Last updated: 3 September 2026
This Privacy Policy explains how WPBay collects, uses, stores, shares and otherwise processes personal data when you visit WPBay.com, create an account, purchase products or services, sell products or services, communicate through the marketplace, subscribe to communications, contact support or otherwise interact with WPBay.
It also explains your rights under the General Data Protection Regulation (“GDPR”), applicable Romanian data-protection legislation and other applicable privacy laws.
1. Who We Are
WPBay is operated by CODE IKIGAI SRL, a company registered in Romania under CUI 37778967, VAT number RO37778967, EUID ROONRC.J2017003813122, and Commerce Registry number J2017003813122.
Registered office:
Bistritei Street 27-29-31
Staircase 4, Floor 1, Apartment 31
400430 Cluj-Napoca
Cluj, Romania
For the purposes of the GDPR, CODE IKIGAI SRL is generally the data controller for personal data processed in connection with the operation of WPBay.
Privacy requests may be sent to [email protected].
2. Scope of This Privacy Policy
This Privacy Policy applies to visitors, registered users, buyers, sellers, affiliates, service providers and other persons whose personal data is processed through WPBay.
It covers personal-data processing carried out in connection with the WPBay website, marketplace, checkout, seller dashboard, buyer accounts, licensing infrastructure, support systems, communications and related services.
Separate terms may apply to the commercial relationship between WPBay, buyers and sellers, including our Terms and Conditions, Seller Agreement, Refund Policy, Cookie Policy, marketplace policies, Digital Services Act procedures and other applicable policies.
This Privacy Policy deals specifically with the processing of personal data and does not replace those documents.
3. Personal Data We Collect
The information we process depends on how you use WPBay.
When you create or use an account, we may process your name, username, email address, account identifiers, password in securely hashed form, profile information, account preferences, login history, IP address and security information.
When you make a purchase, we may process your name, email address, billing address, country, company details, VAT or tax identification number where applicable, order details, purchased products or services, prices, discounts, tax amounts, transaction identifiers, payment status, refund information and other information needed to complete and document the transaction.
WPBay or its payment processors may also use information needed for fraud prevention and payment authentication. WPBay generally does not need to store complete payment-card numbers where payments are processed by an external payment provider. We may instead receive transaction identifiers, payment status, card type, limited card information such as the final digits, risk indicators or similar information.
When you register as a seller, we may process your legal or trading name, contact information, address, country of residence or establishment, company registration information, VAT number, tax identification information, seller profile information, payout information and information necessary to comply with marketplace, tax, anti-fraud and legal requirements.
Where legally necessary, additional verification information may be requested from sellers, such as proof of identity, proof of address, company documentation or information required by payment or payout providers. Some verification information may be collected directly by the relevant provider rather than WPBay.
For seller payouts, we may process payment-account identifiers and information connected with services such as bank transfers or third-party payout providers.
When buyers and sellers communicate through WPBay, we may process the contents of messages, attachments, support requests, transaction references and associated metadata.
When you use WPBay licensing or product-update services, we may process information such as the product identifier, license identifier, activation status, website URL or domain associated with an activation, WordPress or software version information, IP address, timestamps and technical information necessary to provide licensing, updates, security or abuse prevention.
When you contact WPBay support, we may process your name, email address, account details, order details, correspondence, technical information and any files, screenshots, logs or other information you choose to provide.
When you participate in affiliate or referral programs, we may process account information, referral identifiers, referred transactions, commission information, payment information and information required for fraud prevention and accounting.
We also automatically receive certain technical information when you use the website, including IP address, browser type, device type, operating system, referring page, pages visited, timestamps, approximate geographic information derived from IP addresses, server logs and security events.
4. Information Obtained From Other Sources
Some personal data may be obtained from sources other than directly from you.
These sources can include payment providers, payout providers, sellers or buyers involved in a transaction, fraud-prevention services, tax-validation services, company and tax registries, analytics providers, affiliate systems, hosting or security services and public authorities.
For example, a payment processor may tell us whether a transaction succeeded or failed, a VAT validation system may confirm whether a VAT number is valid, or a seller may provide information connected with a support dispute involving a buyer.
Where required by Article 14 GDPR, this Privacy Policy is intended to provide information concerning such processing.
5. Why We Process Personal Data and Our Legal Bases
WPBay only processes personal data where a lawful basis exists.
Performance of a Contract
Under Article 6(1)(b) GDPR, we process personal data where necessary to enter into or perform a contract with you.
