Marketplace guides
Two tracks: what you have to meet, and how to build it so meeting it stays possible
From a business decision to evidence of execution
A knowledge base for small and mid-sized platforms selling goods to consumers in the EU. Operator obligations, plus the architectural decisions behind them.
Marketplace operator obligations
What you have to meet in order to run a marketplace legally in the EU
GPSR, EPR, consumer law, GDPR, DSA, P2B, DAC7 and accessibility. Decision rules, the split of responsibility and a checklist before launch.
Scope:EUobligation from EU law, implementation details can be nationalPLPolish registers, thresholds or deadlines
Before you start5
Important Disclaimer Regarding the Nature of the Material
Informational and educational material, an author interpretation of the rules as of the stated date. It is not legal advice or a legal opinion.
00How to use the guide
What the owner of a small or mid-sized marketplace has to decide, build, show to users and archive. Selling goods to consumers in the EU.
01First choose the business and responsibility model, then build the marketplace
The usual mistake is starting with the catalogue and payments before deciding who sells, takes the money, packs the parcel and handles the complaint.
02Construction plan: what must exist and when
What must exist before the first seller, what before the first sale, and what only once you grow. An implementation order rather than a wish list.
03EUResponsibility Matrix: Operator, Seller, and Suppliers
Who answers for seller identity, product documents, payment and complaints. Operator, seller and external provider in a single table.
Sellers and products5
Seller Onboarding: Whom to Allow to Sell
Onboarding cannot be a single „business or private person” question. It sets the roles that consumer law, GPSR, EPR, VAT, DAC7 and payouts depend on.
05EUProduct card: information without which an offer cannot be published
The product card is where pre-contractual, GPSR and DSA duties are met. A missing mandatory element blocks publication rather than warning about it.
06EUGPSR: Product Safety in Practice
GPSR applies from 13 December 2024. Who the responsible operator is, what data must sit next to the offer, and when an offer cannot go live at all.
07EUProduct Category Gates
GPSR does not replace sector rules. For each category the operator approves the list of required information and evidence before opening it to sellers.
08PLPackaging and EPR: who is actually responsible
EPR duties do not apply automatically to everyone who sells. They follow specific roles and product groups, usually whoever packs and first places goods.
Selling and money3
Consumer Law: Sale, Withdrawal, and Complaint
What the buyer must see before purchase, how the withdrawal period is counted, and who handles the complaint when the seller is not the operator.
10EUPrices, Promotions, Ranking, Advertising, and Reviews
The 30-day lowest price on every reduction, disclosed ranking criteria, labelled ads and verified reviews. Four duties landing on one screen.
11EUPayments, Payouts, VAT, and Sales Documents
Why a small marketplace needs a provider with a marketplace product: split payments, payout schedule, refunds, chargebacks and reconciliation.
Data and compliance7
GDPR without myths: what to record, where, and on what basis
Accepting the terms is not GDPR consent. Account, order, payment and security each rest on their own legal basis, not on one shared tick box.
13EUDSA: reporting, moderation, and seller traceability
A marketplace is usually a hosting service and an online platform. Being exempt by size does not mean having no DSA obligations at all.
14EUP2B: fair rules for business users
P2B protects business sellers against the operator: disclosed ranking criteria, a statement of reasons for suspension, and notice periods.
15EUDAC7: seller data and annual reporting
DAC7 is not a tax charged by the platform. It is due diligence, collection and verification of seller data, and annual reporting by the operator.
16EUE-commerce accessibility from June 28, 2025
The accessibility act covers e-commerce services. A micro-enterprise is exempt, a small or mid-sized operator is not. Where the line actually runs.
17PLCybersecurity and NIS2
A marketplace holds seller identity data, customer addresses and compliance documents. Account takeover here is an incident, not just an IT problem.
18EURetention: How long to store data and evidence
There is no single „GDPR means five years” period. Each data group has its own purpose, legal basis and longest applicable retention period.
Launch and running it6
Post-launch operations: calendar and owners
What to check daily, what monthly and what once a year, and who on the operator side owns each of those processes.
20Four business models - specific decisions
Four marketplace variants and the concrete consequences of each. Recommended start: sellers from the EU, no operator fulfilment.
21Document and Procedure Package to Prepare
Documents visible to customers, seller agreements and internal procedures. The list of what has to be ready before sales open.
22GO / NO-GO Checklist Before Launch
GO / NO-GO questions before opening sales. A „no” on an item marked as blocking stops the launch rather than raising a warning.
23Most Common Misconceptions
The costliest myths: „the terms will say the seller is responsible”, „we are small, so DSA does not apply”, „compliance is a launch project”.
24Sources and Update Principle
Binding legal acts and materials from the competent authorities, not law firm blogs. Update rule: review changes at least once a quarter.
Marketplace architecture: from MVP to scale
How to build it so you are not rewriting it a year from now
Order model, multi-seller cart, commissions, payouts and integrations. Which decisions are reversible and which ones cost a migration.
Before you start2
How to use this guide
The guide shows architectural decisions and their consequences, not code to copy. It assumes a marketplace built by one person or a small team.
01The marketplace model comes before features
A handful of first-week decisions settle the order model, payments and catalogue. Which ones can be undone and which stay with you for years.
Data and catalogue4
Sellers: data model and onboarding
Onboarding is not a registration form. It settles which data the platform holds, which stays with the payment provider, and what happens later.
03The seller catalogue
A catalogue that will not block later imports. When to separate your own product id from the identifier in the seller system, and why.
04Integrating seller shops
From manual entry through CSV to continuous sync. Which source is the truth, what to do with a conflict, and what not to synchronise at all.
05Stock levels
Available quantity, reservations and who owns the stock. How to avoid building a warehouse system without cementing stock into the product.
The transaction3
Cart and checkout
If a second seller may one day land in the cart, assuming one order equals one seller is the most expensive decision in the whole system.
07The order model
When one order with seller-owned lines is enough, and when you need an order per seller. The consequences of both choices.
08Shipping and fulfilment
Methods, cost split across sellers and fulfilment state. A model that lets you add a carrier later without building logistics today.
Money5
Payments
The provider owns processing the payment. The platform owns what that event means for the order, the commission and the payout.
10Payouts
A manual payout at low volume is not bad architecture. Bad architecture is having no payout history and no answer to a refund after the transfer.
11Commissions
Commission as the model case for history and versioning. A single number in settings is simpler today and costly at the first rate change.
12Promotions and loyalty
Who funds the discount: the platform or the seller. Commission before or after it. Two questions to settle before the first campaign.
13Returns and disputes
A refund touches the order, the payment, the commission and the payout at once. If partial returns are possible, the model must know items, not orders.
Operations4
Moderation and operator decisions
Reports, suspensions and bans without building a trust and safety department. Decision history where the decision was made, before any central audit.
15The operator panel: from one person to a team
You do not build a command centre for a single administrator. What to add only once a second person starts making decisions.
16Events, notifications and recovery
A sent email is not proof that the operation succeeded. If something can partly succeed, there must be a way to establish its state and repair it.
17Security boundaries in a marketplace
Data isolation between sellers, permissions, webhook verification and user-uploaded content. Not general web security theory.
Putting it together3
Reversible and irreversible decisions
You can always add a profile field. History, line ownership and the money model cannot be retrofitted without a migration. A list of both.
19The maturity matrix: manual or automated
Process by process: the starting version, the concrete trigger, the next stage and the mistake that costs most. A table to walk before you build.
20A reference MVP
Tens of sellers, a few thousand products, seller-side shipping. What is built, what is delegated, what stays manual and what is deliberately deferred.