Construction plan: what must exist and when

Stage A - before signing an agreement with the first seller#

• Approved responsibility model and list of allowed categories.
• Agreement and terms and conditions for sellers, covering P2B, division of responsibilities, product documents, EPR, DAC7, payouts, complaints, recalls, and penalties.
• Seller verification process and the ability to retain documents and decision history. In MVP, this can be fields/statuses of an existing seller account and files in a controlled storage – a separate module is not required.
• Agreement with a payment provider supporting marketplaces.
• DSA procedure: content/product notifications, moderation, justification of decisions, and appeals to the extent required.
• GPSR procedure: blocking, notification, recall, buyer notification, and contact with the authority.
• Privacy policy, GDPR role map, data processing agreements, and record of processing activities.
• DAC7 decision: whether the operator is a reporting operator and what data it will collect.

Stage B - before publishing the first offer#

• Product card enforcing seller, manufacturer, responsible person in the EU, product identification, warnings, and category information.
• Category approval process and blocking publication if information is missing.
• Ability to attach compliance documents and proof of origin to the seller or offer. In MVP, existing file storage with access control and record association is sufficient.
• Visible indication of whether the seller is a business or a private individual.
• Rules for ranking, advertisements, reviews, and promotions.
• Price change history and calculation of the lowest price over 30 days. In MVP, this can be a record of each change and a query performed during promotions; a separate pricing engine is not necessary.

Stage C - before accepting the first paid order#

• Checkout indicating the seller for each item, total price, fees, delivery, and payment obligation.
• Checkbox for accepting terms and conditions with proof allowing reconstruction of the person, time, and applicable version – not as marketing consent. The law does not mandate a separate technical table.
• Separate, voluntary marketing consents and a cookie panel blocking optional technologies until consent is given.
• Order snapshot: seller, product, price, offer, warnings, document versions, and proof of acceptance.
• Path for withdrawal, complaint, return, refund, and communication with the seller.
• Payment processing, payouts, holds, refunds, and chargebacks by the PSP.
• Account security: MFA for administrators and high-risk local operations, roles, logs, and backups. Payout operations performed solely within Stripe are secured by Stripe.

Stage D - before public scaling#

• Availability report and the entire purchasing process available.
• Established schedule for audits of offers, sellers, EPR, DAC7, security, and retention.
• Event view: blocked products, missing documents, notifications, deadlines, complaints, recalls, and incidents. Initially, this can be a saved query or a controlled export/spreadsheet; a dedicated dashboard is only needed for a larger volume of cases.
• Business continuity plan, backup recovery, and data breach handling.
• Assessment of DSA, PAD, and NIS2 thresholds with an alert before losing exemption or reaching a threshold.

MVP Matrix – the simplest implementation for the entire guide#