Privacy policy

About this policy

This Privacy policy explains how Food Trailers Marketplace ("we", "us", "our") collects, uses, and protects personal data when you use the platform — including when you register as a supplier, browse listings, contact us, or pay for an optional feature.

It applies in conjunction with our Terms of use. By using the platform you agree to the practices described here.

Who is the data controller

For the purposes of the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018, the data controller for personal data processed via the platform is Food Trailers Marketplace, operated from Ireland. You can reach us about anything in this policy through the contact form.

What data we collect

We only collect what we need to operate the platform. The categories below cover everything we routinely process.

Supplier account data — company name, CRO and/or VAT number where supplied, account email address, hashed password, and any contact details (phone, WhatsApp, email) you choose to publish on your public profile or listings.

Listing content — titles, descriptions, prices, county, photos you upload, and category information you select.

Verification documents — for suppliers on the optional ✓ Verified tier, we collect a CRO or VAT certificate which is reviewed by our team and stored only for as long as the verification remains active.

Payment data — for paid features (Verified subscription, listing promotions), payments are processed by Stripe. We never see or store full card numbers; we only retain Stripe customer IDs, transaction IDs, and the last 4 digits + card brand to display in your dashboard.

Communications — messages you send via the contact form, replies to support emails, and any documents you attach.

Account activity — the date and time you last signed in, the IP address used for that sign-in, and the date and time your account was last used while signed in. We record the last-used timestamp at most once every five minutes, and we do not record which pages you visited while signed in.

Technical data — IP address (used for rate limiting and abuse prevention; hashed before being stored for analytics), browser type, device type, referring URL, pages viewed, and timestamps. Some of this is collected via cookies (see section 5).

How we use your data & lawful basis

Under GDPR, every processing activity has a lawful basis. Ours are:

• Performance of a contract — running your account, displaying your listings, processing your subscription or promotion payment, sending transactional emails (verification, password reset, payment confirmations).
• Legitimate interests — keeping the platform secure (rate limiting, abuse detection), preventing fraud, producing aggregate analytics so we can improve the site, and showing you relevant features in your dashboard.
• Consent — any marketing email you specifically opt in to. You can withdraw consent at any time from your dashboard preferences.
• Legal obligation — retaining payment and tax records for the period required by Irish law, responding to lawful requests from authorities.

We do not sell or rent personal data to third parties, and we do not use your data for automated decision-making or profiling that produces legal effects.

Trailer Operators — public data on the Trailers Map

If you sign up as a Trailer Operator (separate from a supplier account), the following information about each trailer you add becomes publicly visible on our Trailers Map:

• Your business name
• Each trailer's full address and exact pin location (latitude / longitude)
• Up to two photos per trailer that you upload
• The short description (up to 280 characters) you write for each trailer
• Your contact methods (any combination of phone, WhatsApp, email) so customers can reach you directly
• Your business type (Coffee, Food, or Coffee & Food) — used by the map filter

Lawful basis: explicit consent (GDPR Article 6.1.a). You give this consent by checking the public-display checkbox at registration. The checkbox is mandatory because the entire purpose of the Trailer Operator account is to appear on the public map — without consent there is no service to provide.

Embedded Google Maps: the public map is rendered using Google Maps Platform. When the page loads, your browser makes requests to maps.googleapis.com and maps.gstatic.com; Google may process your IP address as part of that load. See Google's Privacy Policy.

"Trailers near me" GPS feature: when you click this button on the map, your browser asks for permission to share your current location. We use it only to centre the map on your view and immediately discard the coordinates — they are never sent to our server and never stored.

Right to remove: you can delete any trailer (which removes its pin from the map immediately) at any time from your operator dashboard at /operator/trailers. You can also close your entire Trailer Operator account; doing so erases your operator profile, all trailers, and all uploaded photo files within 7 working days.

Events & Parking Spots — public listings and applications

We operate two further account types: Events Coordinator (posts events that need coffee or food trailers) and Parking Spots Operator (lists parking spots available to trailers). Both are separate from supplier and Trailer Operator accounts.

If you post a listing, the following becomes publicly visible to anyone on /events-and-parking, with no login required:

• Events: the event name, theme, start date and duration, full location, the type of trailer you need, your description, and any photos you upload
• Parking spots: the location, whether electricity and water are provided, your description of the trailer you want, any photos you upload, and the contact details you enter (any combination of phone, WhatsApp and email)
• The display name on your account, shown alongside your listings

Your account email address is not published — it is used to send you applications. Note that a parking-spot listing publishes whatever contact details you choose to enter, so only enter details you are happy to make public.