This includes creating and administering accounts, processing purchases, supplying digital products or services, managing licenses, processing refunds, operating seller accounts, calculating seller earnings, making payouts, providing support and administering marketplace functionality.
Compliance With Legal Obligations
Under Article 6(1)(c) GDPR, we process information where necessary to comply with legal obligations.
These obligations may relate to accounting, invoicing, VAT, taxation, consumer protection, regulatory reporting, fraud investigations, legal claims, court orders, law-enforcement requests, marketplace obligations, record keeping and other requirements imposed by Romanian or European Union law.
Legitimate Interests
Under Article 6(1)(f) GDPR, we process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your fundamental rights and freedoms.
These interests may include preventing fraud and abuse, securing WPBay and its users, operating and improving the marketplace, preventing unauthorized license use, investigating disputes, enforcing marketplace rules, preventing malicious activity, maintaining business records, understanding service performance, protecting intellectual property and establishing, exercising or defending legal claims.
Consent
Under Article 6(1)(a) GDPR, we process personal data based on consent where consent is required.
This may apply to non-essential cookies, certain analytics or advertising technologies, optional marketing communications and other processing where applicable law requires consent.
You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
6. Marketplace Transactions and Merchant of Record Processing
Where WPBay acts as the Merchant of Record for a marketplace transaction, WPBay processes information necessary to administer the sale to the customer.
This can include checkout information, payment information, tax information, invoices, refunds, consumer-rights requests, chargebacks and transaction records.
The seller whose product or service you purchase may also receive information reasonably required to deliver the product or service, provide updates, operate licensing, communicate regarding the purchase or provide support.
Depending on the circumstances and the purpose for which information is used, a marketplace seller may act as an independent data controller for data it receives or, in certain circumstances, process information on behalf of WPBay.
Sellers are required to process personal data lawfully and only for legitimate purposes connected with their relationship with buyers and WPBay.
7. Payments, Refunds and Chargebacks
Payments may be processed using external payment service providers.
Information you submit to a payment provider is also processed according to that provider’s own privacy terms.
WPBay may receive and retain transaction identifiers, payment status, amount, currency, fraud indicators, payment method information, chargeback information, refund information and limited payment-account details necessary for transaction administration.
We may provide transaction information to payment providers, banks, card networks, financial institutions, fraud-prevention providers or other parties where required to process transactions, investigate fraud, deal with disputes or comply with financial obligations.
8. Seller Payouts
To issue seller commissions or other amounts owed through WPBay, we may process seller identity information, tax information and payout-account information.
Where payouts are made using third-party providers, information necessary to make the payment may be transmitted to those providers.
Such providers may independently process personal data in accordance with their own legal and regulatory obligations.
9. Tax, VAT, Accounting and Invoicing
WPBay may process and retain information necessary to comply with Romanian, EU and other applicable tax and accounting laws.
This may include customer and seller names, addresses, countries, tax-residence information, VAT numbers, company registration information, transaction details, invoice information, payment information, evidence used to determine customer location, seller earnings and related records.
Certain tax and accounting records must be retained even if you close your WPBay account or request deletion of your personal data.
Where international tax obligations apply, WPBay may disclose information to competent tax authorities or other legally authorized recipients.
10. DAC7 Reporting
Council Directive (EU) 2021/514, commonly known as DAC7, establishes reporting and due-diligence obligations for certain digital platform operators.
Romania implemented these requirements through Romanian tax legislation, including Government Ordinance no. 16/2023.
DAC7 does not automatically apply to every seller or every transaction conducted through WPBay.
Under DAC7, a “Relevant Activity” includes certain personal services, the rental of immovable property, the rental of transport and the sale of “Goods”. For DAC7 purposes, “Goods” means tangible property.
Accordingly, the licensing or sale of purely downloadable digital software is not treated as a sale of tangible Goods merely because it takes place through WPBay.
However, certain activities facilitated by WPBay may qualify as DAC7 Relevant Activities. In particular, services involving time-based or task-based work performed at the request of a user may constitute a “Personal Service” under DAC7.
Where WPBay is legally required to perform DAC7 due diligence or reporting in relation to a seller or activity, we may collect and verify information including the seller’s legal name, address, date of birth where applicable, tax identification number, VAT number, company registration information, tax residence, financial account information and amounts paid or credited through the platform.
