WALLAPOP PRIVACY POLICY

Last revised: 11 November 2025

Wallapop is committed to respecting the privacy of users and the protection and security of your personal data. Therefore, it is very important for us to inform you about the way we collect, treat and protect the personal data provided to us through our website, social networks and application.

Terms written with an initial capital letter shall have the meaning attributed to them in Wallapop’s Terms and Conditions, unless specifically defined in this Privacy Policy.

As set out in Wallapop’s Terms and Conditions, the use of the Platform is reserved to persons over 18 years of age. To this end, Wallapop reserves the right to check the age of Users of the Platform at any time.

Therefore, it is important to inform that Wallapop complies with the data protection regulations of the countries in which we operate, these are Spain, Italy and Portugal, as well as with the European Data Protection Regulation. Because of this, there may be specific amendments referred to in this privacy policy that apply only to users in the countries referred to above and, in some cases, different rules may be established due to applicable local legislation. In the event of a conflict, the specific amendment will prevail.

1. Who is responsible for the processing of personal data?

The processing of data is carried out by and on behalf of Wallapop S.L. (hereinafter, “Wallapop”), which collected your data, with registered office at Avenida Meridiana 89, 6th floor, C.P. 08026, Barcelona (Spain), with tax identification number B-66049057.

If you wish to contact us to resolve any questions, please write an email to privacidad@wallapop.com.

Please note that when through our website or application you make a comment on social networks, the person responsible for the Data you provide through them will be the corresponding social network and not Wallapop, and you must contact said social network to exercise, where appropriate, your data protection rights, which you can consult in the section “What are your personal data protection rights” of this Privacy Policy.

2. When and how do we collect your personal data?

Wallapop collects and processes personal data both from users who have registered on our website and on our application, as well as users who, without having registered, browse or consult them.

Wallapop obtains and uses the IP data and other identifiers provided by the device from which you browse our website or application, as well as the Data you provide when registering as a Wallapop “User”, alongside the Data obtained as a result of your browsing, requests, publications, conversations, searches, purchases, ratings from other users, participation in competitions and the Data derived, where appropriate, from the linking of your registration on our website or application with your Facebook or Google account.

Wallapop may also collect personal data through the use of cookies and other tracking technologies, as described in the Cookie Policy accessible through the following link.

Additionally, if you give us your consent, Wallapop will also process the location of your device to inform you of the items that are closest to you, thus allowing you to enjoy our services in a complete way.

3. What kind of personal data do we collect?

The categories of Data we collect depend on your activity and interaction with Wallapop through the website, app and social media. Also, Wallapop will only collect personal data that is necessary for the purposes we carry out. For this reason, it is important that we explain how and what kind of data we collect:

Categories of data	Collected data
Basic Data	Name and surname, e-mail, telephone number, password.
Registration Data (Information collected when you use the Wallapop website and applications for informational purposes only – Information relating to your use of the website).	In accordance with the choice of cookies provided (if and when applicable), when you use our Platform for informational purposes only (e.g., you do not register on the Platform, shop through the Platform or otherwise submit your data), your Internet browser automatically collects, and transfers to us, certain basic information related to your use of the Platform. Such registration data may include the type and version of your browser, your operating system and interface, the device being used, language preference, the website from which you are visiting us (referring URL), the page(s) you visit on our Platforms, the date and time of your visit, part of your Internet Protocol address (IP), your actions taken on the Platforms, and the name of your access provider. Please also note that certain features of our website and app use location-based browsing in order to provide you with the most relevant information in each case, as well as to offer you certain services. Although location-based browsing is always a user’s choice, in cases where you reject location-based browsing, the Wallapop website and/or application will not be able to offer you location-based functionalities or provide you with location-based content.
Social network data (Information collected when you use Wallapop’s social media for informational purposes only – Information processed by third-party social media providers).	The very use of our Platforms does not generally involve data processing activities (including data transfers) in connection with third party media platforms and/or social networks (such as Facebook and Instagram, “External Platforms“). However, if you accept the provided targeting cookie (if and when applicable) or if you use the sharing buttons that allow you to share Wallapop content with your friends through these External Platforms, the External Platforms may (subject to their own legal basis) collect and otherwise process personal data about you for the purpose of providing you with personalized advertising. For more information on the scope and purposes of the data processed by the External Platform provider, including your rights and settings options to protect your privacy, please refer to the privacy notice of the respective External Platform provider.
Application data (Information collected when you interact with us in other ways).	The information you share with us when you interact with us through application forms. Also when you apply for a job offer.
Basic data and economic transaction data. (Information collected to comply with the DAC7 Directive on fiscal data reporting).	Name, surname, first name, ID number, passport, VAT information, postal address, date and place of birth, bank card details, bank account details, country of residence.
Basic contact details of professionals. (Information collected to comply with the obligation established in Article 30 of the Digital Services Regulation (Regulation (EU) 2022/2065)).	Name, surname, telephone number and contact email, professional address, bank account number and copy of identity document.

