Privacy Policy

Last updated: 10.10.2026

This version has applied since 10.10.2026. The previous policy remains available in the archive. This is a translation of the German original; in case of discrepancies, the German version prevails.

1. General
The LOLA market FlexCo, Lindengasse 56/18-19, 1070 Vienna ("LOLA", "we", "us") considers the protection of your personal data to be an important concern. Compliance with the provisions of data protection law, in particular the General Data Protection Regulation ("GDPR"), the Austrian Data Protection Act ("DSG") and the Austrian Telecommunications Act 2021 ("TKG 2021"), is therefore a matter of course for us.

This privacy notice informs you about the nature, scope and purposes of the collection and processing of your personal data in connection with the visit to and use of our website (lola.market) and our app (LOLA market).

2. Controller details
Name: LOLA market FlexCo
Address: Lindengasse 56/18-19, 1070 Vienna
Company register number: FN 655577i, Commercial Court Vienna
Email address: [email protected]

3. What is personal data?
Personal data is information about data subjects (natural persons) whose identity is determined or at least determinable (e.g. name, email address or IP address).

4. Which data do we collect from persons who visit or use our website?

4.1 Contacting us
Data categories and purpose: If you contact us using the contact details given above or via the contact form, we process your personal data (name, email address or telephone number as well as the content of your enquiry and any further correspondence relating to it) for the purpose of handling and answering your enquiry.
Legal basis: The legal basis is the performance of our (pre-)contractual obligations pursuant to art 6(1)(b) GDPR and our legitimate interests pursuant to art 6(1)(f) GDPR in dealing promptly with and responding to any queries.
Retention period: We store your data in connection with enquiries for a period of six months so that we can respond appropriately to follow-up questions. Longer storage takes place only where a business relationship subsequently arises, or on the basis of statutory retention obligations, or for the defence of potential legal disputes.

4.2 Newsletter
Data categories and purpose: If you have signed up for our newsletter about our services and offers, we process your email address and the open and click rates of the newsletters. We use a service provider established in the EU for sending them.
Legal basis: Processing takes place on the basis of your voluntary and express consent pursuant to art 6(1)(a) GDPR in conjunction with sec 174 TKG 2021. You can withdraw your consent at any time with effect for the future (e.g. by email to [email protected] or via the unsubscribe link you will find in every newsletter).
Retention period: We process your personal data for receiving the newsletter until you withdraw your voluntary consent, but no longer than three years from your last contact with us.

4.3 Social media
Data categories and purpose: You can interact with us on our social media pages by commenting on our posts, reacting to them (e.g. via the "Like" button), sharing them or sending them to other users. In doing so, we process your interactions, your username and, where applicable, personal data of invited third parties. This data may also be processed by the platforms in this context. In this case, the respective platform and we are joint controllers pursuant to art 26 GDPR. We have therefore concluded agreements on joint controllership.
Legal basis: The data processing serves to answer your questions, to give you the opportunity to express yourself and to respond to your opinions or feedback, as well as to promote our offering. Processing therefore takes place on the basis of both our and your legitimate interests pursuant to art 6(1)(f) GDPR and for the performance of our (pre-)contractual obligations pursuant to art 6(1)(b) GDPR.
You can find further information on data processing by the platforms, including on the retention period, at:
(1) Facebook: https://de-de.facebook.com/privacy/policy/
(2) Instagram: https://de-de.facebook.com/help/instagram/155833707900388
(3) LinkedIn: https://de.linkedin.com/legal/privacy-policy

4.4 Provision of the website and creation of log files
Data categories and purpose: The following technically necessary data within the meaning of sec 165(3) TKG 2021 is collected automatically when you visit our website, in order to display the website to you and to ensure its stability and security:
(1) information about the browser type and version used,
(2) the operating system of the user,
(3) the internet service providers of the user,
(4) the IP address of the user,
(5) date and time of access,
(6) content of the request (specific page).
Legal basis: All of this data is transmitted by your web browser when you access our website. We process this data solely for the provision of the website and for the purpose of operational security, and it is therefore strictly technically necessary within the meaning of sec 165(3) TKG 2021. These processing operations are therefore based on our legitimate interests pursuant to art 6(1)(f) GDPR and also include the logging of system use, user authorisation processes and the evaluation of server logs for problem analysis.
Retention period: We generally store your usage data when visiting the website for a period of one year. This data is not stored together with other personal data of the user.

