What are Cookies?

Cookies are small text files stored on your device (computer, tablet, smartphone, etc.) when you visit a website. These files save information about your browsing and preferences, allowing the site to function in an optimized and personalized way. At Marketplace Vila, cookies help us improve your experience by recognizing your preferences on future visits and adjusting our services to your needs. Although cookies do not directly identify the user, they can make browsing smoother and more personalized, improving the site’s functionality.

How do we use Cookies at Marketplace Vila?

By accessing Marketplace Vila, you are accepting the use of cookies on your device, in accordance with this policy. If you choose to disable or block cookies in your browser, some site features may be affected, compromising your user experience. We use cookies for various purposes, including:

• Ensuring the proper functioning of the site;
• Personalizing content and ads according to your preferences;
• Improving the performance and usability of the platform;
• Ensuring the security of online transactions.

Types of Cookies We Use

Strictly Necessary Cookies: Essential for the site’s operation, enabling basic functionalities like logging into secure areas or filling out forms. Without these cookies, parts of the site may not function correctly.

• Performance Cookies: Collect anonymous and aggregated data to measure traffic and understand how users interact with the site, helping to improve its efficiency.
• Functionality Cookies: Allow the site to remember your choices (such as language or region) and provide more personalized features.
• Advertising and Social Media Cookies: Used to display relevant advertising and allow content sharing on social media. They are also used to track your browsing across various platforms, offering personalized ads.

Managing Cookies

During the purchase process at Vila, we use cookies to ensure your transactions are secure. These cookies collect technical information about the device used to identify suspicious behavior and prevent fraud. You can configure your browser to block or delete cookies. However, by disabling essential cookies, your browsing experience may be impaired. Consult the specific instructions for managing cookies in the most common browsers:

• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Safari

For more information about cookies and how to manage them, visit All About Cookies. If you do not want your visits to our site to be recorded by Google Analytics, you can opt-out of this tracking at Google Analytics Opt-out.

Changes to the Cookie Policy

The Marketplace Vila cookie policy may be updated periodically to ensure compliance with current legal standards or to reflect improvements in our services. It is recommended that you consult the policy regularly to be aware of possible changes.

Last modified date: 23/09/2025

Data Registration and Processing

This describes the personal data processed in the Vila marketplace. It technically documents all data processed, its purpose, storage, and the processing performed.

General Data

The following data is processed for all users (authenticated and non-authenticated).

Age

To comply with legal restrictions on the sale of products to minors, a functional cookie is stored with the following indication provided by the user.

Question: Are you 18 years of age or older?

Data stored: Yes/No

Validity: 7 days

Storage: Storage is done only in the functional cookies of the user’s browser.

Processing: The data is used only to hide, or not, products with sales restrictions for minors.

Erasure: The data is deleted after the cookie’s Time to Live (TTL) expires, or by manually deleting the browser’s cookies.

Bot Verification

A bot verification service is used to add a layer of security without hindering interaction. The cookie described below is used.

Cookie name: cf_clearance

Data stored: Verification token for automated users.

Validity: 30 seconds

Google Analytics

The Google Analytics service is used, which makes use of cookies and other technologies to gather information about interactions in the Marketplace.

The Google Analytics cookie policy is available here.

Data related to traffic source

Metadata related to traffic sources is collected. If the user allows it, in the dialog box that requests this permission, the following data is stored in the session cookies.

Cookie name: sbjs_current

Data stored: Stores information about the traffic source of the current session: how the visitor arrived at the website during this specific visit (e.g., through a search engine, direct link, or marketing campaign).

Validity: 30 minutes

Cookie name: sbjs_current_add

Data stored: Stores additional metadata about the source of the current session, such as the campaign name, keyword, or content used in the URL parameters (e.g., UTM tags).

Validity: 30 minutes.

Cookie name: sbjs_first

Data stored: Records the original source that first brought the visitor to the website. This helps identify the initial point of contact, even if the user returns later through other means.

Validity: 6 months

Cookie name: sbjs_first_add

Data stored: Similar to sbjs_first, but contains additional details about the source of the first visit, such as campaign or keyword information.

