Effective Date: 17.02.2026
Archived version. This policy applied until 25.08.2026. The version applying since then can be found under Privacy Policy.
1. General
LOLA market, Lindengasse 56/18-19, 1070 Vienna ("LOLA", "we", "us"), considers the protection of your personal data to be an important concern. Therefore, compliance with the provisions of data protection law, in particular the General Data Protection Regulation ("GDPR"), the Austrian Data Protection Act ("DSG") and the Telecommunications Act 2021 ("TKG 2021"), is self-evident to us.
These data protection notices inform you about the nature, scope and purposes of the collection and processing of your personal data in connection with the visit and use of our website (lola.market) as well as our app (LOLA market).
2. Data of the Controller
LOLA market FlexCo
Name: LOLA market
Address: Lindengasse 56/18-19, 1070 Vienna
E-mail address: [email protected]
3. What are personal data?
Personal data are information about data subjects (natural persons) whose identity is determined or at least determinable (e.g., name, e-mail address, or IP address).
4. What data do we collect from persons who visit or use our website?
4.1 Contacting us
Categories of data and purpose: If you contact us via the contact form or the contact details provided above, we process your personal data (name, e-mail address or telephone number, as well as the content of your inquiry and further correspondence regarding your inquiry) for the purpose of handling and responding to your inquiry.
Legal basis: The legal basis is the fulfillment of our (pre-)contractual obligations pursuant to Art. 6(1)(b) GDPR and our legitimate interests pursuant to Art. 6(1)(f) GDPR in the prompt handling and response to any follow-up questions.
Retention period: We store your data in the context of contacting us for a period of six months so that we can respond appropriately to follow-up questions. A longer retention period applies only if a business relationship subsequently arises, due to statutory retention obligations, or for the purpose of defense in any legal disputes.
4.2 Newsletter
Categories of data and purpose: If you have registered for our newsletter regarding our services and offers, we process your e-mail address and the open and click rates of the newsletters (provider: Brevo).
Legal basis: The processing is carried out on the basis of your voluntary and explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 174 TKG 2021. You can revoke your consent at any time with effect for the future (e.g., by e-mail to [email protected] or via the unsubscribe link provided in each newsletter).
Retention period: We process your personal data for the purpose of receiving the newsletter until you revoke your voluntary consent, but no longer than three years from the last contact with us.
4.3 Social Media
Categories of data and purpose: You can interact with us on our social media pages by commenting on our posts, reacting to them (e.g., via the "Like" button), sharing them, or sending them to other users. In this context, we process your interactions, your username, and, if applicable, personal data of invited third parties. These data may also be processed by the platforms in this context. In this case, the respective platform and we are joint controllers pursuant to Art. 26 GDPR. We have therefore concluded agreements on joint responsibility.
Legal basis: The data processing serves to answer your questions, to give you the opportunity to express yourself, to respond to your opinions or feedback, and to promote our services. Therefore, the processing is carried out both on the basis of our and your legitimate interests pursuant to Art. 6(1)(f) GDPR and for the fulfillment of our (pre-)contractual obligations pursuant to Art. 6(1)(b) GDPR.
Further information on data processing by the platforms, including the retention period, can be found at:
(1) Facebook: https://de-de.facebook.com/privacy/policy/
(2) Instagram: https://de-de.facebook.com/help/instagram/155833707900388
(3) LinkedIn: https://de.linkedin.com/legal/privacy-policy
4.4 Provision of the website and creation of log files
Categories of data and purpose: The following technically required data pursuant to § 165(3) TKG 2021 are automatically collected during your visit to our website in order to display the website to you and to ensure its stability and security:
(1) Information about the browser type and version used,
(2) The operating system of the user,
(3) The Internet service provider of the user,
(4) The IP address of the user,
(5) Date and time of access,
(6) Content of the request (specific page).
Legal basis: All these data are transmitted by your web browser when accessing our website. We process these data solely for the provision of the website, for the purpose of operational security, and are therefore technically strictly necessary pursuant to § 165(3) TKG 2021. This processing is therefore based on our legitimate interests pursuant to Art. 6(1)(f) GDPR and also includes logging of system usage, user authorization processes, and evaluation of server logs for problem analysis.