Where reporting is legally required, the applicable information may be submitted to ANAF – Agenția Națională de Administrare Fiscală, which may subsequently exchange the information with tax authorities in other jurisdictions as required by law.
DAC7 information is processed under Article 6(1)(c) GDPR because processing is necessary to comply with a legal obligation.
Information required for DAC7 compliance is retained for the period required by applicable tax and record-keeping legislation.
If a seller is legally required to provide information for DAC7 due diligence and fails to provide it after the legally required procedures and reminders, WPBay may take measures required or permitted by law, including restricting relevant seller activity or payouts.
DAC7 is a reporting framework and does not itself create a new tax on sellers.
11. Product Licensing, Updates and Abuse Prevention
WPBay may operate infrastructure used for product activation, licensing, automatic updates, download authorization or verification of marketplace purchases.
For these purposes we may process a license or purchase identifier, product identifier, domain or website URL, IP address, activation status, activation timestamps, version information and other technical information necessary to provide the requested functionality.
Such information may also be used to detect fraudulent licenses, unauthorized distribution, abuse of download systems or violations of applicable license terms.
Processing necessary to provide licensing functionality is generally based on performance of a contract. Anti-abuse and security processing may also be based on WPBay’s legitimate interests.
12. Reviews, Comments and Public Content
When you submit a review, comment, forum contribution, seller profile, product listing or other content intended to be public, information included in that content may become publicly accessible.
You should avoid publishing personal data that you do not wish to make public.
When visitors leave comments, we may collect the information entered in the comment form together with IP address and browser user-agent information to prevent spam, abuse and malicious activity.
An anonymized representation of an email address may be transmitted to Gravatar where that functionality is enabled. If Gravatar recognizes the associated account, the relevant profile image may appear publicly with your comment.
Publicly submitted content may remain visible after account closure where retaining the content is necessary to preserve discussions, reviews, marketplace integrity or legal records. Where appropriate, identifying information may instead be removed or anonymized.
13. User-Uploaded Files and Media
If you upload files, images, product packages, screenshots, documentation, support attachments or similar content, WPBay processes that material for the purpose for which it was submitted.
Images can contain embedded metadata, including location information. You should remove sensitive metadata before uploading material intended for public distribution.
You are responsible for ensuring that personal data relating to other people is not uploaded unless you have a lawful basis to provide that information.
14. Support Communications
When you contact WPBay, we retain information necessary to respond to the request, investigate technical or marketplace issues, maintain support history and resolve disputes.
Support messages may include account information, transaction information and technical data supplied by you.
Support information may also be processed where necessary to establish, exercise or defend legal claims.
15. Security, Fraud Prevention and Marketplace Integrity
WPBay processes technical and account information to protect the marketplace, users and infrastructure against fraud, spam, unauthorized access, account takeover, payment fraud, malicious files, abusive downloads, licensing abuse and other prohibited activity.
This may involve analyzing IP addresses, login attempts, account behavior, transaction information, device or browser characteristics, license activity and other security indicators.
Information may be shared with hosting, security, fraud-prevention, payment or infrastructure providers where necessary to identify or prevent abusive activity.
16. Legal Notices, Content Moderation and Regulatory Requests
WPBay may process personal data contained in copyright complaints, trademark complaints, illegal-content reports, Digital Services Act notices, seller complaints, consumer complaints, security reports and similar submissions.
This may include the identity and contact details of complainants, affected sellers or users, evidence supplied with a report and communications relating to the matter.
Information may be shared with relevant parties where required by law or necessary to fairly investigate or resolve the matter.
We may also preserve and disclose information where required by a valid legal request from a court, regulatory authority, law-enforcement authority, tax authority or other legally competent body.
17. Cookies and Similar Technologies
WPBay uses cookies and similar technologies necessary for website functionality, authentication, security, shopping carts, checkout, user preferences and other core functionality.
Strictly necessary technologies may be used without consent where permitted by applicable law because they are necessary to provide a service requested by the user or protect the service.
Non-essential cookies and similar technologies used for analytics, advertising or other optional purposes are activated only where a valid legal basis exists and, where required, after consent has been obtained.
Where consent is used, you may withdraw or change your choices through the cookie-consent controls made available by WPBay.
Continuing to browse WPBay does not by itself constitute consent to non-essential cookies where applicable law requires affirmative consent.
Additional details concerning cookie categories, providers and durations are provided in our Cookie Policy and cookie-consent interface.
18. Analytics
WPBay may use analytics services to understand how users interact with the marketplace, identify technical problems and improve products, content and navigation.