4.5 Cookies
Which cookies we use, for what purpose and on what legal basis can be found on our cookie page. In addition, a banner appears the first time you access our website, via which you can accept or reject analytics and statistics cookies. You can return there at any time via the "Cookies" menu item in the footer of the website and change your decision with effect for the future.

4.6 Protection against abusive use
Data categories and purpose: To protect our forms and registration in the app against automated and abusive access, we use a verification procedure. In doing so, your IP address as well as technical information about your browser and device are transmitted and evaluated in order to determine whether the request originates from a person or from an automated system.
Legal basis: Processing is based on our legitimate interests in the security of our systems and in preventing misuse pursuant to art 6(1)(f) GDPR.
Provider: We use a service provider established in the USA for this detection. Regarding transfers to the USA, see the section "International data transfers".
Retention period: The data is processed only for the duration of the check and deleted thereafter.

4.7 Preview page
Data categories and purpose: At lola.market/vorschau we provide selected persons with a password-protected preview of LOLA. In order to understand how this preview is received by each target group, we measure its use in an abbreviated form that cannot be traced back to you. The measurement takes place without cookies; your IP address is processed in abbreviated (anonymised) form. This is a short-lived, non-identifying evaluation without profiling; recognition beyond the individual visit does not take place.
Legal basis: Processing is based on our legitimate interest in evaluating the response to the preview pursuant to art 6(1)(f) GDPR. You can object to this measurement at any time by email to [email protected].
Provider: We use the same self-hosted analytics software as under point 5.3, whose provider is established in New Zealand.
Retention period: We process the usage data collected in connection with the preview only for as long as this is necessary for the evaluation.

5. Which data do we collect from persons who visit or use our app?

5.1 Usage data
Data categories and purpose: The following technically necessary data within the meaning of sec 165(3) TKG 2021 is collected automatically in the course of using our app, in order to display the app to you and to ensure its stability and security:
(1) IP address of your device,
(2) language,
(3) operating system and version,
(4) screen resolution, and
(5) data on usage behaviour.
Legal basis: We process this data solely for the provision of the app and for the purpose of operational security, and it is therefore strictly technically necessary within the meaning of sec 165(3) TKG 2021. These processing operations are therefore based on our legitimate interests pursuant to art 6(1)(f) GDPR and include the logging of system use, user authorisation processes and the evaluation of server logs for problem analysis.
Retention period: We generally store your usage data when visiting the app for a period of one year.

5.2 Registration of a user account
Data categories and purpose: When you register to use the app or sign in via a single sign-on service (SSO) such as Google, Apple or Facebook, we process your first and last name and your email address in order to provide you with a user account. We do not collect a date of birth at registration; you may provide it voluntarily in your profile, but this is not mandatory. If you register as a business or as an association, we additionally process the details of your organisation. For the processing of rentals for a fee and in order to fulfil statutory reporting and accounting obligations, we also process your address and, where available, your VAT identification number.
Legal basis: We collect and process this data in order to make our app and our services available to you and to prevent fraud. The legal basis is therefore the performance of a contract and our legitimate interests pursuant to art 6(1)(b) and (f) GDPR.
Retention period: We generally process registration data for as long as you hold an active account with us or until you terminate your contract.

5.3 Analysis of your user behaviour
Data categories and purpose: We process data relating to your use of our services, in particular regarding listings posted and viewed, search histories, functions used and — where activated — location data. This data is collected in part automatically and serves to improve our services, to prevent fraud and to personalise the presentation of content and listings (e.g. displaying recently searched content or sorting listings by distance as part of the proximity search). You can enable or disable the transmission of location data at any time in the settings of your mobile device. We analyse usage data in order to produce statistics and market trends and to develop our services further. On the basis of your user behaviour and preferences, we provide you with personalised content and recommendations.
Legal basis: Processing takes place on the basis of your voluntary consent pursuant to sec 165 TKG 2021 in conjunction with art 6(1)(a) GDPR. You may withdraw your consent at any time, without giving reasons and with effect for the future, via our contact form or by email to [email protected].
Provider: We use self-hosted analytics software whose provider is established in New Zealand.
Retention period: Data in this context is processed only for as long as consent exists and the data is necessary for the purpose. Upon withdrawal of consent, and where processing is no longer necessary for the purpose, the data is deleted without delay.

