Privacy Policy

1. Who is responsible for your data

FOMO Group OÜ, a company registered in Estonia under registry code 17616828, with its registered address at Kastani tn 64a, 50410 Tartu, Estonia ("maxdrop", "we", "us"), is the controller of personal data processed through maxdrop.io within the meaning of the EU General Data Protection Regulation (GDPR). You can reach us about any privacy matter at support@maxdrop.io.

This policy explains what personal data we collect when you use maxdrop, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to maxdrop.io and does not cover third-party sites we link to.

2. What we collect

• Identity data: your nickname (username), first and last name, date of birth, and, if we ask you to verify your identity, a copy of a government-issued photo ID.
• Contact data: your email address, phone number, and delivery address (street, apartment, city, region, postal code, country), and where we ask for it, proof of address.
• Account data: your password (stored only in hashed form), account settings, the version of our Terms you accepted and when, and your marketing preferences.
• Google sign-in data: if you sign in with Google, the information described in Section 3.
• Financial and transaction data: the record of each payment you make (amount, date, currency, payment method type, and the payment provider's transaction reference), your balance and credit history, box openings, won items, sell-backs, and shipping requests. Your full card details are collected directly by our payment provider; we never see or store them.
• Technical data: IP address, browser and device type, operating system, and access timestamps, collected for security, fraud prevention, and to keep the Site working properly.
• Communications data: the content of messages you send to support, and messages we send to you.

3. Google sign-in

If you choose to sign in with Google, Google shares with us your email address, your Google account identifier, and, where your Google profile provides them, your name and profile picture. We use this information only to create your account, sign you in, link your Google login to your maxdrop account, and keep your account secure. We do not access your Gmail, Google Drive, Calendar, contacts, or any other Google data, and we do not sell Google user data or use it for advertising. You can remove maxdrop's access at any time in your Google account settings (Security → Third-party apps with account access). Removing access does not delete your maxdrop account; to delete it, email support@maxdrop.io.

4. Why we process your data, and on what legal basis

• To perform our contract with you: running your account (registration, login, balance management), processing box openings, payments, sell-backs and shipments, and answering your support requests.
• To meet our legal obligations: keeping accounting and tax records, and responding to valid requests from courts, tax authorities, regulators, or law enforcement.
• For our legitimate interests: verifying your age and identity, preventing fraud, chargebacks, money laundering, and underage use, meeting the requirements of our payment providers, and keeping the Site secure. We have balanced these interests against your rights and consider them necessary to operate the platform safely.
• With your consent: sending you marketing communications and setting optional cookies. You can withdraw consent at any time, without affecting processing already carried out.

5. Who we share your data with

We share personal data with: payment providers, to process your payments; identity-verification providers, to check documents you submit; shipping and logistics partners, to deliver won items to you; Google, if you use Google sign-in; IT, hosting, and email providers, who process data on our behalf under contract; professional advisers such as lawyers and accountants; and courts, regulators, tax authorities, and law enforcement, where we are legally required to, or where we reasonably believe disclosure is necessary to investigate suspected fraud, money laundering, or a breach of our Terms.

We do not sell your personal data, and we do not share it with anyone for their own marketing without your consent.

6. Where your data is stored and processed

Our infrastructure and service providers may be located inside or outside the European Economic Area. Where we transfer personal data outside the EEA, we rely on an adequacy decision of the European Commission or the Commission's Standard Contractual Clauses, and we take reasonable steps to ensure your data receives an equivalent level of protection.

7. How long we keep your data

• Accounting and transaction records: 7 years from the end of the financial year they relate to, as required by Estonian accounting law.
• Identity-verification records and the transactions connected to them: 5 years after the end of our relationship with you.
• Account, contact, and communications data: for as long as your account is open, and afterwards only as long as needed to handle complaints or legal claims.
• Technical data: up to 12 months, unless needed longer to investigate a specific security or fraud incident.

In no case do we keep personal data for more than 10 years after your account is closed. When a retention period ends, we delete or anonymize the data.

8. Your rights

Under GDPR, you have the right to: access the personal data we hold about you; rectify it if it is inaccurate or incomplete; erase it, subject to our legal retention obligations (Section 7); restrict or object to certain processing, including the right to object at any time to direct marketing; receive a copy of the data you provided to us in a portable, machine-readable format; and, where processing is based on consent, withdraw that consent at any time. To exercise any of these rights, contact us at support@maxdrop.io. We will respond within one month, which may be extended where the law allows.

If you are unhappy with how we have handled your data, you can lodge a complaint with our lead supervisory authority, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or with the data protection authority in your own EU country of residence, for example the Agencia Española de Protección de Datos (AEPD) in Spain.

9. Cookies

We use cookies that are strictly necessary for the Site to work, and, only with your consent, optional cookies. See our Cookie Policy for details and to change your cookie settings at any time.

10. Children

maxdrop is not directed at, and must not be used by, anyone under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have, we will delete it and take appropriate action on the associated account.

11. Changes to this policy

We may update this Privacy Policy from time to time, including to reflect changes in the law or in how we process data. We will post the updated version on this page with a new "last updated" date, and where a change is material we will notify you through your account or by email before it takes effect.

12. Contact us

Questions about this policy, or requests relating to your personal data, can be sent to support@maxdrop.io or by post to FOMO Group OÜ, Kastani tn 64a, 50410 Tartu, Estonia. Website: maxdrop.io.