GDPR Notice

Controller: Tradegenius SL, Calle Villalba Hervas 2, 4-2, 38002 Santa Cruz de Tenerife, Spain.

Contact for data-protection matters: service@wholesaleup.com or write to the registered postal address above.

Lead supervisory authority: the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) at www.aepd.es.

You have the following rights regarding your personal data. To exercise any of them, email service@wholesaleup.com with your request — we will respond within 30 days of receipt (Article 12), extendable by up to two further months for complex or high-volume requests (we will notify you of any such extension within the initial 30 days).

• Right of access (Article 15) — request a copy of the personal data we hold about you.
• Right to rectification (Article 16) — correct inaccurate or incomplete data.
• Right to erasure (Article 17) — ask us to delete your personal data, subject to legal-retention exceptions.
• Right to restrict processing (Article 18) — pause our use of your data while a dispute or correction is resolved.
• Right to data portability (Article 20) — receive your data in a structured, machine-readable format (JSON or CSV).
• Right to object (Article 21) — object to processing based on legitimate interests, including direct marketing and profiling.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting prior lawful processing.
• Right to lodge a complaint — with your local data protection authority. If WholesaleUp™ is your controller, the lead authority is the Spanish AEPD; UK users may also contact the UK Information Commissioner's Office (ICO).

We process personal data under one or more of the following Article 6(1) lawful bases:

• Contract (6(1)(b)) — to provide the WholesaleUp™ service you have signed up for: account management, the supplier and buyer directories, messaging, and the AI-powered translation feature where the messaging contract is engaged.
• Consent (6(1)(a)) — for non-essential cookies, marketing communications, and the optional personalisation features. You can withdraw consent at any time via the cookie banner or your account preferences.
• Legitimate interests (6(1)(f)) — for service improvement, fraud and license-sharing prevention, security monitoring, and the device-fingerprint-based abuse-detection signals described in §1.10 of our Privacy Policy. We have completed a balancing test for each legitimate-interests use case; you can request the summary by emailing us.
• Legal obligation (6(1)(c)) — to comply with tax, accounting, anti-money-laundering, and other regulatory duties applicable to a Spanish-registered service provider.

Several of our service providers (Vercel, Cloudflare, Resend, Anthropic, Stripe, Google) are based in the United States. Where personal data is transferred outside the EEA or UK we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner.
• The EU-US Data Privacy Framework (DPF) and its UK Extension where the recipient is DPF-certified (verifiable at www.dataprivacyframework.gov) — applied as a defence-in-depth measure alongside the SCCs.

If a sub-processor's DPF certification is suspended, withdrawn, or invalidated, the transfer continues to rely on the SCCs. Section 6 of our Privacy Policy details the full sub-processor list and the legal basis applied to each transfer.

WholesaleUp™ is a B2B service intended for business users aged 18 or over. We do not knowingly collect personal data from children under 16 (the age threshold under Spanish law per Article 7 of LOPDGDD). If you believe a child has registered an account, contact us at service@wholesaleup.com and we will delete the account and associated data.

We retain personal data for as long as you maintain an active account, plus the minimum periods required for legal, tax, and audit purposes. Granular event-level data (page views, deal impressions, search interactions) is aggregated into anonymised daily statistics after 7 days and the raw records are permanently deleted. Specific retention windows per data category are documented in §7 of our Privacy Policy.

We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The license-abuse detection signals described in §1.10 of our Privacy Policy inform manual review by our team and may trigger account suspension pending appeal; suspensions are not enforced solely by automated means — every adverse decision is reviewed by a human before account access is permanently affected.

We may update this GDPR Notice from time to time. The Effective date shown at the top of this page is the date of the current version. Material changes will be notified by email or via a prominent on-site notice before they take effect.

• Privacy Policy — full clause-by-clause detail of all data we collect and process
• Cookie Policy — what cookies we use and how to manage your consent
• Terms of Use — the contractual terms governing your use of the service
• Contact us — get in touch for any data-protection or privacy question