Vinted

Incorporated and operating in Lithuania as Vinted, UAB; the operating entity and the registered seat coincide in Vilnius, so EU/GDPR/DSA law reaches it directly. The payments subsidiary is licensed and supervised by the Bank of Lithuania, an EU national regulator. No foreign parent sits above the Lithuanian core.

Founded by Lithuanians and still privately held with an EU operating core, but the economic majority is non-EU. Major holders include US firms (Accel, Lightspeed, Insight, TPG, Hedosophia, Pinegrove, BlackRock funds), Canada's Ontario Teachers' (TVG), UK's Schroders and Baillie Gifford, and Switzerland's Lombard Odier; EU economic exposure runs mainly through Sweden's EQT and Belgium's Sofina. No foreign stock listing, which lifts the score above pure foreign-control cases, but the cap-table economics clearly skew outside the EU.

Vinted states most user data is processed within the EEA, which is better than a default-US posture, but it relies on third-party cloud and service providers and discloses transfers to third countries including the USA under Standard Contractual Clauses (e.g., Google LLC). No EU-sovereign, EU-owned infrastructure is claimed, and the specific core-platform cloud provider is not confirmed from a primary source, leaving CLOUD Act exposure plausible. Scored in the mid-range: EEA-default processing lifts it above a pure US-hosting case, but the lack of sovereign infrastructure and the documented US transfers cap it.

Strongly EU-centered operationally: headquartered in Vilnius since 2008, with its largest workforce in Lithuania (Vilnius, Kaunas) plus EU offices in Amsterdam, Berlin, Hamburg, Paris and Luxembourg (and London). Reports in euros, operates across ~26 mostly-European markets. CEO Thomas Plantenga is Dutch (EU). One small non-EU office (London) keeps it just shy of the top band.