5.4 Statutory reporting and retention obligations
Data categories and purpose: Where the statutory thresholds under the Austrian Digital Platform Reporting Act (DPMG) are reached (30 transactions or EUR 2,000 total turnover per calendar year), we are obliged to report your identification and transaction data to the Austrian tax authority within the prescribed period. This includes in particular name, address, date of birth, tax identification number or VAT identification number, and the amounts earned through the app. Insofar as individual items of this information — such as your date of birth — are not yet available to us at that time, we collect them when the reporting threshold is reached.
Legal basis: Processing takes place in order to fulfil a legal obligation pursuant to art 6(1)(c) GDPR.
Retention period: We retain the information reported to the tax authority for ten years after the end of the relevant reporting period (sec 15(3) DPMG). Receipts and payment data are subject to retention periods under tax and accounting law of generally seven years.

5.5 Use of services
Data categories and purpose: Depending on your use of our app, we also process the following data:
(1) If you post listings as an "offer" or "search listing", we process the details you provide (details of the product, description, photos, transaction type, price, category and validity date for a "search listing") in the app and may also place this content on our social media pages. Optional details such as the serial number are stored exclusively for you as the creator and are not visible to other users. Photos of your listing are accessible via a non-guessable internet address and can be displayed via such a link even without signing in.
(2) We process data on your past product searches and the transactions you have carried out in the areas of "sale", "giving away", "rental" and "free rental".
(3) If you participate in groups, we process your membership of them and your activities.
(4) If you voluntarily share your location, we also process this and will show you listings near you. This is not mandatory in order to use the app. When handing over and returning a rental item, you can additionally share your location specifically with the other person involved so that you can find each other at the meeting point. This sharing takes place only when you expressly trigger it and applies only to the transaction concerned.
(5) If you use the chat function, we process the content of your messages as well as the details of the participants and the time, in order to enable communication between you and other users. In chats relating to rentals we add automatically generated system messages about the status of the transaction.
(6) Following the completion of a rental, the parties involved may review one another. The review consists of ratings in several categories and a text; it is assigned to your user account and is visible to other users once both sides have submitted a review or the review period has expired. A submitted review cannot be withdrawn. If you delete your user account, the reviews you have submitted and received are retained; the link to your account is removed in the process.
(7) If you record items in your personal inventory without offering them ("keep"), we process the details you provide as well as any purchase receipts or comparable documents you store. These entries and documents are intended for you only and are not visible to other users unless you actively share them. A non-binding value estimate may be displayed for an item.
(8) If you create an event or take part in one, we process the details of the event as well as your participation. The details of an event and the list of participants are visible to the users authorised to see them.
Legal basis: We collect and process this data in order to make our app and our services available to you. The legal basis is therefore the performance of a contract pursuant to art 6(1)(b) GDPR and our legitimate interests pursuant to art 6(1)(f) GDPR.
Retention period: We generally process registration and account data for as long as you hold an active account with us or until you terminate your contract. You can also delete your listings yourself in the app at any time. You can likewise remove your membership of groups in the app at any time.

5.6 Payment processing for rentals for a fee
Data categories and purpose: If you book a rental for a fee or offer one, we process the data required for processing it: the service booked, the period, the amounts including service fee and VAT, the payment status and the associated receipts. You enter your payment data on a page provided by our payment service provider; complete card details are neither collected nor stored by us. We only receive the payment method, the last digits of the card and its validity. If you rent out for a fee, verification with the payment service provider is required for payout. In doing so, the provider processes the data required for identity verification as well as your bank details. We receive the status of this verification and the information as to whether a payout is possible. If a payment is subsequently charged back, we additionally process the details of that event. In order to contest the chargeback, we transmit the details documented for the rental in the app — in particular the confirmations of both parties, photos, shared locations and the chat history — to the payment service provider and the payment institutions involved. If this gives rise to a claim against you, we store its amount, reason and reference to the transaction until it is settled or offset against a payout.
Legal basis: Processing serves the performance of the user agreement and the processing of your booking pursuant to art 6(1)(b) GDPR. Insofar as we are obliged to retain or report data, processing takes place in order to fulfil legal obligations pursuant to art 6(1)(c) GDPR. We have a legitimate interest in preventing fraud and payment defaults, in contesting chargebacks and in asserting the resulting claims pursuant to art 6(1)(f) GDPR; the transmission also serves the assertion and defence of legal claims.
Provider: Stripe Payments Europe, Ltd., Ireland. Stripe processes payment data in part as an independent controller; for details see https://stripe.com/privacy. If you choose Klarna as your payment method, the data required for processing is additionally transmitted to Klarna Bank AB (publ), Sweden.
Retention period: For the duration of contract processing, and beyond that until the expiry of the statutory retention periods.

