Privacy notice

Controller and contact

The controller identified for SBAAAM! is 10ten, Via Maffeo Pantaleoni 5, Frascati (Rome), Italy. For personal-data requests contact assistenza@sbaaam.com. Do not send passwords or OTP codes.

Inventory and submitted content

Items, photos, private locations, notes and drafts in your personal inventory stay on your device. Documents cannot become listings.

The server receives content you choose to send to prepare or publish a listing and use the marketplace. Signing in does not create a remote backup of your local inventory.

Data processed

• Account: email, optional public name and technical sign-in verification data.
• Listings: submitted information and photos, category, condition, amount and selected Italian postcode.
• Negotiations: offers, counteroffers, outcomes and update preferences.
• Security and support: reports, blocks, support requests, IP address and technical information needed to handle requests and abuse.
• Android app: if you enable remote notifications, the token and technical identifiers needed for delivery and association with your account.

Purposes and legal bases

Accounts, listings and negotiations provide the requested functions, based on performance of the service or requested pre-contractual steps.

Access controls and abuse prevention serve the legitimate interest in protecting users and the service through proportionate measures. Requirements imposed by law rely on the relevant legal obligations.

Service updates about offers follow account preferences. App notification permissions can also be managed in the operating system. These updates are not an advertising newsletter.

Publication and recipients

A seller’s public name, listing content, photos, amount and postcode can be viewed in the marketplace. Avoid adding contact details, documents or precise addresses to public fields. Email addresses and negotiations are not published in the marketplace.

The service uses Aruba for hosting, database and email, and Google Firebase Cloud Messaging for enabled Android notifications. Technical providers and authorised personnel may process data needed for their functions. Authorities may also receive data where required by law.

Firebase Cloud Messaging uses global infrastructure: installation identifiers and technical data may also be processed outside the European Economic Area. Google states that it participates in the EU-US Data Privacy Framework; the provider’s data processing terms also describe the applicable contractual safeguards. See the Firebase sources below, or ask the controller for details and a copy of the relevant safeguards. Disabling push notifications does not automatically erase every identifier already processed by the provider.

Retention

Sign-in codes are valid for 10 minutes; sessions last no longer than 7 days. Expiry does not automatically delete every technical record.

For accounts, listings, negotiations and support, the criterion is the period needed to provide the service, handle requests or disputes, and meet applicable obligations. Necessity, account status and the request affect retention. You can request information and erasure using the contact above.

Backups support continuity and recovery. A data request includes checking relevant backup copies: instant deletion from every backup is not promised.

Account deletion

You can start the request from Delete account in the app, in Profile or in the website footer, even without the app installed. We require a code sent to the account email and your explicit confirmation.

After confirmation we disable the account, revoke sessions and push registrations, and make listings unavailable. The deletion process removes the email, public name, credentials, preferences, listings and published photos; a receipt lets you check the actual outcome. Your private on-device inventory is not deleted.

Counterparties and report handling may retain minimal pseudonymous references, such as an identifier, amount, date and agreement outcome, without retaining the deleted account’s public name or email. Deletion does not cancel obligations already arising between people. When payment-provider data or other constraints need review, the receipt shows that support must handle the request rather than reporting deletion as completed.

Backups and any retention obligations are handled as described in Retention. For further requests or problems with this process, contact assistenza@sbaaam.com.

Required data and choices

An account is not required to view public listings. Email and code verification are needed for restricted features; without them we cannot open a session.

An additional public name, publishing items and enabling notifications are user choices. Submitted content must also respect other people’s privacy.

Rights and requests

Where applicable, you may request access, rectification, erasure, restriction, portability or object to processing; you may withdraw consent where processing relies on it. You can complain to a competent authority, including in the country where you live or work.

Write to assistenza@sbaaam.com with your request and account reference. We will check it comes from the person concerned, asking only for what is necessary. Do not send credentials.

Your private inventory is not used for behavioural advertising or to decide which items to publish. Publication remains an explicit choice.

Cookies and changes

Technical sign-in and language cookies are described on the Cookies page. New purposes or providers will require an updated notice and, where necessary, a further user choice.