Banknotes exchanges.
You send 5 banknotes
to a random member
and you receive 5 back!
Effective Date: August 22, 2026
This Privacy Policy applies to the collection exchange websites operated by NODE HUB S.R.L. that display or link to it (together, the "Club Network" and individually a "Club Website"). It covers the Club Websites listed in the Terms and Conditions, including their official language subdomains.
The Club Network includes websites for exchanging postcards, stamps, coins, banknotes, trading cards, stickers and other collectible items. The same general Privacy Policy is used across the network, while the data associated with an account or exchange remains identified with the Club Website on which it was created.
The controller responsible for the processing described in this Policy is NODE HUB S.R.L., with its registered office at 33 Nae Leonard Street, Apartment 2, Galați, Galați County, Romania, registered with the Romanian Trade Register under no. J2026038669006, tax identification number (CUI) 54895290 (the "Controller" or "Operator").
Questions, privacy requests and complaints may be submitted through the Contact page on the Club Website you are using or by email to the administrative address for that domain (for example, admin@postelo.club when using postelo.club). No data protection officer has been appointed because the Controller does not currently consider that the legal conditions requiring one are met.
Club Websites use a common application and some common infrastructure, but accounts, exchange records and settings may be stored separately for each club. Some security, anti-abuse, supporter-administration and legal-document records are managed in shared infrastructure and include a club identifier so the relevant context can be determined.
Creating an account on one Club Website does not necessarily create an account on another Club Website. Data is not used to merge public profiles across clubs unless a feature clearly says so or you request it.
This may include username, password authentication data, email address, country, registration date, account status, language and account preferences. Passwords should be stored in protected form rather than as readable text.
To participate in physical exchanges, you may provide a recipient name and complete postal address, including street, number, postal code, city, region and country. Depending on the postal destination, you may also provide formatting instructions needed for delivery.
Your profile may include username, country, languages, description, avatar, collecting interests, preferred themes, registration date, recent activity and statistics. Fields presented as public may be visible to members, visitors and search engines.
This may include assigned members, origin and destination countries, exchange IDs, item type or theme, request, sending, receipt and expiry dates, exchange status, ratings, comments, uploaded images and records of sent, received, active or expired exchanges.
This may include private messages, discussion posts, support and contact messages, reports, evidence supplied in a dispute, moderation notes, warnings, restrictions and records needed to investigate abuse or enforce the Terms.
This may include IP address, browser and device information, user agent, session identifiers, request dates and times, login and security events, error information, spam indicators and other technical logs needed to operate and protect the websites.
When you accept the Terms or acknowledge a Privacy Policy version, the Club Network may record the club, member identifier, document type and version, acceptance date and time, language, content hash, IP address, browser user agent and acceptance source, such as registration or a legal-update notice.
If you make a donation or supporter payment, the operator may receive and store transaction identifiers, amount, currency, payment status, payer information supplied by the payment provider and the period or benefit associated with the payment. Full payment-card details are not intended to be collected by the Club Websites when payment is handled by an external provider.
Cookies, session storage, local storage and third-party technologies may process identifiers and information about use of the website. Details are provided in the Cookie Policy.
Most data is obtained directly from you. Some data is generated through use of the service, received from another member involved in an exchange or report, or received from a service provider such as a payment processor. Technical data is generated automatically when your browser communicates with the website and enabled third-party services.
When processing is based on legitimate interests, the operator considers the necessity of the processing, the reasonable expectations of members and the effect on their rights. You may object as described in Section 12.
Fields marked as required are needed to create an account, secure it or provide a requested exchange. Without required account data, an account cannot be created or maintained. Without a valid postal address, you cannot receive physical items and may not be able to participate in exchanges.
Profile descriptions, avatars, interests, optional communications and most User Content are voluntary. The interface should indicate when a field will be public before you submit it.
Your recipient name and postal address are disclosed to the member assigned to send you an item. This disclosure is essential to the physical exchange you request. The sender is instructed by the Terms to use those details only for that exchange and not to publish, sell, retain for unrelated purposes or reuse them.
An assigned member may live outside the European Economic Area. Therefore, when you request an international exchange, your postal details may be viewed in the recipient member's country. This member-to-member disclosure is initiated as part of the exchange you request and is distinct from the operator appointing a service provider abroad. You may use club options that limit exchanges geographically where those options are available.
