Markood Privacy Policy — Vendors and Customers

Last updated: 1 October 2026

This Privacy Policy explains how Markood collects, uses, shares, stores and protects personal information relating to customers, Vendors, business owners, authorised representatives and Vendor staff. “You” means any individual covered by this Policy.

It applies when you browse Markood’s websites or apps; create or manage a customer or Vendor account; apply to become a Vendor; operate a store; browse products or offers; place, pay for, collect or receive an order; process orders; request a return or refund; receive Vendor payouts; submit reviews; communicate with Markood; or use the Vendor Dashboard.

Some sections apply to all users. Vendor-specific information, such as business verification and payout details, is collected only where relevant to your role. Features mentioned in this Policy apply only where offered and used.

1. Who is responsible for your information?

The data controller is:

Legal company name: Markood Ab

Organisation number: 559603-1384

Registered address: Ringögatan 13c, 417 07 Göteborg, Sweden

Privacy email: support@markood.com

Markood determines why and how personal information is processed for the purposes described in this Policy. Vendors and payment or delivery providers may be independently responsible for certain processing they undertake for their own purposes, as explained below.

2. Information Markood collects

The information collected depends on whether you are a customer or Vendor, the features you use and, for Vendors, your business structure and product category.

2.1 Vendor and contact information

Markood may collect:

• Full name
• Business email address
• Telephone number
• Position or job title
• Preferred language
• Account profile information
• Authorised-representative information

2.2 Business information

Markood may collect:

• Legal business name
• Trading name
• Organisation number
• Registered business address
• Store or operating address
• Company type
• Business category
• Website and social-media information
• Licences, permits and insurance details

Information relating only to a legal entity may not always constitute personal data. This Policy applies when business information identifies or relates to an individual.

2.3 Tax and VAT information

Markood may collect:

• VAT number
• F-tax or FA-tax status
• Tax residence
• Taxpayer identification details
• Information required for tax reporting
• Transaction and payout information
• Documents supporting tax status

2.4 Owners and authorised representatives

Markood may collect information about:

• Business owners
• Beneficial owners
• Directors
• Authorised representatives
• Account administrators
• Vendor employees

This may include names, ownership percentages, positions, contact details and verification information.

2.5 Identity-verification information

To verify the Vendor and prevent fraud, Markood or an approved verification provider may collect:

• Government-issued identification
• Date of birth
• Nationality
• Photograph or identity-verification image
• Document number and expiry date
• Verification status
• Sanctions or compliance-check results
• Information confirming the right to represent the business

Markood collects only the information necessary for the relevant verification purpose.

2.6 Bank and payout information

Markood or its payment provider may collect:

• Account-holder name
• Bank name
• IBAN or bank-account number
• Clearing or routing information
• Payout-provider account identifier
• Payout status and history
• Refunds, reversals and adjustments

Banking information is used to verify the payout recipient and send Vendor proceeds.

2.7 Store, product and order information

Markood may collect:

• Store name and profile
• Product listings
• Product photographs and descriptions
• Prices and stock
• Orders and cancellations
• Preparation and handover times
• Delivery and pickup information
• Returns and refunds
• Customer complaints
• Vendor performance information
• Customer ratings and reviews
• Commission, fees and payout records

2.8 Device, login and security information

Markood may collect:

• IP address
• Device and browser type
• Operating system
• Login time and activity
• Account changes
• Cookie identifiers
• Security and fraud signals
• Approximate location derived from an IP address
• Crash and diagnostic information

2.9 Communications

Markood may retain:

• Support tickets
• Emails
• Live-chat messages
• Call records where lawfully recorded
• Uploaded documents and attachments
• Complaint and appeal communications
• Communications involving active orders

2.10 Fraud, dispute and compliance information

Markood may collect:

• Suspected fraud indicators
• Chargeback information
• Customer disputes
• Product-authenticity complaints
• Product-safety reports
• Policy violations
• Account restrictions
• Appeal records
• Legal or regulatory enquiries

2.11 Customer account and contact information

Markood may collect:

• Name, email address and telephone number
• Account identifiers, login credentials and authentication information
• Profile image and display name, if provided
• Preferred language and account settings
• Saved addresses and contact preferences
• Marketing choices and consent records

2.12 Customer orders, payments and refunds

Markood may collect:

• Products, quantities, selected options and order instructions
• Order history, order status and pickup or delivery details
• Billing address and invoice information
• Payment-provider references, payment status and limited payment-method details supplied by the provider
• Discounts, promotion codes and offer-redemption records
• Pickup confirmation codes and handover records
• Cancellation, return, refund and dispute details

Payment details are processed through the payment provider used at checkout. The provider’s privacy notice explains its own processing. Do not include payment-card details or other sensitive information in order notes, reviews or support messages.

