Skip to content
Log inStart free

EU Digital Services Act (DSA) Compliance Policy

Effective
Updated
Version
1.3
On this page

Applicable law: Regulation (EU) 2022/2065 (Digital Services Act)

This policy sets out how Tanqory complies with the EU Digital Services Act (DSA). It is written in clear, internationally aligned language for merchants, developers, end users, regulators, and trusted flaggers. It explains platform classification, points of contact, notice-and-action, statements of reasons, internal complaint handling, out-of-court dispute resolution, KYBC, advertising transparency, recommender systems, child protection, transparency reporting, and additional measures if Tanqory is ever designated as a Very Large Online Platform (VLOP).

Authoritative references:

1) Purpose and scope

This policy describes DSA compliance for services directed to recipients in the EU/EEA: web, mobile apps, store-builder tools, APIs/SDKs/webhooks, merchant dashboards, and related hosting. It applies to merchants, developers, partners, general users, and government authorities acting under the DSA. It is a DSA-specific layer that works alongside our Terms of Service, Acceptable Use Policy, Privacy Policy, Data Processing Addendum, Ads/Recommender Disclosures, and other regional annexes. Material changes will be announced in advance with effective dates.

2) Platform classification and applicability (Articles 3–4, 33)

Tanqory is an online platform (hosting service that disseminates information to the public) under Articles 11–32. As of this publication we are not a VLOP because the average monthly active recipients of the service in the EU are below 45 million. We comply with Titles II and III. If user numbers exceed the VLOP threshold and the European Commission designates Tanqory, we will implement Title IV obligations without delay and publish updated statements, including user-number methodology aligned with Article 33 and Recital 77.

3) Points of contact and EU representative (Articles 11–13)

4) Orders and cooperation with authorities (Articles 9–10)

  • Orders to act against illegal content or provide information: We verify authenticity, scope, legal basis, issuing authority, territorial reach, and proportionality. We act “promptly” and inform the issuing authority of actions taken. Data disclosures follow GDPR/PDPA safeguards and are logged.
  • Reason-giving and user notification: Unless legally prohibited, we inform affected users and provide a Statement of Reasons (SoR) consistent with Article 17.
  • Preservation: Content and logs may be preserved to comply with lawful requests, subject to minimization and retention limits.

5) Terms of Service transparency (Article 14)

Our Terms of Service (ToS) clearly explain: prohibited content/goods, ranking principles, grounds for restriction/removal, appeal routes, recommender logic, advertising transparency, and links to Notice/Complaint/SoR forms. Material changes are announced ≥30 days in advance via email and in-product notice, with the right to terminate if not accepted. ToS and key notices are provided in English; additional EU languages are added proportionately to the user base (Article 14(3)). Versioning is retained for audit.

6) Notice-and-action for illegal content (Article 16)

  • Channels: https://legal.tanqory.com/dsa/report or report@tanqory.com (supports major EU languages).
  • Required elements: URL/Content ID, description, legal basis (if known), evidence, good-faith declaration, and contact for follow-up.
  • Prioritization: CSAM/terrorism: response within 1 hour; unsafe/counterfeit within 48 hours; standard cases targeted within 14 days.
  • Abuse controls: We monitor misuse patterns; repeated bad-faith notices may be limited/suspended per Article 23. Metrics are reported in transparency reports.
  • Record-keeping: Each notice is logged (time, source, content ID, action, rationale, automation/human mix).
  • Feedback: Notifiers receive confirmation and updates on outcomes where legally permissible, including the main reasoning and available appeal routes.
  • Takedown scope: We tailor actions to be proportionate (e.g., item-level removal before store-level suspension) and document why broader measures are necessary when applied.

7) Statement of Reasons (Article 17)

When we remove or restrict content/accounts or reduce visibility, we send an SoR that states: action taken, timestamp, policy/legal basis breached, source of notice (user/trusted flagger/state), impact on visibility/ranking, and appeal channels under Articles 20–21. We avoid boilerplate and tailor SoRs to the decision. If notice is legally prohibited (e.g., CSAM, sealed court order), we comply with those limits.

