Privacy Policy

FreshLink Market respects your privacy. This policy explains how we collect, use, retain, and protect personal data, in line with Algerian Law 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, and its implementing decrees.

1. Who We Are (Data Controller)

FreshLink Market is a marketplace intermediary between farmers and buyers in Algeria, operated by[Legal entity — to be filled after formal registration], with registered office at [Registered address], trade-register entry [رقم السجل التجاري / Trade Register No.].

Data-protection contact: support@freshlinkmarket.com

2. The Data We Collect

2.1 Data you provide

At sign-up:

• Full name, email address, phone number
• Account type (farmer or buyer)
• Wilaya (region)
• Company name and trade-register number — for buyers
• Farm name, specialty, area, certifications — for farmers
• Password — stored encrypted with bcrypt (we never see plain text)

While using the service:

• Your products, orders, invoices, financial transactions
• Messages exchanged with other parties on the platform
• Ratings, complaints, attached documents (product photos, delivery certificates)
• Delivery addresses, registered payment methods (we store a partial token, not the full number)

2.2 Data we collect automatically

• IP address, browser type, operating system
• Visit timestamps, pages viewed
• Session cookies (see Section 6)

2.3 Data we do NOT collect

• Full bank-card numbers (processed directly by the payment provider)
• Precise geolocation (we keep wilaya-level only)
• Sensitive data (health, religion, ethnic origin, union membership) except where strictly necessary and with your explicit consent

3. Legal Basis for Processing

In line with Article 7 of Law 18-07, we rely on one of the following bases:

• Contractual performance: data needed to deliver the service (account, orders, invoices)
• Legal obligation: invoices and tax records (mandatory 10-year retention under Algerian law)
• Explicit consent: marketing notifications, transactional emails (you can withdraw at any time)
• Legitimate interest: security, fraud prevention, platform performance

4. How We Use Your Data

• Operating the platform: your account, orders, communication with other parties
• Managing escrow and processing payments
• Sending operational notifications (order confirmation, shipping status, password reset, security alerts)
• Managing disputes and mediation
• Legal compliance (issuing invoices, tax records, responding to lawful authority requests)
• Fraud prevention and account protection (IP tracking, suspicious-pattern analysis)
• Service improvement (aggregate analytics without identifying individuals)

We do not sell your data to third parties for marketing purposes. Ever.

5. Who We Share With

We share the minimum amount of data, only when necessary, with:

We sign Data Processing Agreements (DPA) with every provider to ensure your data is protected to a standard at least equivalent to Algerian law.

6. Cookies

We use only two categories:

• Strictly necessary cookies: to keep you signed in (NextAuth) — these are essential and cannot be disabled
• Aggregate analytics cookies: to know which pages are most visited, in aggregate, without identifying individuals

We do not use advertising cookies, do not track you across other sites, and do not share your identifier with ad networks.

7. Retention Periods

• Active account data: for as long as you use the service
• After account closure: account data is deleted within 30 days (except where law requires retention)
• Invoices and tax records: 10 years (legal obligation)
• Messages and transaction logs: 3 years (for dispute resolution)
• Session logs (IP): 12 months for security and fraud prevention

8. Your Rights

In line with Articles 32 and 33 of Law 18-07, you have:

• Right of access: request a copy of the data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): request deletion when no legal basis remains for retention
• Right to portability: obtain your data in a machine-readable format to transfer it to another provider
• Right to object: oppose certain processing (such as marketing notifications)
• Right to withdraw consent: at any time, where processing was based on your consent
• Right to restriction: temporarily halt processing pending verification

To exercise any of these rights, write to support@freshlinkmarket.com describing your request. We will respond within a maximum of 30 days from receipt of a complete request.

If you are not satisfied with our response, you may file a complaint with the National Authority for the Protection of Personal Data (ANPDP).

9. Security Measures

We protect your data with:

• HTTPS/TLS encryption on every exchange
• Password encryption with bcrypt (factor 12) — we never store plain text
• Encryption of sensitive data at rest
• Email-verification and password-reset tokens stored as SHA-256 hashes
• Continuous monitoring of access and security logs
• Daily encrypted backups
• Rate limiting on sensitive endpoints

In the event of a security breach affecting your personal data, we will notify you within 72 hoursas required by Algerian law, and submit a detailed report to the competent authority.

10. Children's Privacy

The platform is intended for adults only (18+). We do not knowingly collect data from minors. If we discover an account belonging to a minor, we delete the data immediately and close the account.

11. International Data Transfers

Some of our providers (such as Resend) may process data on servers outside Algeria. We ensure such transfers are subject to appropriate safeguards (standard contractual clauses or recognised certification schemes), so the level of protection remains equivalent to Algerian law.

12. Changes to This Policy

We may update this policy from time to time to reflect legal or operational developments. We will notify you of material changes by email or in-app notification at least 30 days before they take effect.

13. Contact

For any privacy-related question, or to exercise your rights:

• Email: support@freshlinkmarket.com
• Website: freshlinkmarket.com

Operating company: [Legal entity — to be filled after formal registration]
Registered address: [Registered address]
Trade register: [رقم السجل التجاري / Trade Register No.]