Where analytics involve non-essential cookies or similar technologies requiring consent, such technologies are used only after the appropriate consent has been obtained.
Analytics data may include pages viewed, device and browser information, approximate location, referral information and interaction information.
Where reasonably possible, WPBay seeks to minimize or aggregate analytics information.
19. Marketing and Commercial Communications
If you subscribe to newsletters or promotional communications, we may process your name, email address, subscription status and engagement information for that purpose.
Where consent is legally required, marketing is sent on the basis of your consent.
In circumstances where applicable electronic-marketing law permits communications to existing customers concerning similar WPBay products or services, WPBay may rely on a legally permitted existing-customer relationship or legitimate interest, subject to the right to object and unsubscribe.
Every marketing email sent by WPBay will provide an appropriate method to unsubscribe.
Transactional, security, account, legal, purchase, support and service-related communications are not marketing messages and may continue to be sent where necessary even if you unsubscribe from promotional communications.
20. Affiliates and Referral Tracking
Where WPBay operates an affiliate or referral program, referral information may be processed to identify referred users or purchases, calculate commissions, prevent fraud and administer affiliate payments.
Affiliate tracking technologies requiring consent are used only where the applicable legal requirements for such tracking have been satisfied.
21. Who We Share Personal Data With
WPBay does not sell personal data to third parties for monetary consideration.
However, operating an online marketplace requires personal data to be disclosed to certain third parties where necessary.
Recipients may include relevant marketplace sellers, payment processors, payout providers, banks and financial institutions, hosting and cloud providers, content-delivery and security providers, email and communication providers, customer-support providers, analytics providers, cookie or consent-management providers, fraud-prevention providers, tax and accounting providers, professional advisers, insurers, auditors, affiliate-service providers and software or infrastructure providers supporting WPBay.
We may also disclose information to courts, law-enforcement bodies, regulators, tax authorities, consumer-protection authorities or other public authorities where legally required.
In connection with a merger, acquisition, restructuring, sale of assets or similar corporate transaction, information may be disclosed to professional advisers and potential transaction counterparties subject to appropriate confidentiality and legal safeguards.
Service providers processing information on behalf of WPBay are required, where applicable, to process that information in accordance with contractual and data-protection obligations.
22. International Transfers of Personal Data
Some service providers used by WPBay may process personal data outside Romania or outside the European Economic Area.
Where GDPR restrictions on international transfers apply, WPBay uses legally recognized mechanisms intended to provide an appropriate level of protection.
Depending on the destination and provider, these mechanisms may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses approved by the European Commission, additional contractual or technical safeguards, or another transfer mechanism permitted under applicable data-protection law.
You may contact WPBay for further information about safeguards applicable to relevant international transfers.
23. How Long We Keep Personal Data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and for any additional period required by law.
Account information is generally retained while the account remains active and for a reasonable period afterward where necessary for security, dispute resolution, fraud prevention or legal claims.
Transaction, invoice, payment, seller-payout, VAT, tax and accounting information is retained for the statutory period required by applicable Romanian and EU legislation, which may extend for several years after the relevant transaction.
Information connected with legal claims, chargebacks, complaints, fraud investigations or regulatory matters may be retained until the applicable limitation period has expired or the matter has been finally resolved.
Security logs are retained for a period proportionate to security, fraud-prevention and troubleshooting needs.
Marketing information is retained until consent is withdrawn, the user unsubscribes, the information is no longer required or another lawful retention requirement applies.
Comments, reviews and other public marketplace content may be retained for as long as the related marketplace content remains available, subject to applicable rights and legal requirements.
Where information is no longer required, it will be deleted, anonymized or otherwise disposed of in accordance with applicable legal requirements and reasonable technical processes.
Backups may continue to contain deleted information for a limited period until the relevant backup is automatically overwritten or securely deleted.
24. Your Data Protection Rights
Where the GDPR applies, you may have the right to obtain confirmation as to whether WPBay processes personal data relating to you and to obtain access to that information.
You may have the right to request correction of inaccurate or incomplete personal data.
You may have the right to request deletion of personal data where the conditions of Article 17 GDPR are met.
You may have the right to request restriction of processing in circumstances provided by Article 18 GDPR.
Where processing is based on consent, you may withdraw your consent at any time.
Where processing is based on legitimate interests, you may object to that processing in accordance with Article 21 GDPR.
You have the right to object at any time to processing of personal data for direct-marketing purposes.