8) Internal complaint-handling and out-of-court settlement (Articles 20–21)

  • Internal complaints: Submit via https://legal.tanqory.com/dsa/complaint or dsa-complaints@tanqory.com. Target response: within 30 calendar days; never beyond 6 months.
  • Escalation: If unsatisfied, users may refer to a certified out-of-court dispute settlement body (e.g., EU ODR). We provide relevant files within 15 days and act in good faith on outcomes.
  • Accessibility: Forms are designed for clarity, available in English and additional EU languages as demand requires, and avoid dark patterns.

9) Trusted flaggers and misuse of notices (Articles 22–23)

  • Notices from DSC-designated trusted flaggers are prioritized with expedited queues; performance is reported in transparency reports.
  • If a notifier abuses the system (e.g., repeated manifestly unfounded notices), we may suspend their ability to submit under Article 23 after assessment and, where applicable, inform the relevant DSC.

10) Suspension policies (Article 24)

We may suspend users who frequently provide illegal content or submit manifestly unfounded complaints/notices, following documented thresholds, proportionality checks, and SoR communication. Reinstatement channels are provided, and suspensions are logged for reporting.

11) Fair design and prohibition of dark patterns (Article 25)

We design UX to be fair and transparent: easy sign-up and cancellation, clear language, no misleading defaults, upfront pricing/fees/VAT, and no confirm-shaming, hidden fees, forced continuity, or bait-and-switch. Marketing/cookie consents are opt-in where required and as easy to withdraw as to give. We maintain easy-to-find “cancel/opt-out” controls.

12) Advertising transparency (Article 26; Article 39 for VLOP)

  • Ads/paid placements are labelled “Ad” or “Promoted,” showing the advertiser and main targeting parameters.
  • No behavioural targeting/retargeting of children; default limits on profiling for general users.
  • If ever a VLOP, we will maintain a public, machine-readable Ad Repository with advertiser identity, targeting parameters, duration, and impressions retained for at least one year, fully aligned with Article 39 and implementing regulations.
  • Influencer/affiliate content is required to be clearly marked as advertising.

13) Recommender systems and ranking (Article 27)

We describe recommender logic in plain language. Primary factors include keyword match, quality/reviews, recent sales, seller reliability, and delivery speed. Users can choose non-profiling options (e.g., price low→high, price high→low, newest, top rated). We do not default to demographic or personal browsing-history profiling. Details and examples are published at https://legal.tanqory.com/dsa/recommender-systems, including how to switch modes and adjust signals.

14) Protection of minors (Article 28)

  • No profiling-based ads to minors; 18+ content/products are hidden from identified minors.
  • Minimum ages: buyers 13+; sellers 18+. Identity/age checks apply where risk or law requires.
  • child-safety@tanqory.com is monitored with a 1-hour SLA for CSAM; emergency form available in Help Center.
  • Measures include limiting contact from strangers, filtering inappropriate content, periodic risk assessments for child safety, and safer defaults for minors.
  • Age assurance is proportionate to risk (e.g., payment age checks, document verification for sellers, targeted prompts for sensitive categories).
  • Guardians can request deletion or restriction of a minor’s account where applicable; requests follow GDPR/PDPA safeguards.

15) Know Your Business Customer (KYBC) for traders (Article 30)

Before selling, traders must complete KYBC: legal name, address, email, phone, tax/registration number, corporate documents, and a bank account in the trader’s name. eIDAS or reputable ID providers may be used. Non-completion or failure results in suspension of selling. Traders must keep details current. Buyer-visible KYBC disclosures are limited to necessary business information; personal tax IDs and sensitive payment data are not exposed. KYBC records are retained securely and updated periodically.

16) Compliance by design, security, and auditability

  • Reporting buttons on every listing; SoR automation with human oversight; default non-profiling for minors; clear ad labels; KYBC displayed on trader profiles; moderation decisions logged with audit trails.
  • AI-assisted detection for prohibited items is supplemented by human review for high-risk categories.
  • Security-by-design: encryption in transit/at rest, strict access controls, logging, and change management to protect DSA processes and evidence.
  • Crisis response playbooks cover emergency orders and high-severity takedowns.

