Effective Date: September 19, 2026
Last Updated: September 20, 2026
At FurniTalk (https://furnitalk.com), operated by XY INNOVATION CORPORATION, we respect your privacy and are committed to protecting personal data.
This GDPR & Data Protection Policy explains how we process personal data relating to individuals in the European Economic Area (EEA) and other individuals whose personal data is subject to the European Union's General Data Protection Regulation ("GDPR").
This policy should be read together with our Privacy Policy, Terms of Use, and, where applicable, our Cookie Policy.
For purposes of applicable data protection law, the entity responsible for determining how and why personal data is processed through FurniTalk may act as a data controller.
XY INNOVATION CORPORATIONIf a Data Protection Officer (DPO) or EU representative is required under applicable law and has been appointed, their contact details will be provided here.
This policy applies to personal data processed through FurniTalk where the GDPR applies, including where an organization outside the European Union offers goods or services to individuals in the EU or monitors their behaviour, subject to the requirements and territorial scope of the GDPR.
The GDPR may apply to organizations established outside the EU when they offer goods or services to individuals in the EU or monitor their behaviour.
"Personal data" means information relating to an identified or identifiable natural person.
Depending on how you use FurniTalk, personal data may include:
Some information may constitute a special category of personal data under Article 9 GDPR. FurniTalk does not intentionally request sensitive personal information through ordinary review submissions and asks users not to include such information in public reviews unless there is a lawful and necessary reason to do so.
We may process information contained in communications you send to us, including support requests, privacy requests, complaints, reports, and other correspondence.
We may collect personal data when you:
We may also receive information from service providers, authentication providers, security and fraud-prevention services, business partners, or publicly available sources where permitted by applicable law.
We may process personal data for purposes including:
Where GDPR applies, we process personal data only where we have an applicable legal basis under Article 6 GDPR.
We may process personal data based on your consent, for example when you voluntarily subscribe to certain marketing communications or consent to non-essential cookies.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
We may process information where necessary to provide Services you request, establish or maintain your account, or perform obligations under an agreement with you.
We may process personal data where necessary to comply with applicable laws, regulations, court orders, or other legal obligations.
We may process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your fundamental rights and freedoms.
Examples may include platform security, fraud prevention, abuse detection, service improvement, customer support, and protecting the integrity of reviews.
Where applicable and permitted by law, we may process information where necessary to protect vital interests or perform a task carried out in the public interest.
FurniTalk is a public review platform. When you intentionally publish a review, rating, comment, photograph, or other public content, that information may be visible to businesses, other users, search engines, and members of the public.
Publicly available User Content may be copied, indexed, cached, or redistributed by third parties outside our control.
You should therefore avoid including sensitive personal information, financial information, passwords, government identification numbers, private contact information, or confidential information in public reviews.
FurniTalk may process personal and technical information to protect the integrity of its review platform.
This may include detecting or investigating:
Where appropriate, we may use automated tools and human review to identify potentially fraudulent or abusive activity.
We may use third-party service providers to process personal data on our behalf. Depending on the Services we operate, these providers may include:
Where a third party acts as our processor, we require appropriate contractual and technical safeguards consistent with applicable data protection requirements.
We do not represent that every third-party provider is itself "GDPR certified." Instead, we assess applicable contractual, organizational, and technical safeguards appropriate to the processing relationship.
FurniTalk and its service providers may process personal data outside the European Economic Area, including in countries that may not provide the same level of data protection as your home jurisdiction.
Where GDPR applies, we will use an appropriate transfer mechanism where required, which may include:
The European Commission recognizes adequacy decisions and Standard Contractual Clauses among the mechanisms that can provide safeguards for transfers of personal data outside the EEA.
The specific mechanism used for a particular transfer will depend on the destination, recipient, processing activity, and applicable law.
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services, maintaining accounts, protecting the platform, resolving disputes, enforcing agreements, and complying with legal obligations.
Different categories of information may have different retention periods.
Public reviews may remain available after an account is closed where necessary for the legitimate operation and integrity of the review platform, subject to applicable law and any rights you may have to request deletion or restriction.