4. For what purposes, legitimate basis and conservation do we process your personal data?

In the event that you have not registered on our website and/or in our application, Wallapop will process the IP of your device for the following purposes:

Purpose

Legitimate basis

Storage Period

Identify the origin of the download of our application in order to improve the commercial offer.

Legitimate interest to improve our commercial offer.

Only at the time of such downloading shall it be carried out.

Access your location while browsing our website or using our application to show you the products nearest you.

Express consent by accepting the cookies policy.

Wallapop will treat and keep the location of your device for the purposes indicated previously, as long as you do not disable the geolocation of your device.

In the event that you have registered on our website and/or in our application, the purposes for which we will treat your Personal Data are:

Purpose	Legitimate basis	Storage Period
Manage your registration and user preferences within the registered user area, as well as to provide you with our Platform services that you have requested.	Execution of the existing contract between Wallapop and the user.	The data collected to enable you to register on our Platform will be retained until you delete your account.
To ensure the proper use of our services and products, preventing unlawful use or contrary use of our policies and values, and possibly unsubscribing you as a registered user.	(i) Wallapop’s compliance with certain legal obligations. (ii) legitimate interest of Wallapop in protecting its products and services.	Until the account is deleted.
To recommend products tailored to your browsing habits and searches obtained from using the Platform.	Legitimate interest in recommending products published on Wallapop that may be of your interest.	Until you object to such processing or delete your account.
To send you, by any means, including electronic means, commercial communications in relation to the products and services offered by Wallapop, communications that may be addressed to you based on your consumption, browsing or use habits of the Platform.	Express consent.	Until you withdraw your consent or delete your account.
Manage your participation in the contests we organize in accordance with our legal bases.	Express consent to participate in the contests we promote.	While the contest is in force and, thereafter, for the necessary time to comply with applicable legal obligations (p.ex., tax retention obligations).
To collect and analyze information about your device, networks, and activity on the Platform in order to verify that our services are being used lawfully.	Wallapop legitimate interest, in order to prevent fraud or unlawful acts.	The storage period for this processing is 5 years.
To monitor delivery of the items and/or services purchased through the Platform.	The processing is necessary for the execution of purchases made through the Platform.	Until you delete your account and, after that, for a period of 5 years to address potential legal responsibilities.
To manage and control purchased Subscription Services or Visibility Services.	The processing is necessary for the execution of your Subscription Service or Visibility Service contract with Wallapop.	The data collected as a consequence of contracting these services will be kept until you cancel the services.
To manage complaints and queries about the items and/or services purchased through our Platform.	The legitimate basis for this treatment being the legal obligation of Wallapop in accordance with the regulations for the protection of consumers and users.	Those data obtained as a result of complaints or queries that you may direct to us will be kept until the corresponding complaint or query has been resolved, or for a period of 5 years to ensure its reliability.
Only if you have given us your express consent to this effect through the Cookies Banner , we will communicate your data to third party companies outside of Wallapop in order to show you advertising adapted to your consumption and browsing preferences for our own items and services, as well as those of third parties.	This processing will only be carried out if you give us your consent to do so.	The data relating to your browsing or consumption habits that we may have obtained from third parties will be kept as long as you do not revoke the given consent.
In the event that you reach a certain amount of revenue or sales, we are required to collect and report such revenue, along with certain tax data, collected under the DAC7 Directive.	Collection and reporting of income and tax data due to the legal obligation set out in the DAC7 Directive.	The data will be kept for a period not exceeding 10 years in accordance with the Directive DAC7.
Manage complaints about illegal content hosted on the Platform submitted through the form available here.	Express consent shown when submitting your complaint.	While your complaint resolution is being managed and, thereafter, for the period necessary to address possible legal liabilities.
Manage appeals requesting the review of content and user moderation decisions through the form available here.	Express consent shown when submitting your complaint.	While your complaint resolution is being managed and, thereafter, for the period necessary to address possible legal liabilities.
Collect and verify information about professional users identified on the Platform as required by the Digital Services Regulation.	Legal obligation established in Article 30 of the Digital Services Regulation (Regulation (EU) 2022/2065).	Until 6 months after the professional user’s account termination on Wallapop and, thereafter, for the period necessary to address possible legal liabilities.
Data analysis to measure and and/or improve our marketing campaigns based on how you interact with them.	Wallapop’s legitimate interest in measuring and improving the effectiveness of its marketing campaigns.	During the period strictly necessary for the performance of temporarily limited studies.

In general, when you unsubscribe as a registered Wallapop user, all personal data we have about you will be deleted. However, it is important to note that:

(i) In accordance with applicable regulations, Wallapop will keep, duly blocked, the personal data necessary to address possible legal liabilities.

(ii) Wallapop will retain any data that it must keep due to applicable legal obligations (e.g., data related to the fulfillment of DAC7 obligations).