17) Transparency reporting (Articles 15 & 24)

We publish at least annual transparency reports (target: by 28 February) covering:

  • Government orders (Article 9) and information requests.
  • User notices (Article 16) and actions taken.
  • Use of automated tools vs. human review.
  • Voluntary removals.
  • Complaint outcomes (Article 20) and out-of-court cases (Article 21).
  • Account/content suspensions, trusted flagger performance, and misuse actions (Articles 22–24).
  • If designated VLOP: include Title IV metrics (risk assessments, mitigation, audit results, data access, ad repository metrics).
    Reports use the Commission’s prescribed templates and are posted to the DSA Transparency Database and https://legal.tanqory.com/transparency/dsa.
  • Metrics include turnaround times by category, reversal rates on appeal, proportion of SoRs delivered, language coverage of notices, and escalation volumes.
  • Where automated tools are used, we describe categories, limitations, error-handling, and the extent of human oversight, avoiding disclosure of security-sensitive details.
  • Historical reports are archived and versioned for at least five years to support regulatory review and longitudinal analysis.

18) Accessibility and language (Articles 11, 14, 20)

Notice, complaint, SoR, and appeal flows are designed to be clear and accessible. English is always available; additional EU languages are added proportionately to user numbers. We avoid captchas or steps that discriminate against users with disabilities and provide alternative contact options where feasible. Links are secured with TLS; unpublished links are not indexed.

19) Data governance and privacy interface (DSA + GDPR)

Content moderation and DSA processes are designed to align with GDPR. Personal data used for notice/complaint handling, KYBC, advertising, and recommender controls is minimized, access-controlled, and subject to retention limits. Data sharing for DSA purposes follows GDPR roles and safeguards. Privacy notices describe DSA-related processing, and DPIAs are conducted where high-risk profiling or automation is involved.

20) Record-keeping and evidence

We maintain traceable records of notices, SoRs, complaints, suspensions, KYBC verifications, ads/recommender disclosures, government orders, and automated tool usage. Logs record timestamps, actors, decisions, rationales, and applicable legal bases. Evidence is stored with integrity controls to support audits, transparency reporting, and regulator requests.

21) Training and governance

Moderation, onboarding, support, product, legal, and security teams receive DSA-specific training every 6–12 months, including child safety. Governance assigns accountable owners, conducts quarterly internal reviews, and performs at least annual external assessments. Policies are reviewed at least yearly or when guidance changes; material updates are communicated to users.

22) Interaction with other Tanqory terms

This policy supplements the Tanqory Privacy Policy, DPA, Cookie Policy, Ads/Marketing Disclosures, and service terms. In case of conflict, the stricter document or applicable law prevails. Product- or region-specific notices may add requirements for certain categories of goods, services, or users.

23) Cross-border services and jurisdiction

Services are operated globally. For DSA matters, EU law applies; for contractual terms with Tanqory Inc., Singapore law and SIAC arbitration apply, without limiting non-waivable statutory rights under the DSA or Member State consumer laws. EU recipients can still seek recourse through DSCs or the Commission (if VLOP).

24) Metrics and user-number methodology (Article 33)

If approaching the VLOP threshold, we will publish the methodology for “average monthly active recipients” consistent with Article 33 and Commission guidance, including: definitions of unique recipients, counting logic for web/app/API, bot/duplicate filtering, and EU geolocation methodology. Records supporting calculations will be available to DSCs/Commission.

  • Methodology will clarify inclusion/exclusion rules (e.g., logged-in vs. logged-out, crawlers/bots excluded, unique counts across devices/apps), and time-window logic.
  • Where sampling is used, statistical confidence intervals and error margins will be documented.
  • Results will be refreshed at least every six months, or more frequently if growth indicates proximity to VLOP thresholds.

25) Data access for vetted researchers (Article 40, VLOP)

If designated a VLOP, we will provide vetted researchers access to data necessary for research on systemic risks, subject to GDPR safeguards, confidentiality, and security controls (e.g., secure workspaces, minimization, auditable queries). Requests, approvals, denials, and datasets provided will be logged and reported.

26) Crisis response (Article 36, VLOP)

If the Commission activates the crisis response mechanism, we will implement the mandated measures, designate crisis coordinators, and follow communication playbooks with DSCs/Commission. Actions will be documented and later reported in the transparency report.