Retention period: We generally store your usage data when visiting the website for a period of one year.
These data are not stored together with other personal data of the user.
4.5 Cookies
A complete list of cookies can be found in the cookie banner. The cookie banner appears automatically when you first visit our website. You can also access the cookie banner at any time via the "Cookies" menu item in the footer of the website.
5. What data do we collect from persons who visit or use our app?
5.1 Usage data
Categories of data and purpose: The following technically required data pursuant to § 165(3) TKG 2021 are automatically collected during the use of our app in order to display the app to you and to ensure its stability and security:
(1) IP address of your device,
(2) Language,
(3) Operating system and version,
(4) Screen resolution, and
(5) Data on usage behavior.
Legal basis: We process these data solely for the provision of the app and for the purpose of operational security and are therefore technically strictly necessary pursuant to § 165(3) TKG 2021. This processing is therefore based on our legitimate interests pursuant to Art. 6(1)(f) GDPR and also includes logging of system usage, user authorization processes, and evaluation of server logs for problem analysis.
Retention period: We generally store your usage data when visiting the app for a period of one year.
5.2 User account registration
Categories of data and purpose: If you register to use the app or log in via a Single Sign-On (SSO) service such as Google, Apple, or Facebook, we process your first and last name, date of birth, and e-mail address in order to provide you with a user account.
Legal basis: We collect and process these data to provide you with our app and services and to prevent fraud. The legal basis is therefore the performance of a contract and our legitimate interests pursuant to Art. 6(1)(b) and (f) GDPR.
Retention period: We generally process the registration data as long as you maintain an active account with us or until you terminate your contract.
5.3 Analysis of your user behavior
Categories of data and purpose: We process data regarding your use of our services, in particular data on posted and viewed listings, search histories, used functions, and—if enabled—location data. These data are partially collected automatically and serve to improve our services, prevent fraud, and provide personalized content and listings (e.g., displaying recently searched content or sorting listings by distance as part of the radius search). You can enable or disable the transmission of location data at any time in the settings of your mobile device.
We analyze usage data to generate statistics and market trends and to further develop our services. Based on your user behavior and preferences, we provide you with personalized content and recommendations.
If the legal thresholds according to the Digital Platforms Reporting Act ("Digitale-Plattformen-Meldepflichtgesetz," DPMG) are met (30 transactions or EUR 2,000 total turnover per calendar year), the platform is obliged to report the data provided by the seller as well as the transaction data to the Austrian tax authorities in a timely manner.
Legal basis: The processing is based on your voluntary consent pursuant to § 165 TKG 2021 in conjunction with Art. 6(1)(a) GDPR. You can revoke your consent at any time for the future without giving a reason via our contact form or by e-mail to [email protected].
Provider: Self-hosted Matomo Analytics, InnoCraft, 7 Waterloo Quay PO625, 6140 Wellington, New Zealand. For more information, see: https://matomo.org/gdpr-analytics/
Retention period: Data in this context are only processed as long as corresponding consent exists and the data are necessary for the purpose. Upon revocation of consent and if the processing is no longer required for the purpose, the data are deleted immediately.
5.4 Use of Services
Categories of data and purpose: Depending on your use of our app, we also process the following data:
(1) If you post listings as an "offer" or "wanted ad," we process your details regarding these listings (product information, description, photos, form of consumption, price, category, and validity date for "wanted ads") in the app and, where applicable, also place this content on our social media pages.
(2) We process data on your past product searches and the transactions you have carried out in the areas of "sale," "gift," "rental," and "free rental."
(3) If you participate in groups, we process your membership in these groups and your activities.
(4) If you voluntarily share your location, we also process this and will display listings near you accordingly. This is not mandatory to use the app.
Legal basis: We collect and process these data to provide you with our app and services. The legal basis is therefore the performance of a contract pursuant to Art. 6(1)(b) GDPR and our legitimate interests pursuant to Art. 6(1)(f) GDPR.