If you apply to a listing (only Trailer Operators can), the business name, phone number, email address and any additional details you type into the application form are sent to the person who posted that listing — by email and in their dashboard. This is a disclosure to another user of the platform, not to the public: applications are never shown on any public page. We share only what you type into that form.

Lawful basis: performance of a contract (GDPR Article 6.1.b) — publishing your listing and passing an application to the listing owner are the service you signed up for. Posting a listing and submitting an application are both voluntary acts you initiate.

Retention: events are hidden from the public page automatically once the event's end date has passed, but the record is kept until it is deleted — by you, or by an administrator. Parking spots stay listed until you delete them. You can edit or delete any listing at any time from your dashboard; deleting a listing also permanently removes its photos and any applications it received. Closing your account erases your profile, every listing you posted, all uploaded photo files, and all applications you received, within 7 working days.

Jobs: job posts and applications

Job Posting Employer accounts post jobs on /jobs. A job post is publicly visible, with no login required: the job title, description, type, pay (if given), county and town, the date it was added, its closing date, any photos, and the company name and website. The employer's account email, the email where applications arrive and the phone number are not published.

If you apply for a job, your name and surname, phone number, email address and the CV file you attach are sent to the employer who posted that job, by email (with the CV attached) and in their dashboard, after you confirm that the job's location suits you. Applications are never shown on any public page. We also email you a copy of what you applied for.

Lawful basis: taking steps at your request before entering a contract (GDPR Article 6.1.b): passing your application to the employer is the service you ask for when you press Send. Once the employer receives it, they are responsible for it as a separate data controller and may use it only to recruit for that job.

Retention: we keep applications and CV files privately on our server for 6 months, then delete them automatically (the file, your name, phone and email). To have yours deleted sooner, reply to the confirmation email or contact us. The copy the employer received by email is kept by them under their own policy. Jobs leave the site on their closing date (60 days at most); employers can put a job on hold, renew it or delete it, and deleting a job also deletes its photos and the applications it received.

Courses: buying a course

If you buy a course on /courses, you give us your name and email address. We send a link to that address to confirm it, and after payment we send the course PDF and a personal download link to it. Stripe handles the payment: we never see your card details. With your order we keep the course, the price, the date, the box you ticked before paying, and when the course was sent and downloaded.

Lawful basis: performance of a contract (GDPR Article 6.1.b): selling and delivering the course you ask for. Keeping the sales record afterwards is a legal obligation (Article 6.1.c, tax and accounting rules).

Retention: an order whose email is never confirmed is deleted automatically after 30 days. Paid orders are kept as accounting records for as long as tax law requires (6 years in Ireland).

Cookies

We use a small set of strictly-essential cookies to keep the platform working. We do not set any analytics, advertising or tracking cookies.

Visit statistics (Umami) — to see which pages people use, we count visits with Umami (Umami Software, Inc., USA). It sets no cookies and stores nothing on your device. With each page view your browser sends Umami the page address, the address of the page you came from, the page title, your browser, device type, screen size and language, and, as with any connection, your IP address. Before anything is sent, private links (email confirmation, password reset, course download) are removed from the addresses, and so is everything after the "?" except campaign tags (utm_...). We only see totals, such as page views, visitors, referring sites, countries, browsers and devices: Umami does not give us your IP address or anything that identifies you.

Essential cookies (always set) — session cookie for keeping you logged in, CSRF token for form security, a small cookie that records your cookie-banner choice so we don't ask again on every visit, and, only when you choose a country version (Ireland or United States) in the flag menu, a cookie that remembers that choice for a year. We look up the country of your IP address in an offline database, without storing it, to suggest the right country version.

If we ever add analytics or marketing cookies in the future, we will update this section, present a granular consent banner, and load nothing non-essential until you opt in.

Marketplace partner links — products on the Marketplace come from partner shops through the Awin affiliate network. We set no cookie for them and only count how many times a product is opened or clicked, without storing who you are (repeat views on the same day are recognised by a one-way hash of your IP address, deleted within 3 days). When you click "See the current price on …" you leave our site: Awin and the partner shop may then set their own cookies, under their own privacy policies.

Sub-processors

The following third parties process personal data on our behalf in order to deliver the service. Each is bound by a data processing agreement (DPA) and processes only what's needed for its specific function.