27) Systemic risk assessment and mitigation (Articles 34–35, Title IV)

If designated a VLOP, we will conduct annual systemic risk assessments covering illegal content, fundamental rights, civic discourse, electoral processes, public health/safety, and gender-based violence. Mitigations may include algorithmic adjustments, increased human review for high-risk areas, stricter verification, and improved user controls. Outcomes will be summarised publicly and shared with regulators.

28) Advertising repository and targeting (Article 39, VLOP)

If designated a VLOP, we will host a public ad repository (machine-readable) containing advertiser identity, targeting parameters, dissemination period, and impressions, retained for at least one year. Targeting excludes minors and sensitive-profile use; lawful bases and consent mechanisms follow GDPR and ePrivacy rules.

29) Independent audit and compliance function (Articles 37 & 41, VLOP)

If designated a VLOP, we will undergo annual independent audits; prepare audit implementation reports; publish summaries; and establish an independent compliance function reporting to senior management to oversee Title IV obligations.

30) Codes of conduct and interoperability (Articles 45–48)

We will participate in relevant codes of conduct and crisis protocols when available and appropriate for our services, and will document adherence or justified deviations as required by the DSA.

31) Technical and organizational safeguards

  • Security controls: Encryption in transit/at rest, RBAC/MFA, least privilege, logging, SIEM/SOC monitoring, WAF/IDS/IPS, vulnerability management, pen testing, secret management, and segregated environments.
  • Resilience: Backups, disaster recovery with regional failover where supported, tested playbooks.
  • Automation guardrails: Human-in-the-loop for high-risk moderation, versioning of models/rules, rollback plans, and bias/false-positive testing.
  • Data minimization: Collect only what is required for DSA processes (notice, complaint, KYBC, ads, recommender controls) with defined retention and destruction schedules.
  • Abuse prevention: Rate limits, fraud/threat detection, anti-spam signals, and verification steps where needed to protect reporting channels.

32) Retention and deletion

  • Notices, SoRs, complaints, orders, KYBC records, and suspension logs are retained only as long as necessary for DSA compliance, legal defence, and transparency reporting, then deleted or anonymized.
  • Backups follow rolling cycles; deletion from backups occurs on schedule.
  • Retention schedule: https://legal.tanqory.com/legal/data-protection/data-retention-policy (EU/DSA summaries available on request).
  • Deletion or anonymization events are logged; evidence can be provided under NDA to regulators or auditors.
  • Time-bound retention examples: SoRs/notice records retained to support transparency reporting cycles; KYBC retained for legal/accounting periods; appeal files retained through limitation periods for claims/defence.
  • Data subject rights under GDPR remain available (access/erasure/objection/restriction) subject to legal holds and DSA recordkeeping duties.

All listed URLs (contact/report/complaint/transparency/recommender) are maintained with valid TLS certificates. If any link is not yet public, access will be restricted to avoid indexation until launched. Status checks ensure HTTP 200/302 responses and correct routing. Internal case-management tooling for DSA workflows preserves SLA and auditability; the specific tooling is identified in the subprocessor list where it processes personal data of complainants or notice submitters.

34) Alignment with product and content policies

Platform rules for prohibited content/goods (e.g., counterfeit, unsafe products, fraud, CSAM, hate speech, illegal weapons, sanctions violations) are mapped to DSA categories and surfaced in merchant onboarding, listing flows, and enforcement SoRs. Enforcement actions are consistent across channels and documented to avoid arbitrary moderation.

35) User empowerment and controls

  • Clear controls to view/delete data where applicable (subject to GDPR), manage ads/recommender preferences, opt out of non-essential tracking, and appeal moderation decisions.
  • For minors, stricter defaults and easy guardian contact.
  • For sellers, dashboards surface KYBC status, policy violations, SoRs, and appeal links.

36) Measurement of automation vs. human review

We track the proportion of automated vs. human moderation for each category (illegal goods, safety, IP claims, spam) and disclose the main automation tools used (without exposing security-sensitive details). Human oversight applies to edge cases, escalations, and high-risk decisions.

  • Quality controls include periodic sampling, false-positive/false-negative tracking, bias testing, and rollback criteria.
  • Automation changes are versioned, reviewed, and tested before deployment, with safeguards for rapid disablement if harmful effects emerge.