2.13 Customer location and activity

Markood may process the location or address you enter to show nearby stores, available offers, pickup locations or delivery availability. Where a feature requests access to your device’s precise location, you can allow or refuse that access through your device settings. Refusing access may limit location-based features; you can enter a location manually where that option is available.

Markood may also collect browsing, search, cart, saved-item and offer-interaction activity where those features are used, subject to applicable cookie and consent requirements. Approximate location may be derived from your IP address.

2.14 Reviews and other submitted content

Markood may collect ratings, reviews, photographs, feedback and other content you submit. Content submitted for public display may be visible with your display name or profile image, as indicated when you submit it. Do not publish private contact information or another person’s personal information in reviews.

2.15 Required and optional information

Information needed to create an account, process an order, verify a Vendor or meet a legal obligation will be identified during the relevant process. If you do not provide required information, Markood may be unable to provide that service. Optional information may be left blank.

3. How Markood receives information

Markood may receive information:

• Directly from customers and Vendors
• Through Markood websites, apps, checkout and the Vendor Dashboard
• From Vendor employees or representatives
• From payment providers
• From identity-verification providers
• From delivery companies
• From customers and Vendors involved in an order or complaint
• From public business registers
• From tax or regulatory authorities where legally permitted
• Automatically when you use the platform

If you provide another person’s information, such as a delivery recipient’s details or information about business owners, employees or representatives, you must be authorised to do so and make this Policy available to them where appropriate.

4. Why Markood uses your information

Markood must have a lawful basis for every use of personal information.

4.1 Creating and managing customer and Vendor accounts

Markood uses information to:

• Process Vendor applications
• Create and maintain customer and Vendor accounts
• Approve stores
• Manage account permissions
• Maintain customer and Vendor profiles
• Communicate operational information

The lawful basis is performance of a contract with you, or steps you request before entering a contract. Where you act for a business that is the contracting party, Markood relies on its legitimate interest in administering that business relationship.

4.2 Verification and compliance

Markood uses information to:

• Verify the business and its representatives
• Confirm ownership and authority
• Verify tax and payout information
• Prevent duplicate or fraudulent accounts
• Meet marketplace and tax-reporting obligations
• Conduct sanctions or compliance checks where required

The lawful bases may include legal obligations and legitimate interests in protecting Markood and its users.

4.3 Operating the marketplace

Markood uses information to:

• Publish and operate Vendor stores
• Display products
• Enable customers to browse products and offers and place orders
• Manage orders, pickup confirmations and order-status updates
• Provide delivery options
• Process returns and complaints
• Measure Vendor performance
• Provide reports and analytics

The lawful bases are performance of a contract for requested marketplace services and legitimate interests in administering business relationships and monitoring service quality.

4.4 Payments and payouts

Markood uses information to:

• Process customer payments
• Calculate commissions and fees
• Process refunds
• Send Vendor payouts
• Manage holds and reserves
• Handle chargebacks and payment disputes
• Produce transaction records

Payment and banking information may be processed by the payment provider identified at checkout or during Vendor onboarding.

The lawful bases are performance of a contract for payments and payouts, legal obligations for required financial records, and legitimate interests in resolving payment disputes.

4.5 Fraud prevention and security

Markood uses information to:

• Protect customer and Vendor accounts
• Detect unauthorised access
• Investigate suspicious transactions
• Prevent fraud and platform abuse
• Enforce applicable customer and Vendor policies
• Protect customers, Vendors and Markood

The lawful basis is Markood’s legitimate interest in protecting the platform and its users, or a legal obligation where a specific requirement applies.

4.6 Customer and Vendor support

Information may be used to:

• Respond to support requests
• Investigate order problems
• Resolve returns and refunds
• Handle complaints and appeals
• Communicate policy or account changes

The lawful bases are performance of a contract when support relates to a contracted service and legitimate interests in responding to enquiries and resolving complaints.