Your email address and password are not disclosed to exchange partners.
Public profile and exchange pages may show usernames, countries, languages, avatars, descriptions, dates, statistics, ratings, comments and uploaded collectible images. Public pages may be indexed, cached or copied by search engines and third parties. Removal from the Club Website does not guarantee immediate removal from third-party caches.
Do not place your postal address, email address, telephone number, identification documents or another person's private information in public fields or images. Images may contain visible writing or embedded metadata; review them before upload.
Personal data may be available, only as necessary, to:
The operator does not sell members' personal data.
The main website infrastructure is intended to be hosted in the European Union. Some service providers or their support operations may process data outside the European Economic Area. Where the operator makes such a transfer, an adequacy decision, approved contractual safeguards or another lawful transfer mechanism will be used as required. Information about relevant safeguards may be requested through the Contact page.
Separately, postal-address disclosure to an assigned member outside the European Economic Area is explained in Section 7.
Personal data is retained only for as long as reasonably needed for the purpose for which it was collected, including the following criteria:
When no fixed period is stated, retention is determined using the account's status, unresolved exchanges, legal duties, security needs, the sensitivity of the data and applicable limitation periods. Data that is no longer necessary is deleted or anonymized.
Subject to the conditions and exceptions in applicable law, you may have the right to:
Requests may be submitted through the Contact page. The operator may ask for information reasonably necessary to verify your identity and protect the account. A response will normally be provided within one month, subject to any lawful extension for complex or numerous requests.
In Romania, the supervisory authority is the National Supervisory Authority for Personal Data Processing (ANSPDCP), whose current contact and complaint information is available at www.dataprotection.ro. You may instead contact the supervisory authority in the EU or EEA country of your habitual residence, place of work or the alleged infringement where applicable.
Withdrawal of consent does not affect processing already carried out lawfully. Erasure is not absolute: limited records may be retained where required by law, needed for legal claims, necessary to protect other members or retained in anonymized form.
You may request account deletion through the Contact page or any account-deletion function made available. Before deletion, active exchanges, unresolved reports, payment records and legal obligations may need to be addressed.
On deletion, direct profile and current address data will be deleted or anonymized where reasonably possible. Public posts, comments, ratings or exchange records may be anonymized rather than removed when retention is necessary to preserve conversations, exchange history, statistics or the rights of other members.
The service uses automated rules to assign exchange partners and calculate limits or statistics. These operational rules do not make decisions producing legal or similarly significant effects. The operator does not currently use solely automated decision-making of the kind described in Article 22 GDPR.
The operator uses reasonable technical and organizational measures intended to protect personal data, including HTTPS, access controls, authentication protections, backups and security logging where appropriate. No online system or postal disclosure can be guaranteed completely secure.
You are responsible for using a strong, unique password, protecting your email account and promptly reporting suspected unauthorized access. Once a postal address has been provided to an assigned sender, the operator cannot technically prevent that person from copying it, although unrelated use is prohibited by the Terms.
The Club Network is not directed to children under 16. A person under 18 should use it only with the permission and supervision of a parent or legal guardian, particularly because physical exchanges involve disclosure of a postal address to another member. If you believe a child has supplied personal data without appropriate involvement of a parent or guardian, contact the operator so the circumstances can be reviewed.
The Cookie Policy describes necessary sessions and optional analytics, advertising, social-media, font or embedded-content services that may be enabled on a Club Website. Non-essential technologies must be managed in accordance with applicable consent requirements. Browser blocking alone is not treated as a substitute for prior consent where prior consent is legally required.
This Policy may be updated to reflect changes in law, providers, security practices or Club Network features. The effective date and version will be recorded. Material changes will be communicated through the website or another appropriate channel. Where required, members will be asked to review or acknowledge a new version before continuing to use affected features.
August 2, 2026 – Privacy Policy prepared for Postelo and themed postcard exchanges.
August 22, 2026 – Replaced the club-specific policy with a general Club Network policy; identified NODE HUB S.R.L. as the Controller; added legal bases, shared-infrastructure explanation, member-to-member address disclosure, international transfers, retention criteria, moderation data and expanded data-subject rights.