37) Templates and forms

Standardized templates (Notice, SoR, Complaint, Appeal) are versioned and stored for traceability. They include required DSA elements, language support, and guidance for evidence submission. Screenshots and UX copy are archived to demonstrate compliance with openness and accessibility requirements.

38) Change management

Material updates to DSA processes (e.g., new recommender options, ad transparency formats, KYBC steps) undergo risk/impact review, are documented, and are communicated to users with effective dates. Backward compatibility or transition periods are provided where feasible.

39) Collaboration with regulators and industry

We cooperate with Digital Services Coordinators, the European Commission (if VLOP), trusted flaggers, and accredited dispute bodies. We participate in consultations and share non-confidential learnings to improve safety, transparency, and user empowerment across the ecosystem.

40) Updates to this policy

We review this policy at least annually and when DSA guidance or implementing acts change. Material changes will be communicated in advance (e.g., dashboard/email) with the new version/date and a summary. Users may stop using the services if they do not accept changes; statutory rights remain unaffected.

41) Enforcement, penalties, and cooperation

  • Member State Digital Services Coordinators (DSCs) enforce the DSA for Tanqory; the European Commission leads for VLOPs.
  • Serious infringements can lead to fines up to 6% of annual worldwide turnover; procedural failures up to 1%; and periodic penalty payments up to 5% of daily income for non-compliance with specific orders.
  • We cooperate with investigations, provide access to records, and respect due process, confidentiality, and privilege where applicable.
  • Appeals and judicial review rights under Member State law remain available; arbitration clauses do not limit statutory rights.

42) Consumer law and sectoral overlays

  • We align DSA enforcement with EU consumer protection, product safety, IP, and unfair commercial practices rules; takedown categories are mapped to these laws.
  • For regulated goods (e.g., medical devices, cosmetics, food supplements, electronics safety, geo-restricted items), additional documentation or certifications may be required from traders, and listings may be paused pending validation.
  • IP claims (e.g., trademark/copyright) follow tailored workflows to balance rights-holder evidence, counter-notices, and abuse prevention.

43) Testing, drills, and continuous improvement

  • Regular tabletop exercises cover CSAM/terrorism escalations, mass fraudulent listings, recommender malfunctions, and crisis-response activation.
  • Post-incident reviews capture root causes, remedial actions, and owner assignments; outcomes are tracked to closure.
  • User feedback from appeals/complaints is analyzed to refine policies, templates, and automation thresholds.

Appendix A: Key definitions (summary)

  • Illegal content: Content that is illegal under EU or Member State law (e.g., counterfeit goods, unsafe products, CSAM, terrorist content, hate speech, fraud).
  • Online platform: A hosting service that disseminates information to the public on request of a user.
  • VLOP: Platform with ≥45 million average monthly active recipients in the EU, designated by the Commission.
  • Trusted flagger: Entity certified by a DSC with priority notice handling.
  • KYBC: Know Your Business Customer verification under Article 30.

Appendix B: Illustrative SLAs (operational targets)

  • CSAM/terrorism emergency: acknowledge ≤1 hour; containment and authority notification per applicable law.
  • Unsafe/counterfeit/high-harm goods: initial action ≤48 hours where evidence is sufficient.
  • Standard illegal-content notices: decision targeted ≤14 days.
  • Internal complaints: resolution targeted ≤30 days (cap at 6 months per DSA).
  • SoR delivery: promptly after action; batch delivery avoided except where security/legal constraints apply.

Change history

Version Date Change
1.2 10 Dec 2025 Comprehensive English rewrite; expanded to cover Articles 9–48, VLOP contingencies, transparency reporting, contacts, accessibility, governance, and safeguards.
1.1 10 Dec 2025 Expanded Articles 11–32, updated contacts and SoR.
1.0 6 Dec 2025 Initial publication.

Published by Tanqory Inc., c/o Harvard Business Services, Inc., 16192 Coastal Highway, Lewes, DE 19958, USA

Questions about this document: legal@tanqory.com

All legal documents

We use cookies

Necessary cookies keep the site working. With your permission we also use analytics and marketing cookies. Change your choice any time in Cookie settings.