4.7 Legal and regulatory obligations

Markood may use and retain information to:

• Meet accounting and tax requirements
• Respond to lawful authority requests
• Meet trader-verification requirements
• Address product-safety obligations
• Establish, exercise or defend legal claims
• Comply with court orders and applicable laws

The lawful basis is compliance with applicable legal obligations, or legitimate interests in establishing, exercising or defending legal claims.

4.8 Improving Markood

Markood may analyse platform activity to:

• Improve customer services and Vendor tools
• Fix errors
• Improve performance
• Understand how features are used
• Develop new marketplace services
• Protect platform stability

Where possible, Markood uses aggregated or anonymised information for analytics. The lawful basis is legitimate interests in improving service quality; consent is used where required for analytics cookies or similar technologies.

4.9 Marketing

Markood may send customers and Vendors information about relevant offers, products, features, services or campaigns where legally permitted. The lawful basis is consent where required, or legitimate interests where applicable law permits marketing on that basis.

When consent is required, marketing will be sent only after consent is obtained.

Customers and Vendors may opt out of promotional communications. Opting out does not stop operational, security, payment or legal messages.

4.10 Location-based features and preferences

Markood uses your chosen location and preferences to show relevant stores, products and available offers. The lawful basis is performance of a contract where this is necessary to provide a feature you request, or consent where required for optional location access or tracking. You can change your location permissions and applicable preferences in your device or account settings.

Where Markood relies on legitimate interests, it considers your rights and interests before processing your information. You may object as explained in section 8.

5. Who may receive your information?

Markood shares information only when necessary for the purposes described in this Policy.

5.1 Payment providers

Payment providers may receive identity, business, banking, transaction and payout information to:

• Process customer payments
• Verify payout accounts
• Send Vendor proceeds
• Process refunds
• Manage disputes and chargebacks
• Conduct fraud and compliance checks

Payment providers may also act as independent data controllers for some processing under their own privacy policies.

5.2 Vendors fulfilling customer orders

The Vendor handling your order may receive your name or order identifier, ordered items, relevant contact details, order instructions, pickup or delivery details, and payment or refund status as needed to fulfil the order and resolve issues. Full payment-card details are not needed for this purpose.

Vendors must protect this information, restrict access to authorised staff and use it only for authorised order-related purposes or their legal obligations. Receiving an order does not authorise a Vendor to add a customer to its marketing list.

Where a Vendor determines its own purposes for processing, such as maintaining its legally required sales records, it acts as an independent controller and must provide the applicable privacy information and respond to rights requests concerning that processing.

5.3 Public store information and reviews

Customers and visitors may see Vendor store profiles, listings, published business contact details and information required by law to identify the seller. They may also see public ratings, reviews and associated display information. Private identity-verification documents and bank or payout details are not part of public store profiles.

5.4 Delivery companies

Approved delivery companies may receive information necessary to:

• Collect orders
• Contact the Vendor or customer where necessary
• Confirm handover
• Complete delivery using the recipient’s name, address, necessary contact details and delivery instructions
• Investigate loss, damage or delays

They should not receive information unrelated to fulfilment.

5.5 Identity-verification providers

Verification providers may process:

• Identification documents
• Business information
• Representative information
• Beneficial-owner information
• Verification and compliance results

5.6 Cloud and technology providers

Markood may use providers for:

• Hosting
• Data storage
• Communications
• Customer support
• Security
• Analytics
• Error monitoring
• Document management

Providers acting as processors must use the information only according to Markood’s instructions and contractual requirements.

5.7 Professional advisers

Information may be shared with:

• Lawyers
• Accountants
• Auditors
• Insurance providers
• Security advisers
• Other professional consultants

They receive only information reasonably necessary for their work.

5.8 Authorities

Markood may disclose information to tax, law-enforcement, court or regulatory authorities when:

• Required by law
• Required by a valid legal order
• Necessary to report unlawful activity
• Necessary to address serious fraud or product-safety risks

5.9 Business transfers

If Markood is involved in a merger, restructuring, financing, acquisition or sale, relevant customer and Vendor information may be disclosed subject to appropriate confidentiality and data-protection safeguards.

Markood does not sell customer or Vendor personal information.

