Privacy policy

This policy explains how we collect, use and protect your data when using our services (Marketplace, DNS, Mail).

It applies to all SMASH users, in accordance with the GDPR and applicable Monegasque law.

We process data in the following situations:

• User account creation and management
• Marketplace transactions and payments
• Communications (support, notifications)
• Marketing campaigns, newsletters and promotions
• Use of the marketplace (browsing, technical logs)
• Legal compliance, fraud prevention, accounting and tax obligations

Main categories of personal data that may be collected:

• Identity / contact (company name, full name, address, email, phone)
• Account information (identifiers, hashed password)
• Payment / billing (bank details, history, invoices)
• Technical / browsing (IP address, session IDs, logs)
• Compliance / verification (supporting documents)

We process your data for the following purposes:

• Account management & user relationship

  Legal basis: Contract performance / Legitimate interest

  Retention: Account lifetime + 6 months

• Transactions & payments

  Legal basis: Contract performance / Legal obligation

  Retention: As required by accounting and tax law

• Communication / support / messaging

  Legal basis: Contract performance / Legitimate interest

  Retention: Until case closure + statutory limitation

• Marketing, prospecting, newsletters

  Legal basis: Consent or legitimate interest (depending on context)

  Retention: Until consent is withdrawn

• Security, fraud prevention, abuse

  Legal basis: Legitimate interest / Legal obligations

  Retention: Until the risk ceases + statutory limitation

• Legal compliance, accounting, tax

  Legal basis: Legal obligation

  Retention: As required under Monegasque/applicable law

We use processors acting on our behalf and under our instructions, selected for security, reliability and compliance.

• Payment provider: Monext (payment processing)
• Hosting & infrastructure: Monaco Cloud (sovereign hosting)
• Email marketing: Brevo (newsletters and commercial emails)

Our vendors are located in Monaco, in the EEA, or in a country covered by an adequacy decision.

We may disclose data to competent authorities (judicial, administrative, tax) where legally required.

We implement appropriate technical and organizational measures:

• Encrypted communications (HTTPS/TLS)
• Secure storage and access control
• Access and sensitive actions logging
• Regular backups
• Anonymization/pseudonymization where possible
• Staff awareness and training
• Data breach handling procedure

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction
• Right to object (legitimate interest)
• Right to data portability, where applicable
• Right to withdraw consent at any time where processing is based on consent

To exercise your rights: privacy@smash.mc

If you believe your rights are not respected, you may contact the APDP (Monaco Data Protection Authority).

• For as long as the account is active
• Transactions: as required by accounting/tax law
• Support tickets/messages/claims: until resolution + statutory limitation
• Marketing: until consent is withdrawn or for a reasonable period
• Data that is no longer needed is deleted or anonymized

The SMASH marketplace is not intended for minors (under 16, or as per applicable law). If a minor account is detected, SMASH may delete the account and any associated data.

Our site may contain links to partners with their own privacy policies, for which SMASH cannot be held responsible.

This policy may evolve (regulation, services). Any changes will be published with an updated date and, where appropriate, notified.

For any question related to personal data:

Email address

privacy@smash.mc

Postal address

SMASH C/° Monaco Boost 4/6 Avenue Albert II 98000 Monaco

Data Protection Officer (DPO)

Elodie FRESNEL