Where the legal requirements are met, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format and to transmit that information to another controller.
These rights are not absolute. WPBay may retain or continue processing information where necessary to comply with legal obligations, establish or defend legal claims, prevent fraud, protect the rights of others or where another lawful exception applies.
We may request reasonable information necessary to verify your identity before completing a privacy request.
We normally respond to valid GDPR requests within one month. Where permitted by law, that period may be extended where a request is particularly complex or numerous. We will inform you if an extension is necessary.
Requests may be sent to [email protected].
25. Complaints to a Data Protection Authority
You have the right to lodge a complaint with a competent data-protection supervisory authority.
WPBay’s lead Romanian supervisory authority is:
Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
28-30 Gheorghe Magheru Boulevard
District 1
010336 Bucharest
Romania
You may also have the right to complain to the supervisory authority in the EU or EEA country where you habitually reside, work or where the alleged infringement occurred.
We encourage users to contact WPBay first so that we can attempt to resolve privacy concerns directly, but contacting us first is not a condition for exercising your right to complain to a supervisory authority.
26. Automated Processing and Fraud Decisions
WPBay may use automated tools and risk indicators to detect payment fraud, account abuse, malicious activity, suspicious transactions, spam or security threats.
Automated systems may flag, temporarily delay or block certain activity where necessary to protect WPBay and its users.
Where a decision falls within Article 22 GDPR because it is based solely on automated processing and produces legal or similarly significant effects, WPBay will provide the safeguards required by applicable law, which may include the right to request human intervention, express your point of view and contest the decision.
27. Personal Data Relating to Children
WPBay is a professional software marketplace and is not intended to be used by children to enter into commercial transactions.
Persons creating seller accounts or entering into legally binding commercial relationships with WPBay must have the legal capacity required to do so.
We do not knowingly solicit personal data from children where such processing would be unlawful.
If you believe a child has provided personal data to WPBay unlawfully, contact [email protected] so the matter can be investigated.
28. Special Categories of Personal Data
WPBay does not normally require information concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic information, biometric information used for identification, health information or information concerning a person’s sex life or sexual orientation.
Users should not provide such information unless it is genuinely necessary and there is a lawful basis for doing so.
29. Data Security
WPBay uses reasonable technical and organizational measures intended to protect personal data against unauthorized access, disclosure, alteration, accidental loss, destruction and other unlawful processing.
Measures may include access controls, authentication mechanisms, encryption where appropriate, security monitoring, backups, software updates, network protections and restrictions on employee or contractor access.
No internet service or storage system can guarantee absolute security. Users are responsible for protecting their own account credentials and should notify WPBay promptly if they suspect unauthorized access to their account.
30. Personal Data Breaches
Where WPBay becomes aware of a personal-data breach, we will investigate the incident and take appropriate remedial measures.
Where required by Articles 33 and 34 GDPR, WPBay will notify the competent supervisory authority and, where applicable, affected individuals within the periods required by law.
31. Business Customers, Companies and Seller Representatives
Where an account belongs to a company or other organization, WPBay may process personal data relating to the organization’s directors, employees, contractors or authorized representatives.
Such information may be processed to administer the organization’s WPBay account, verify authority, manage transactions, communicate with the organization and comply with legal requirements.
Where the contract is with the organization rather than directly with the individual, processing of representative information may be based on WPBay’s legitimate interest in administering its commercial relationship with that organization.
32. Third-Party Websites and Embedded Content
WPBay may contain links to external websites or embedded content such as videos, images, documentation or social-media content.
External services may collect information about you independently, including through cookies or other tracking technologies.
WPBay does not control the privacy practices of independent third-party websites. Their processing is governed by their own privacy policies.
Where embedding third-party content involves non-essential tracking requiring consent, WPBay will seek to apply the consent requirements applicable to that technology.
33. Changes to This Privacy Policy
We may update this Privacy Policy when WPBay’s services, technology, providers, legal obligations or data-processing practices change.
The current version will display its effective or last-updated date.
Where a change materially affects how personal data is processed or where applicable law requires additional notice or consent, WPBay will take reasonable steps to provide such notice or obtain consent as required.
34. Contact
Questions, requests or complaints concerning privacy or the processing of personal data may be sent to:
CODE IKIGAI SRL / WPBay
Bistritei Street 27-29-31
Staircase 4, Floor 1, Apartment 31
400430 Cluj-Napoca
Cluj, Romania
Email: [email protected]