Privacy notice

The company named in our imprint is the data controller for the personal data described here. For anything in this notice, or to exercise the rights in section 07, write to contact@gmtone.com.

When you create an account: your name, email address and mobile number, and a hash of your password — we never store the password itself. The mobile number is how we reach you about your own listings and offers; it is not published, not shown to other members, and not used for marketing. If you sign in with Google or Apple, we receive your name and email address from them instead, and you are not asked for a number.

If you fill in your profile: a picture, a short description and a location, all optional. Unlike the number above, these are the parts of your profile meant to be seen — they appear alongside the watches you list.

When you sell: the listing you write, the photographs you upload, and your city and country. All of this is published, deliberately — that is what a listing is.

When you buy: the offers and questions you send, their amounts and messages, and the email address and any phone number you give so the seller can reply. These are shown to the seller of that listing.

When you use the AI tools: the reference or question you type. Your concierge conversation is kept on your own device, not on our servers, and only if you allowed preference storage in the cookie banner.

Automatically: your IP address and standard request information, which our host processes to deliver and protect the site. We do not run analytics or advertising trackers; see the cookie policy for everything stored on your device.

To run your account and the marketplace — creating your account, publishing your listings, carrying offers and questions between you and the other party, and keeping you signed in. This is necessary to perform our contract with you (Article 6(1)(b) GDPR).

To take payment for listing fees and dealer subscriptions, also on the contract basis, and to keep the accounting records the law requires of us (Article 6(1)(c)).

To keep the marketplace safe and honest — checking seller identity, reviewing dealers, investigating reports, preventing fraud and abuse. This rests on our legitimate interest in a marketplace people can trust (Article 6(1)(f)), balanced against your interest in not being over-monitored: we look at accounts and listings when there is a reason to, not routinely.

To remember your preferences — the light or dark theme, your concierge history — only where you have consented (Article 6(1)(a)). You can withdraw that at any time from cookie settings, and withdrawing it costs you nothing else.

Other users. Your listing, its photographs and your city are public. When you make an offer or ask a question, the seller of that listing sees your message and the contact details you gave — that is the point of sending it. Your email address is not otherwise shown to anyone.

Our processors, listed below. Each acts on our instructions under a data-processing agreement and may not use your data for their own purposes. We do not sell personal data, and we do not share it with advertisers.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

Some processors above operate in the United States. Where data reaches them, the transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the Commission’s Standard Contractual Clauses together with additional safeguards. You can ask us for a copy of the mechanism that applies to a particular provider.

Your account for as long as it exists. Delete it and we delete the account and its personal details.

Listings stay while they are live. A removed or sold listing is kept for 12 months so both sides have a record of what was agreed, then deleted.

Offers and questions for 12 months after the last activity on them, for the same reason.

Payment and accounting records for 10 years, because Luxembourg commercial law requires it. This is the one category we cannot delete on request.

Password reset tokens expire within an hour and are deleted once used.

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent you can withdraw it at any time without affecting what we did before you did.

Write to contact@gmtone.com. We answer within one month. We may ask you to confirm who you are first, so that we do not hand your data to somebody else.

If you are not satisfied, you can complain to the Luxembourg supervisory authority, the Commission nationale pour la protection des données, or to the authority where you live.

Our AI tools draft listing details and suggest prices. They advise; they do not decide anything about you. No account is approved, refused, suspended or priced by an automated decision without a person involved, so there is no solely automated decision-making with legal or similarly significant effects.

What you type into the concierge or the listing assistant is sent to our AI provider to produce the answer. Do not put anything into those boxes you would not want processed that way.

If we change this notice we will update it here and, where the change matters to you, say so on the site. The date of the current version is shown at the foot of this page once counsel has approved the wording.