5.7 AI-supported functions
Data categories and purpose: When you create a listing, the photos you upload and the details you provide are evaluated automatically in order to generate suggestions for the listing. A photo may show more than the item offered – other people, the surroundings in which it was taken, or legible details on labels and documents. Where such content contains personal data, it is processed along with the rest. Suggestions are made in particular for category and transaction type, condition, title and description as well as product characteristics such as brand, model or main colour; in addition, a price recommendation is generated. If you store a purchase receipt or comparable documents for an item, these may also be evaluated automatically in order to recognise the details they contain, assign them to an item and create a non-binding value estimate. The suggestions and the value estimate are non-binding and can be changed or discarded by you at any time. No automated decision in an individual case within the meaning of art 22 GDPR takes place. When you carry out a search, we additionally check which of the listings found match your search query. For this purpose we transmit your search term as well as the title, description and category of the listings found to an AI service; the result determines which matches are highlighted for you. Your user ID is not transmitted in the process.
Legal basis: Processing takes place for the performance of the user agreement pursuant to art 6(1)(b) GDPR and on the basis of our legitimate interests in the quality and completeness of listings pursuant to art 6(1)(f) GDPR.
Provider: For the evaluation of photos and the price recommendation we use Google Ireland Limited, Ireland, and for the generation of text OpenAI Ireland Limited, Ireland. Both providers may also transfer data to their parent companies in the USA; see the section "International data transfers". The AI services used do not use the content transmitted to train their models. They store it only for a short period in order to detect misuse.
Retention period: The details derived from the photos are stored together with your listing and deleted with it.

5.8 Crash and error reports
Data categories and purpose: In order to identify and fix errors and crashes in the app, we process technical error reports. These contain details of the device and operating system, the app version, the time and type of the error and the technical sequence of events leading to it. If you are signed in, your user ID and email address are additionally assigned to the report so that we can attribute recurring errors to an account and help you specifically. A proportion of sessions is additionally evaluated on a sample basis for speed and stability.
Legal basis: Processing is based on our legitimate interests in the stability, security and correct functioning of the app pursuant to art 6(1)(f) GDPR.
Provider: We use a service provider established in the USA; the data is stored in that provider's EU region. Access from the USA cannot be ruled out; see the section "International data transfers".
Retention period: Error reports are deleted after 90 days.

5.9 Notifications
Data categories and purpose: If you activate notifications, we process a device identifier (push token) as well as your notification settings and selected language in order to deliver messages about activity in the app to your device. We also send notifications by email. You can determine in the settings what you are notified about; notifications relating to the processing of an ongoing transaction and to account security are excluded. You can additionally disable push notifications at any time in the settings of your device.
Legal basis: Processing takes place for the performance of the user agreement pursuant to art 6(1)(b) GDPR and on the basis of our legitimate interests in informing you about activity in the app pursuant to art 6(1)(f) GDPR.
Provider: Push notifications are delivered via a service provider established in the USA and via the push services of the operating system manufacturers. For sending emails we use a service provider established in the USA. Regarding transfers to the USA, see the section "International data transfers".
Retention period: We store the push token for as long as you have notifications activated and hold a user account.

5.10 Moderation, restriction and blocking of user accounts
Data categories and purpose: Where we receive a report of a possible breach of our T&C or of the law, or where such a suspicion arises otherwise, we review the content concerned and the associated details of your user account. The review is carried out exclusively manually; no automated decision in an individual case within the meaning of art 22 GDPR takes place. As a result, we may remove content, restrict your user account for future use or block it; we store this status with your user account. If you lodge a complaint against such a measure, we process your complaint and our decision on it. Where rentals are open at the time of a block, we inform the respective other person involved that the transaction can no longer be continued through the app.
Legal basis: The review and the resulting measures are based on the performance of the user agreement pursuant to art 6(1)(b) GDPR and on our legitimate interests in a safe and legally compliant platform pursuant to art 6(1)(f) GDPR.
Retention period: For the duration of the measure and thereafter for as long as this is necessary for the defence of legal claims.

