderation, automatic translation, search relevance and listing-creation assistance; see Sharing and international transfers and our Sub-processors page)
Other useful links: Terms of Use · Services Agreement · Cookie policy · Sub-processors
Why we process your data
We process users personal data for the following purposes:
- Provide access to next2u and its services (create a profile, post listings, use next2u, and, with your consent, partner services). Data: email, username, address, photos, videos and other data related to next2u services.
- Ensure stable operation and security (improve user experience and quality, marketing activities, develop new features). Data: technical data, behavioral metrics, transaction data.
- Prevent and stop violations (of laws, of our Terms of Use and rules, and to protect users from fraud), including automated anti-fraud and anti-scam checks on listings that analyze technical signals such as the IP address used to post, posting frequency, duplicate content and image fingerprints. Data: technical data (including IP address), listing content and behavioral metrics necessary for fraud prevention and security.
- Provide AI-assisted features and keep the platform safe (automatically moderate listings, usernames and profile pictures; translate listings; improve search and listing-creation assistance). Data: listing text and photos, username, profile picture, search queries. These rely on an AI sub-processor (see Sharing and international transfers). Moderation may involve automated analysis of your content; you can ask us to have a human review any moderation decision that affects you by contacting customer support.
- Fulfill legal obligations (accounting, tax reporting, responses to government inquiries). Data: email, address.
- Respond to your inquiries. Data: email, inquiry content.
- Send you notifications you have enabled (web push and email about your account, listings, messages and saved searches). Data: email, push notification subscription.
- Display personalized offers that may interest you. Data: email, device identifiers, next2u usage data, location data.
- Organize your participation in events, research and surveys. Data: email and voluntarily provided information.
Legal basis for processing
In accordance with Article 6 of the GDPR, we process your personal data on the following grounds:
- Your consent (Article 6(1)(a)): given when registering, logging in, using next2u services or interacting with our interfaces. You can withdraw consent at any time.
- Contractual obligations (Article 6(1)(b)): processing necessary to perform agreements such as our Terms of Use.
- Legitimate interests (Article 6(1)(f)): protecting the Company or third parties, fraud prevention, security, and service improvement, provided this does not override your fundamental rights.
- Legal requirements (Article 6(1)(c)): compliance with regulatory obligations under EU and Luxembourg law.
Sharing and international transfers
In compliance with GDPR Articles 44-49, we may transfer personal data to third parties when necessary to provide next2u services or with your consent. We engage the following categories of recipients:
- Service providers (sub-processors) that process personal data on our behalf under data processing agreements (Article 28 GDPR): our AI provider (moderation, translation, search and listing assistance), analytics, error tracking, payment processing, SMS verification and social sign-in. The complete, up-to-date list (purpose, data and location for each) is on our Sub-processors page.
- Infrastructure provider: OVHcloud hosts our core data in the European Union (France, Germany and Luxembourg), as a processor under a data processing agreement (Article 28 GDPR).
- Stripe (Stripe Payments Europe, Ltd.): payment processing. Card details are entered on Stripe's own systems; we only receive transaction references.
- Government authorities, where required by law.
Your content is public
When you publish listings, reviews or profile information on next2u, the personal data they contain becomes available to an indefinite number of people. You disclose it yourself; the Company does not transfer it. We process it to fulfill the agreement concluded at your initiative.
The purpose of posting data on next2u is to establish contact with a potential buyer interested in a listing. Other users may not process your data for any other purpose. This means others cannot:
- call or message you to offer their own goods or services;
- copy your data to post it on other services;
- use next2u users' information for scoring purposes.
How we protect your data
In accordance with GDPR Article 32, we implement appropriate technical and organizational measures to ensure a level of security suited to the risk.
To protect personal data, we:
- publish a comprehensive data processing policy in line with GDPR transparency (Articles 12-14);
- maintain internal acts on processing and protection (accountability, Article 5(2));
- train employees on data protection and keep GDPR awareness ongoing;
- regularly audit our processes for GDPR and Luxembourg-law compliance;
- conduct Data Protection Impact Assessments where required (Article 35);
- apply data minimization and need-to-know access;
- use pseudonymization, encryption, access controls and regular security testing.
Our choices are guided by legal obligations, a risk-based approach (Article 32), industry best practice, accountability (Article 5(2)), and the priority of data subjects' rights.
Where your data is stored
Our core technical infrastructure is provided by OVHcloud, with primary data stored in data centres within the European Union (France, Germany and Luxembourg), so the majority of processing takes place within the EEA. A limited number of sub-processors process certain data outside the EEA (in particular in the United States) for specific features such as AI processing and social sign-in; these transfers are protected by Standard Contractual Clauses, as described under Sharing and international transfers and on our Sub-processors page.
How long we keep your data
We retain your personal data only for as long as necessary to fulfill the purposes it was collected for (storage limitation, Article 5(1)(e)).
| Data type | Retention | Reason |
|---|---|---|
| Account data (email, username, profile) | Until account deletion + 1 year | Legal requirement |
| Listings | Until deleted by user or account deletion | Service provision |
| Chat messages | 3 years after last activity | Contractual disputes |
| Payment records | 10 years | Luxembourg tax law |
| Reviews | Until account deletion | Service provision |
| Favorites | Until account deletion | Service provision |
| Link click analytics | 90 days, then anonymized | Legitimate interest |
| Anti-fraud signals (creation IP, fraud score) | 12 months | Legitimate interest (fraud prevention) |
| Support requests | 3 years | Legal claims limitation |
| Cookie consent records | 3 years | Compliance documentation |
We stop processing your data once the purpose is achieved, on expiry or withdrawal of consent, if processing is found unlawful and cannot be made lawful, or if the Company is liquidated (unless the law provides another ground). After the retention period, data is automatically deleted from our systems; non-automated records are securely destroyed.
Deleting your account
To delete your account and all the data in it, go to Settings > Privacy & Data and select account deletion. If you have unfinished transactions, complete them first. We will stop processing and delete your data as required by law; we cannot restore it afterwards. The law requires us to keep certain user information for at least a year after deletion.
Your rights
Under the GDPR, you have the following rights over your personal data:
- Access (Article 15): request information about the data we hold about you.
- Rectification (Article 16): correct inaccurate or incomplete data.
- Erasure (Article 17, "right to be forgotten"): request deletion in certain cases.
- Restriction (Article 18): limit processing in specific situations.
- Portability (Article 20): receive your data in a structured, common format and transmit it elsewhere.
- Objection (Article 21): object to processing based on legitimate interests or to direct marketing.
- Withdraw consent (Article 7(3)): at any time, without affecting prior lawful processing.
- Lodge a complaint (Article 77): with the CNPD or your local supervisory authority.
Data controller
next2u S.à r.l. - S.
14A Rue du Baumbusch
L-8213, Mamer, Luxembourg
For privacy inquiries, contact customer support through the website.
Supervisory authorities
You have the right to lodge a complaint with a data protection authority. Depending on your country of residence, you may contact:
Luxembourg (Lead Authority)
Commission Nationale pour la Protection des Données (CNPD)
15, Boulevard du Jazz, L-4370 Belvaux
Website: cnpd.public.lu | Email: info@cnpd.lu
Belgium
Autorité de protection des données (APD/GBA)
Rue de la Presse 35, 1000 Brussels
Website: dataprotectionauthority.be | Email: contact@apd-gba.be
France
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07
Website: cnil.fr
Germany
Bundesbeauftragter für den Datenschutz (BfDI)
Graurheindorfer Str. 153, 53117 Bonn
Website: bfdi.bund.de | Email: poststelle@bfdi.bund.de
(Or contact your state data protection authority)