• Hostinger (EU) — web hosting, MySQL database hosting, transactional email delivery (SMTP).
• Stripe (Ireland / global) — payment processing for Verified subscriptions and listing promotions. Stripe is a separate data controller for the payment information you provide directly to its checkout.
• Umami (Umami Software, Inc., USA) — visit statistics without cookies (see Cookies). Its data processing agreement includes the EU Standard Contractual Clauses.

If we add a new sub-processor that materially changes how your data is handled, we will update this list and give reasonable notice in advance.

International transfers

Most of your data stays in the EU. There are two exceptions. Stripe may transfer payment data outside the EU as part of its global processing infrastructure under EU-approved Standard Contractual Clauses (SCCs); if you avoid the paid features (Verified subscription, listing promotions), Stripe is never engaged on your behalf. Umami, our visit statistics service, is a US company whose providers are in the USA and the EU; it receives only the page-view details described under Cookies, under the same Standard Contractual Clauses.

Data retention

We keep personal data only as long as we need it for the purpose collected, or as required by law.

• Account data — kept while your account is active. After you close it, we delete profile, listings, images, and contact details within 7 working days; we may keep a minimal record (email + hashed password) for up to 24 months for fraud-prevention.
• Payment & tax records — retained for at least 7 years to meet Irish tax law obligations.
• Verification documents — kept while the Verified subscription is active and deleted within 30 days of cancellation.
• Support & contact-form messages — retained for up to 3 years so we can refer back to past correspondence.
• Job applications and CVs — deleted from our server automatically 6 months after the application was sent (Jobs).
• Course orders: unconfirmed orders deleted automatically after 30 days; paid orders kept as accounting records for 6 years (Courses).
• Sign-in IP address — the IP recorded at your last sign-in is erased automatically once 180 days have passed since that sign-in. The sign-in and last-used timestamps themselves are kept for the life of the account.
• Server logs — request logs (with sensitive query-string parameters redacted) are kept for up to 30 days for security and abuse-detection purposes, then rotated.

Your rights

Under GDPR you have the following rights in relation to your personal data. We respond to all requests within one month (GDPR Art. 12.3); exercising any of them is free, and we won't penalise you for using them.

• Access — get a copy of the personal data we hold about you. Logged-in suppliers can self-serve at /dashboard/account → "Download my data". Non-registered users can request a copy via the contact form.
• Rectification — ask us to correct inaccurate or incomplete data. Suppliers can edit their profile + listings directly from the dashboard.
• Erasure ("right to be forgotten") — ask us to delete your data. Logged-in suppliers can submit a deletion request at /dashboard/account → "Delete my account" (email confirmation + 7-working-day admin-action window). Subject to retention obligations described in section 8.
• Restriction — ask us to pause processing while we resolve a query about your data. Email us via the contact form.
• Portability — get your data in a structured, machine-readable format you can transfer to another service. The "Download my data" button on your account page returns a JSON export covering this right.
• Objection — object to processing based on our legitimate interests, including direct marketing. Email us via the contact form.
• Withdraw consent — where processing is based on consent (e.g. analytics cookies), you can withdraw it at any time via the cookie banner or by clearing your cookies.

Every request is logged in our internal DSR audit trail (date, type, status) so we can prove timely compliance if challenged. You'll see your own audit history on your account page.

Security

We use reasonable technical and organisational measures to protect your data:

• HTTPS/TLS for all traffic to and from the platform
• Passwords stored only as bcrypt hashes — never in plain text
• Rate limiting and CSRF protection on authentication and form endpoints
• Regular software updates and dependency patching
• Server location in the EU (Hostinger), with backups that don't include card data
• Access controls limiting who on our team can see account-level data

No system is perfectly secure. If we discover a breach that is likely to result in a risk to your rights, we will notify the Data Protection Commission within 72 hours and notify affected users without undue delay, in line with GDPR Article 33–34.

Children

The platform is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has registered an account, please contact us and we'll delete the account and any associated data promptly.

Changes to this policy

We may update this policy from time to time as the platform evolves or the law changes. The "last updated" date at the top of this page reflects the most recent revision. For material changes — for example, adding a new sub-processor or expanding the categories of data we collect — we will give reasonable notice by email or in-account notification before they take effect.

Contact & complaints

To reach us about anything in this policy — to exercise a right, ask a question, or raise a concern — use the contact form. We aim to respond within 5 working days and at the latest within 1 month.

If you are not satisfied with our response, you have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or with the supervisory authority in your country of residence.