5.11 Map display
Data categories and purpose: On a map we display businesses (users with a public business address), public groups and events; listings of private users are not shown on the map. The map material required for this is loaded from a map service provider. In doing so, your IP address is transmitted to this provider, which technically needs it in order to deliver the map material to your device.
Legal basis: Processing is based on our legitimate interests in providing the map display pursuant to art 6(1)(f) GDPR.
Provider: We use a map service provider for the map display.
Retention period: The IP address is transmitted only at the time the map is loaded.

5.12 Use without a user account
Data categories and purpose: If, without registering, you try adding an item to the inventory and having a non-binding value estimate displayed, we transmit the photo you upload for evaluation to an AI service (point 5.7) in order to generate suggestions and the value estimate for you. The photo is stored for up to 24 hours so that you can transfer it into your inventory when registering, without having to upload it again. To protect against abusive use, we check whether the request originates from a genuine device (device attestation); in doing so, technical details of your device are processed.
Legal basis: Processing is based on our legitimate interests in providing this function and in protecting against misuse pursuant to art 6(1)(f) GDPR.
Retention period: The transmitted photo is automatically deleted after 24 hours if you have not created a user account by then; the details processed for device attestation are processed only for the duration of the check.

5.13 Connecting your own AI assistants
Data categories and purpose: You can connect your own AI assistant (for example an assistant on your computer) with your LOLA account so that it acts on LOLA on your behalf, for instance searching for offers, recording products or reading and writing messages. You set up the connection yourself: you confirm the access in your account and determine which areas the assistant may access. The assistant sees and processes exclusively your own data in the areas released, and every action is carried out under your account and is like an action by you in the app. We do not transmit any data to the assistant; it retrieves the data with your release. The privacy policy of the provider of your assistant applies to that provider.
Legal basis: Processing takes place for the performance of the user agreement pursuant to art 6(1)(b) GDPR; the release and the choice of areas are made by you.
Retention period: The release remains in place until you withdraw it in your account or delete your account.

6. Recipients of personal data
We treat your personal data confidentially, of course. We therefore deliberately keep the circle of recipients of your data small. To operate our website and app we use service providers who also have access to personal data in order to be able to provide the services commissioned. These include in particular service providers in the following areas:
(1) payment processing: Stripe, and additionally Klarna when Klarna is used (point 5.6);
(2) AI-supported functions: Google and OpenAI (point 5.7);
(3) crash and error reports (point 5.8);
(4) delivery of notifications and sending of emails (point 5.9);
(5) protection against abusive use (point 4.6);
(6) reach measurement (point 5.3);
(7) sending of newsletters (point 4.2);
(8) map display (point 5.11);
(9) hosting, operation and maintenance of our systems.
These service providers process your data on our behalf, on the basis of our instructions and exclusively for the purposes described; we have concluded agreements with them pursuant to art 28 GDPR. If we use a different or additional service provider for one of these areas, the same requirements apply. Insofar as a service provider is independently responsible for part of the processing – in particular the payment service provider in fraud prevention and in fulfilling its own regulatory obligations – its own privacy policy applies.

In addition, in individual cases we transmit your personal data to the following recipients to the extent necessary:
(1) to external third parties to the extent necessary on the basis of our legitimate interests (e.g. auditors, debt collection agencies, insurers in the event of a claim, legal representatives in individual cases, etc);
(2) to authorities and other public bodies to the extent legally required (e.g. tax authorities, data protection authority etc.).
(3) to the payment service provider and the payment institutions involved where a payment is charged back and we contest the chargeback (point 5.6).
(4) to third parties entitled to information under the Austrian E-Commerce Act, in particular in the case of a request for information pursuant to sec 13(3) ECG, where someone claims to have been infringed in their rights by a listing or content.
Your personal data is not passed on to any other third parties for their own purposes without your consent.

