Your conversation with us

The contact page provides one ongoing conversation per account. Messages and screenshots are encrypted in storage for the life of the account, subject to the existing inactive-account retention period. Your data export includes the conversation and screenshots. Deleting the account removes its conversation, screenshots and notifications. Images are resized and re-encoded to remove embedded metadata; only you and authorised support staff can view them. Do not include passwords, sign-in codes or identity documents. We use these details to answer your questions and handle your sale.

When we reply, we email a link to your conversation. An account-bound link replaces the email code for up to 30 minutes; your password is still required when signed out. We can see when our message was displayed in your active chat, not whether you understood it. Customers do not see our read status. Conversations are excluded from session replay.

Who uses your details?

SlabsOnSlabs (Dutch Chamber of Commerce number 93172311), Javaplein 10B, 1094 HW Amsterdam, is responsible for processing personal data in QuickSell. Our contact information is on the contact page.

What do we store, and why?

We ask for your full legal name, address, date of birth, IBAN, email, password and an email recognition phrase. Your name and address prepare and support a sale and shipping. Your IBAN is optional at registration and used for payout; you can add it later. Your date of birth checks whether your declared age is at least 18. Email is needed for login, verification and recovery. We place the recognition phrase at the top of automated account emails so you can spot a mismatched message more quickly. We also record when you accepted the declaration and terms. For a sale we store the exact agreement, transaction summary, contract version and your explicit consent encrypted. You can download your contract copy from the offer.

We process details needed to provide your account and requested sale to perform or prepare a contract. Limited security records serve our legitimate interest in protecting accounts and personal data. Required accounting records are processed under legal obligations. We do not use account details for advertising.

IP addresses and security

At registration, sign-in and account use, we record your IP address and the time to detect abuse and protect access. IP addresses are encrypted at rest. We do not use them for advertising or to infer identity or ownership of scans.

Ordinary IP history and administrator records are retained for up to 90 days. Active IP blocks remain while applicable; after removal or expiry, the record is deleted within 90 days. Several people can share one IP address. Contact us for a review if you believe a block is incorrect.

How are your details protected?

Connections to the account service are encrypted. Passwords are hashed with Argon2id. Your name, address, date of birth, IBAN, email and email recognition phrase are encrypted in storage; keys are kept outside website files. The scan worker cannot access your account details. Authorised administrators can view and manage them through a separately secured control panel. Access and changes are logged. Resell Center has no direct access to the account database.

Login requires your password and an email code. Changes, downloading your data and deleting your account require another password check and email code. The recognition phrase is not a password, login code or identity question. We will never ask you to share it with us.

How long do we keep data?

Unverified registrations are deleted automatically within 24 hours. Accounts remain while you use them and are deleted after 2 years without use. You can also delete your account yourself. Security events are kept for up to 90 days. Codes expire after 10 minutes; confirmation and reset links after 30 minutes.

Scan photos and scan results are kept separately for up to 30 days. The accepted agreement and packaging photos belong to the separate purchase dossier for shipping and potential claims, not those temporary scans. They are stored encrypted with that dossier, including after account deletion. Contact us for access or a deletion request. Encrypted account backups expire within 30 days. Deletion records prevent removed accounts from returning when a backup is restored.

Completed purchases and returns create financial records: amounts, bank receipts, corrections and refunds. Required basic accounting records are retained for seven years under Dutch tax rules. The separate encrypted purchase dossier also contains inspection evidence, expressly accepted amendments, case review messages, return addresses, notices and consent. We retain non-financial evidence while needed to complete the sale or return, handle an outstanding claim or dispute, or establish and defend legal rights; necessity is assessed separately from the accounting period. This does not automatically require keeping every photograph, address or your entire account for seven years. Dossier retention is reviewed manually, not removed by the temporary-scan deletion schedule. Account deletion does not end an unresolved case. Contact us through the contact page or our postal address for access or a deletion review after account deletion; we verify your identity before releasing records.

Who receives data?

QuickSell, your account, scan photos and session recordings are hosted by OVHcloud in Frankfurt, Germany. Encrypted account backups are also kept on our server in the Netherlands. Card recognition runs on that Dutch server. Account details are not shared with PSA, PriceCharting or the scan worker. We use OVHcloud Zimbra, with email hosting in France, for verification, login codes and password recovery. OVHcloud processes your email address and these account messages, including your recognition phrase. We send them from noreply@slabsonslabs.eu. These security messages do not include your postal address, date of birth or IBAN. The separate approval email does include a retainable copy of the sale agreement and transaction summary, including address, date of birth and a masked IBAN. It never includes the full IBAN.

Card recognition and market lookups use PSA, PriceCharting and Zyte with card and certificate information. To choose a language automatically, your browser requests the country of your IP address from country.is. That service can see your IP; we only keep the country code temporarily in your browser.

We arrange data protection agreements with processors. Before using services outside the EEA, we check applicable international transfer rules and safeguards.

Cookies and browser storage

We use necessary session cookies for accounts and form protection. JavaScript cannot access these cookies. After 30 minutes without account activity you need to log in again; a session lasts up to 12 hours. Your language choice is saved locally in your browser, and the country code for up to 30 minutes per tab. We do not use advertising cookies or third-party tracking. For our own website statistics, we reuse the random queue cookie. We count visits, page views, scans, claims, completed buy-ins and queue depth. A local IP database may estimate country, region and city. Historical statistics contain no form content or full IP address; a keyed IP hash allows test traffic to be excluded. To monitor current website traffic, authorised operators can also see and copy the IP address of active visitors. These addresses are encrypted in a separate temporary cache, expire from the live view after 45 seconds without a visible-page heartbeat, and are cleared during traffic processing or scheduled maintenance. They are not included in historical statistics or account backups. We retain these limited statistics for up to two years. Only authorised operators can view them.

Your rights

You can view, correct, download and delete account details in your account. You may also request access, correction, restriction, deletion or transfer of your data, and object to processing based on legitimate interests. Use the contact page to reach us. We normally respond within one month. You may complain to the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

If something goes wrong

We investigate security incidents, limit their impact and record them. Where a breach must be reported, we notify the Dutch Data Protection Authority within 72 hours when required. We also inform you if it is likely to pose a high risk to you.

Email support and account recovery

You can email support@slabsonslabs.eu without an account. We use your sender address, subject and message to answer your question. Emails appear as anonymous conversations in our secured admin workspace: anonymous means not linked to a signed-in account, not that your email address is hidden. We do not automatically link email to an account, and replies are sent by email. Email attachments are not imported into the conversation. Screenshots uploaded directly in account chat are available there. Email is handled by OVHcloud Zimbra in France. The local email conversation is deleted after one year without activity; original messages remain in the mailbox until we delete them there.

Account recovery requires a valid, matching ID through a secure upload and manual review. This protects your account and any sale and payment details under our legitimate interest in security. Only your full legal name, date of birth, photo and expiry date need to be visible. Cover your national identification number or BSN, document number, signature, address and machine-readable lines or codes. Add the purpose and date as a watermark. Never send your ID by email or chat. Contact us before uploading if you cannot complete this check; we do not restore access without sufficient identity verification.

We store the ID image encrypted outside account backups. Only authorised staff can access it. The image is deleted after approval or rejection, or when the invitation expires, no later than seven days after the invitation. We keep a minimal review record with the compared name and date of birth, decision, reviewer and timestamps for up to 90 days; encrypted backups of that record expire within 30 days. After approval, you have 24 hours to complete recovery. Privacy-rights requests do not routinely require an ID copy: we verify identity appropriately and ask for no more than necessary. Contact support@slabsonslabs.eu for these requests.