(iii) Wallapop may keep purely statistical data on the use of its resources and tools by users.

In case you want to report any communication or possible irregularity through the Ethical Channel, the information about the treatment of your data in the framework of the Channel is available in the Privacy Policy in the following link.

5. With whom do we share your personal data?

In order to fulfill the purposes indicated in this privacy policy, it is necessary for us to provide access to your personal data and to third parties that support us in the services we offer you, among which are: financial entities, tax and fraud prevention entities, government agencies, technology service providers, transport and logistics service providers and partners, marketing and advertising companies, and customer service and complaint or claim management companies.

In this regard, we only select service providers that offer adequate guarantees through internal processes defined by both Wallapop’s legal and privacy departments, guaranteeing at all times the transparency and privacy of your personal data.

Additionally, it should be noted that personal data will also be shared with our payment service provider, Mangopay, S.A., for the purpose of providing payment services and complying with its legal obligations. Mangopay, S.A. is a limited liability company incorporated under Luxembourg law with its registered office at 2, Avenue Amélie, L-1125 Luxembourg and registered with the Luxembourg Commerce and Companies Registry under number B173459 (“Mangopay”), as detailed in our Terms and Conditions. You can find more information about the data processing carried out by Mangopay here.

Wallapop in no case shares user data with third-party companies, whether within or outside the European Union, for purposes other than the provision of the service without explicit consent and without having complied with the duty of information.

Only if you provide your express consent through the consent management platform, we may share certain personal data with Partners (such as Meta Platforms Ireland Limited, Google Ireland Limited or LiveRamp France) with the strict purpose of showing and directing advertising to you. You can consult our complete list of Partners and obtain more information about the processing of personal data carried out in their respective privacy policies linked in our consent management platform accessible through this link.

Additionally, you should be aware that we may share your personal data with public authorities who, in the exercise of their functions, request the data from us or when we are obliged to report such data (e.g., data reporting for compliance with the obligations established in the DAC7 regulation).

In addition to the above, you should be aware that, whether you are a Professional User or a Consumer User, certain identification and contact data may be accessible and visible to other Users in specific situations of use of the platform (for example, if you open a chat with a potential seller, he/she may see your username or if you close a sale through the platform using the Wallapop shipping service, the seller may have access to your name and address in order to carry out the shipping).

For reasons of availability or efficiency of the service, some of our suppliers are located in territories outside the European Economic Area that cannot provide a level of data protection comparable to that of the European Union, such as the United States. In such cases, we inform you that we transfer your data with appropriate safeguards and always keep your data secure:

The providers are certified in the Data Privacy Framework Program, certification that you can consult in the following link: https://www.dataprivacyframework.gov/s/
With other suppliers we have signed Standard Contractual Clauses approved by the Commission, the content of which can be consulted at the following link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.
Security questionnaires and verification of technical and organizational measures implemented by the company.

6. Know your data protection rights.

You may exercise your rights of access, rectification, erasure, opposition, restriction of processing and data portability, as well as the revocation of any consents you may have given, before Wallapop, S.L., with registered office at Avenida Meridiana 89, 6th floor, C.P. 08026, Barcelona (Spain), with tax identification number B-66049057. In order to facilitate the management of these requests, and without prejudice to the formal requirements provided for in the GDPR, Wallapop makes available to you the following contact channel: privacidad@wallapop.com, through which you can send your request for appropriate processing.

Likewise, we remind you of the possibility of making a complaint to the Spanish Data Protection Agency, especially when you consider that Wallapop has not duly satisfied the exercise of your rights. This claim may be submitted to the aforementioned authority through the different options that the electronic headquarters of the Spanish Data Protection Agency offers (https://www.aepd.es/reglamento/derechos/index.html).

If you wish to exercise your data protection rights with Mangopay, our payment service provider linked to the Wallet, you should send an email to dpo.mangopay@mangopay.com directly requesting Mangopay the data protection right you wish to exercise.

7. How to contact Wallapop for privacy inquiries?

For any questions or comments related to this Privacy Policy or how Wallapop collects and uses your data, you can also contact us at the email address privacidad@wallapop.com.

8. Data Protection Officer’s contact details.

For any questions or comments regarding this Privacy Policy or how Wallapop collects and uses your Data, you may also contact our office, and email: dpo.wallapop@wallapop.com.

9. Changes to the Privacy Policy.

We may change the information contained in this Privacy Policy from time to time. If we do so, we will notify you in various ways through the App (for example, through a banner, a pop-up or a push notification), or we will even notify you at your email address when the change in question is significant to your privacy, so that you can review the changes, assess them and, if appropriate, object or unsubscribe to any service or functionality.

In any case, we suggest that you review this Privacy Policy from time to time in case there are minor changes or we introduce any interactive improvements, taking advantage of the fact that you will always find it as a permanent point of information on our Platform.