Retention period: We generally process registration and account data as long as you maintain an active account with us or until you terminate your contract. You can also delete your listings at any time directly in the app. Likewise, you can remove your membership in groups at any time via the app.
6. Recipients of Personal Data
We naturally treat your personal data confidentially. Therefore, we deliberately keep the circle of recipients of your data small. To operate our website and app, we use service providers who may also have access to personal data in order to perform the commissioned services. Our processors are primarily providers of IT services:
(1) Software and service providers, as well as providers of tools and solutions that support us in providing the website and delivering our services;
(2) General IT administration (including support, software and maintenance, data centers).
These processors process your data only on our behalf, based on our instructions, and for the purpose of providing the above-mentioned services. We have concluded agreements with all our processors in accordance with Art. 28 GDPR.
In addition, we may transfer your personal data, on a case-by-case basis and to the extent necessary, to the following recipients:
(1) To external third parties to the extent necessary based on our legitimate interests (e.g., auditors, debt collection agencies, insurance companies in the event of a claim, legal representatives in the event of a legal matter, etc.);
(2) To authorities and other public bodies to the extent legally required (e.g., tax authorities, data protection authority, etc.).
Your personal data will not be shared with any other third parties for their own purposes without your consent.
7. Storage Period
We generally store your personal data only as long as we need it to fulfill the purposes described. Once we no longer need your personal data, we delete it from our systems or anonymize it so that you can no longer be identified irreversibly.
Information on the specific retention periods for each purpose can be found above under the respective purpose.
If the data processing is carried out based on our or a third party's legitimate interest, your personal data will be deleted as soon as this interest no longer exists, unless statutory retention obligations require us to retain it for a longer period. This also applies to data processing based on consent that has been given. As soon as this consent is revoked by you for the future, the personal data will be deleted immediately, unless a legal retention obligation requires a longer retention.
Furthermore, we take into account statutory limitation periods when determining retention periods, which, for example, according to the Austrian General Civil Code (ABGB), generally amount to 3 years, and in certain cases up to 30 years (§ 1489 ABGB).
Your data related to the exercise of data subject rights is stored for 18 months to provide evidence of the fulfillment of your request, based on our legitimate interests (Art. 6(1)(f) GDPR).
This is without prejudice to cases in which longer retention is necessary for legal disputes, requests from competent authorities, or as required by applicable law.
8. Data Security
We have implemented appropriate technical and organizational security measures pursuant to Art. 32 GDPR to ensure the confidentiality and security of your personal data.
9. Data Subject Rights
You have the right to obtain information about your personal data processed by us as the controller (Art. 15 GDPR). In addition, you have the right to rectification of incorrect data and the deletion of your data ("right to be forgotten") (Arts. 16 and 17 GDPR). You may also have the right to restrict the processing of your data (Art. 18 GDPR) as well as the right to receive the data you have provided in a structured, commonly used, and machine-readable format ("data portability", Art. 20 GDPR). Furthermore, you can revoke your voluntarily given consent to the processing of personal data at any time with effect for the future, e.g., by email to [email protected] (Art. 7(3) GDPR).
Moreover, you have the right to object at any time to direct marketing measures and, for reasons arising from your particular situation, to object to the processing of your data at any time (Art. 21 GDPR). In this case, we will refrain from further processing of your personal data unless we can demonstrate compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or if the processing serves the establishment, exercise, or defense of legal claims.
If you believe that we are processing your personal data unlawfully, you also have the right to lodge a complaint with the competent supervisory authority or to pursue a judicial remedy (Art. 77 GDPR). In Austria, this is:
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Email: [email protected]
You may also submit a complaint to the supervisory authority of the EU country in which you have your habitual residence or place of work, or to the supervisory authority of the location where the alleged violation occurred.
To exercise these rights, you may at any time contact us, for example, by email at [email protected].
10. Changes
The further development of our services may lead to changes. We will, of course, keep the privacy notice up to date and adjust it if necessary. We make the currently valid version of the privacy notice available on our website at https://lola.market/privacy-policy_en and will notify you separately of any material changes. We also recommend that you regularly review the current version.