7. International data transfers
Your personal data may be transferred to countries outside the European Union (EU) or the European Economic Area (EEA) that offer an adequate level of data protection, as established by adequacy decisions of the European Commission (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en).

The transfer of your personal data to countries that are not members of the EU or the EEA and that do not ensure an adequate level of protection takes place only where the controller and the recipients of the data have concluded the European Commission's standard contractual clauses (SCC) as appropriate safeguards for the protection of your personal data, have carried out a transfer impact assessment and implemented supplementary security measures, or where you have given your express voluntary consent.

Specifically, this concerns the reach measurement, whose provider is established in New Zealand, for which an adequacy decision of the European Commission exists. In addition, data may be transferred to providers established in, or with a parent company in, the USA: payment processing, the AI-supported functions, crash and error reports, the delivery of notifications, protection against abusive use and the map display. For these transfers we rely on the European Commission's standard contractual clauses.

If we contest a chargeback, the data required for this may also be transmitted to payment institutions outside the EU where the card was issued there. This transfer takes place for the assertion and defence of legal claims.

8. Retention period
We generally store your personal data only for as long as we need it to fulfil the purposes described. Where we no longer need your personal data, we delete it from our systems or anonymise it so that you can irreversibly no longer be identified.
Details of the specific retention periods can be found above under the respective purpose.

Where data processing takes place in our legitimate interest or that of a third party, your personal data is deleted as soon as that interest no longer exists, unless statutory retention obligations require us to store it for longer. This also applies to data processing on the basis of consent given. As soon as such consent is withdrawn by you with effect for the future, the personal data is deleted immediately, unless a statutory retention obligation requires longer retention.
In determining the retention period we also take into account the statutory limitation periods, for example under the Austrian Civil Code (ABGB), which are generally three years and in certain cases up to 30 years (sec 1489 ABGB).
Receipts and payment data are subject to retention periods under tax and accounting law of generally seven years. We store your data in connection with the exercise of data subject rights for 18 months as evidence that your request has been dealt with, on the basis of our legitimate interests (art 6(1)(f) GDPR).
This applies without prejudice to cases in which longer retention is necessary for legal disputes, requests from the competent authorities or under applicable law.

9. Data security
We have taken appropriate technical and organisational security measures within the meaning of art 32 GDPR in order to ensure the confidentiality and security of your personal data.

10. Data subject rights
You have a right to information about the personal data we process as controller (art 15 GDPR). In addition, you have the right to rectification of inaccurate data and erasure of your data ("right to be forgotten") (art 16 and 17 GDPR). You may also have a right to restriction of the processing of your data (art 18 GDPR) and a right to receive the data you have provided in a structured, commonly used and machine-readable format ("data portability", art 20 GDPR). You can also withdraw your voluntarily given consent to the processing of personal data at any time with effect for the future, e.g. by email to [email protected] (art 7(3) GDPR).

In addition, you have the right to object at any time to direct-marketing measures and, on grounds relating to your particular situation, to the processing of your data at any time (art 21 GDPR). In that case we will refrain from further processing your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or where the processing serves the establishment, exercise or defence of legal claims.

If you are of the opinion that we process your personal data unlawfully, you also have the right to lodge a complaint with the competent supervisory authority or to seek a judicial remedy (art 77 GDPR). In Austria this is:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Email: [email protected]
You can also lodge the complaint with the supervisory authority of the EU country in which you have your habitual residence or place of work, or with the supervisory authority of the place where the alleged infringement took place.
To exercise these rights you can contact us at any time, for example by email at hello@lola.market.

You can delete your user account yourself at any time: in the app under "Profile" → "Delete profile". If you no longer have the app installed, or if you would like individual data deleted without giving up your account, an informal message to hello@lola.market is sufficient.

When your account is deleted, we remove your profile and the associated data, and your listings are deleted as well. Reviews remain in place without any reference to your account (point 5.5); receipts and payment data are retained for the statutory periods (point 5.6). If there is still an outstanding balance, if you are the sole administrator of a group, or if a rental is still in progress, we will delete your account as soon as these have been concluded.

11. Changes
The further development of our offering may lead to changes. We will of course keep this privacy policy up to date and adapt it where necessary. We make the currently valid version of the privacy policy available on our website at https://lola.market/privacy-policy_en and will notify you separately of material changes. We also recommend that you inform yourself regularly about the current version.