Validity: 6 months

Cookie name: sbjs_migrations

Data stored: Used internally by Sourcebuster to track version changes or updates to its cookie structure. It ensures backward compatibility and a smooth transition of tracking data.

Validity: 6 months.

Cookie name: sbjs_session

Data stored: Stores session-level data, such as timestamps and session duration, to help distinguish between multiple visits. It expires at the end of the browser session.

Validity: Session (expires when the browser is closed)

Cookie name: sbjs_udata

Data stored: Contains anonymous technical details about the user’s browser, device, and potentially geolocation (based on IP). This data allows for accurate source tracking but does not contain personally identifiable information.

Validity: 6 months

Storage: Storage is done in the non-functional cookies of the user’s browser. When an order is placed, the data is used to add metadata to it.

Processing: The data is used for statistical analysis.

Erasure: The data subject can request the removal of their data. As the metadata listed above is not necessary for compliance with any legal obligation, it will be deleted.

Orders

The Marketplace allows authenticated and non-authenticated users to place orders. For authenticated users, the data already existing in the user’s profile is used to pre-fill the corresponding fields in the order.

The data associated with the order, listed below, is necessary for completing the purchase and its delivery.

• First and last name
• Tax ID (optional)
• Address: Includes first name, last name, company name (optional), country, address, postal code, city, district, phone, Tax ID (optional)
• Email address: Necessary for transactional communications related to the order. The address is verified during the checkout process to ensure the viability of the communication channel.
• Phone contact: Necessary for the logistics of order delivery.
• Payment data: For the “Direct Transfer to the Seller(s)” and “In-store Payment” methods, no payment data is stored, with payment verification done manually by the sellers. For payments made via a payment gateway (SIBS Gateway), only SIBS transaction identifiers are stored; no personal or payment data of the customer is saved.

Storage: The data is recorded in a high-availability cloud database hosted in the European Union (using the AWS RDS service installed in the Frankfurt datacenter). Personal data that allows for the identification of the person will be encrypted.

Processing: The collected data is used for completing the purchase and its delivery, and other associated legal obligations.

Erasure: Data collected from non-registered users is kept only for the period necessary to fulfill the purposes for which it was collected, namely the execution of the order, delivery of the product(s), and compliance with legal obligations, such as tax or accounting.

Authenticated Users

At the time of user registration, the data listed below is collected.

• Email address
• Password: A hash is created from the value, and it is not reversible.

The user can add the following data in their account management.

• First and last name
• Billing address: Includes first name, last name, company name (optional), country, address, postal code, city, district, phone, Tax ID (optional)
• Shipping address: Includes first name, last name, company name (optional), country, address, postal code, city, district, phone, Tax ID (optional)

The user profile also aggregates the following data.

• List of followed stores.
• Reviews made for stores on the Marketplace.

Processing: The data is used to carry out necessary functions (e.g., shipping orders, customer notifications).

Erasure: The collected data will be deleted at the request of the account holder. The deletion of the account by the user will trigger the automatic deletion of the holder’s profile data.

Portability: The data subject can request data portability. An email will be sent containing all the data registered on the Marketplace platform related to the subject.

Stores and Sellers

Sellers

The private data associated with a seller is the same as that associated with a registered user. The “Authenticated Users” section should be consulted.

In addition to the common data, a seller is associated with Stores they manage, whose data is described below.

Stores

The data associated with a Store in the Marketplace is listed below.

• Identification: Name; GPS Coordinates
• Address: Street address; Postal code; Country; Region
• Electronic contacts: Email; Phone contact
• Direct payments: IBAN; MBWay number; SPIN number
• Transactional communications: Number for SMS communication

Storage: The data is recorded in a high-availability cloud database hosted in the European Union (using the AWS RDS service installed in the Frankfurt datacenter).

Processing: The collected data is used for completing the purchase and its delivery, and other associated legal obligations.

Erasure: The collected data is kept only for the period necessary to fulfill the purposes for which it was collected, namely the execution of the order, delivery of the product(s), and compliance with legal obligations, such as tax or accounting. The seller can request the removal of the data from the Marketplace manager, who will exempt all data not necessary for compliance with legal obligations.

Portability: The data subject can request data portability. An email will be sent containing all the data registered on the Marketplace platform related to the subject.

Last modified date: 23/09/2025