6. International data transfers

Some providers may process information outside Sweden or the European Economic Area.

Where personal information is transferred outside the EEA, Markood will use a legally recognised transfer mechanism, such as:

• An EU adequacy decision
• European Commission Standard Contractual Clauses
• Another approved legal safeguard

Markood will apply additional security measures where appropriate. You may contact Markood to request information about the safeguards relevant to your information and, where applicable, a copy of those safeguards.

7. How long Markood retains information

Markood retains personal information only for as long as necessary for its purpose and applicable legal requirements.

Markood may retain:

• Account information while the customer or Vendor account is active
• Agreement and acceptance records for the relevant contractual period
• Customer orders, payments, refunds and Vendor payouts for accounting and tax requirements
• Identity and verification records while required for fraud, tax or regulatory compliance
• Complaints and disputes until resolution and the expiry of relevant legal-claim periods
• Product-safety and recall records for required safety and regulatory periods
• Security records for a limited period based on the identified risk
• Marketing preferences until withdrawn or no longer required

Retention periods depend on the type of record, the purpose for which it is held, applicable legal requirements and any unresolved claims. You may contact Markood for information about the retention criteria relevant to your records.

Closing a customer account or Vendor store does not mean every record will be deleted immediately. Records may be retained for:

• Accounting
• Tax reporting
• Fraud prevention
• Product safety
• Chargebacks
• Outstanding disputes
• Legal claims
• Regulatory compliance

Information will be deleted or anonymised when it is no longer required.

8. Customer and Vendor privacy rights

Subject to applicable law, an individual may request:

Access

A copy of the personal information Markood holds about them and information about its use.

Correction

Correction of inaccurate or incomplete personal information.

Deletion

Deletion of eligible personal information when Markood no longer has a lawful reason to retain it.

Restriction

Restriction of certain processing in circumstances permitted by GDPR.

Data portability

A portable copy of eligible information provided to Markood and processed automatically based on consent or contract.

Objection

Objection to certain processing based on legitimate interests and objection at any time to direct marketing.

Withdrawal of consent

Withdrawal of consent where Markood relies on consent. Withdrawal does not affect processing that occurred lawfully before withdrawal.

Complaint

A complaint may be submitted to the Swedish Authority for Privacy Protection:

Integritetsskyddsmyndigheten (IMY)

www.imy.se

You may also complain to the supervisory authority in the EEA country where you live or work, or where you believe an infringement occurred.

To exercise a right, contact:

support@markood.com

Markood may request reasonable identity verification before responding.

These rights are not absolute. Markood may retain or continue processing information when required by law or necessary for legal claims.

9. Security and incident reporting

Markood uses reasonable technical and organisational measures designed to protect customer and Vendor information, including where appropriate:

• Encryption during transmission
• Secure password hashing
• Multi-factor authentication
• Role-based access controls
• Security monitoring
• Restricted employee access
• Backups
• Incident-response procedures
• Provider security requirements

No online system can guarantee absolute security.

Customers and Vendors should promptly notify Markood if they suspect:

• Unauthorised account access
• A stolen password or device
• Disclosure of customer information
• Misuse of Markood data
• A security or personal-data incident

Incidents should be reported to:

support@markood.com

10. Automated checks

Markood or its providers may use automated tools to identify:

• Fraudulent accounts
• Suspicious payments
• Account takeovers
• Policy violations
• Unusual transaction activity

Where a decision is based solely on automated processing and produces legal or similarly significant effects, Markood will provide the safeguards required by applicable law, including human review where required.

11. Cookies and similar technologies

Markood may use cookies and similar technologies to maintain sessions, remember preferences, secure accounts and support checkout. Non-essential analytics or marketing technologies are used only with consent where required by law.

Where available, cookie settings allow you to accept, reject or change optional choices. You can also manage cookies through your browser. Blocking essential cookies may prevent account or checkout features from working. Any separate cookie notice should identify the technologies in use, their providers, purposes and durations.

12. Changes to this Policy

Markood may update this Policy to reflect changes in its services, providers or legal obligations.

The updated Policy will be published with a revised “Last updated” date. Material changes will be communicated where required.

13. Contact Markood

Markood Ab

Organisation number: 559603-1384.

Registered address: Ringögatan 13c, 417 07 Göteborg

Support email: support@markood.com