When personal data is no longer required, we may delete, anonymize, or securely dispose of it.
Subject to the conditions and exceptions provided by applicable law, you may have the following rights:
You may request confirmation of whether we process your personal data and request access to relevant information about that processing.
You may request correction of inaccurate or incomplete personal data.
You may request deletion of your personal data in circumstances provided by GDPR.
This right is not absolute. Certain information may need to be retained where a legal obligation or another lawful basis applies.
You may request that we restrict processing in circumstances provided by GDPR.
Where the GDPR portability requirements apply, you may request certain personal data in a structured, commonly used, and machine-readable format and, where technically feasible, request that it be transmitted to another controller.
You may have the right to object to processing based on legitimate interests or to certain forms of direct marketing.
Where processing is based on consent, you may withdraw your consent at any time.
Where applicable, you may have rights concerning solely automated decision-making, including profiling, that produces legal or similarly significant effects.
To submit a GDPR-related request, contact us at:
To protect users against unauthorized access, we may take reasonable steps to verify your identity before processing certain requests.
We will respond to valid requests within the time period required by applicable law. Where permitted, we may extend the response period when a request is particularly complex or numerous and will provide the required notice.
We generally do not charge a fee for exercising GDPR rights. However, where permitted by law, we may charge a reasonable fee or refuse to act where requests are manifestly unfounded or excessive.
If you believe that our processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.
You may generally contact the data protection supervisory authority in the country where you live, work, or where you believe the alleged infringement occurred.
We encourage you to contact us first at [email protected] so that we can try to resolve your concern directly, although you are not required to contact us before exercising your right to complain to a supervisory authority.
We seek to implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, accidental loss, destruction, alteration, disclosure, or other unlawful processing.
Depending on the nature and risk of the processing, safeguards may include:
No method of transmission or electronic storage is completely secure. Therefore, we cannot guarantee absolute security.
If a personal data breach occurs, we will assess the incident and take appropriate steps in accordance with applicable law.
Where GDPR requires notification to a supervisory authority, the applicable notification will generally be made without undue delay and, where feasible, within 72 hours after becoming aware of the breach.
Where required by GDPR, we may also notify affected individuals without undue delay.
FurniTalk may use cookies, pixels, local storage, software development kits, and similar technologies.
These technologies may be used for purposes such as:
Where required by GDPR or applicable national law, we will request consent before placing or using non-essential cookies and similar technologies.
You can manage certain cookie preferences through our cookie consent tools or your browser settings.
For more information, please see our Cookie Policy.
We may send service-related communications where necessary to operate your account or provide the Services.
Where required, we will obtain consent before sending electronic direct marketing communications.
You can unsubscribe from marketing emails at any time by using the unsubscribe mechanism provided in the relevant communication or by contacting us.
FurniTalk is not intended to knowingly collect personal data from children in circumstances where such collection is prohibited by applicable law.
Where consent is required for processing a child's personal data, FurniTalk will seek the appropriate authorization in accordance with applicable law.
If you believe that a child has provided personal data to us in circumstances where we should not have collected it, please contact us at [email protected].
GDPR does not require every organization to appoint a Data Protection Officer. A DPO is required only in circumstances specified by the GDPR, including certain large-scale monitoring activities or large-scale processing of special categories of personal data.
If FurniTalk is required to appoint a DPO or an EU representative under applicable GDPR requirements, the relevant contact information will be published on this page and/or otherwise made available to affected individuals.
FurniTalk may use automated systems for purposes such as security, fraud detection, spam prevention, content moderation, and service analytics.
Where automated processing constitutes solely automated decision-making that produces legal or similarly significant effects, we will comply with applicable GDPR requirements, including providing applicable information and safeguards.
We may update this GDPR & Data Protection Policy from time to time to reflect changes in our Services, technology, business practices, or applicable law.
When we make changes, we will update the "Last Updated" date displayed at the beginning of this policy.
Where required by law, we will provide additional notice or obtain consent before implementing material changes.
For questions, requests, complaints, or other matters relating to GDPR or the protection of your personal data, please contact:
XY INNOVATION CORPORATION