Privacy Policy

1. Controller

2. Hosting and Technical Infrastructure (Base44)

Our website and parts of our application infrastructure are operated via the Base44 platform. Base44 provides the technical infrastructure for the creation, deployment, and hosting of our website.

The following data is processed in the course of hosting in particular:

• IP address
• Date and time of access
• Browser type and version
• Operating system
• Referrer URL
• Technical log files

Processing is carried out to ensure the secure and stable operation of our online services.

Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in IT security and stability).

Where Base44 processes personal data on our behalf, the required data protection agreements are in place.

The server log files are used exclusively to ensure technical operation and for error analysis, and are automatically deleted on a regular basis.

3. Use of Cookies and Consent Management (CCM19)

Our website uses cookies. Some cookies are technically necessary to ensure the functioning of the website. Other cookies serve statistical purposes. Technically necessary cookies are set on the basis of Section 25 Para. 2 TDDDG.

To manage your consent, we use the Cookie Consent Manager CCM19 by Papoo Software & Media GmbH, Germany. CCM19 stores your consent settings locally in your browser to fulfil the statutory proof obligation pursuant to Art. 7 Para. 1 GDPR.

You may change or withdraw your consent at any time via the cookie consent tool.

Legal bases: Art. 6 Para. 1 lit. c GDPR (legal obligation) and Art. 6 Para. 1 lit. a GDPR (consent).

4. Registration and Use of the Auction Platform (Bidlogix)

For the operation of our online auction platform, we use the software solution of Bidlogix Ltd., United Kingdom.

In the course of registration and use of the platform, the following personal data is processed in particular:

• Name
• Email address
• Company data
• Registration information
• Bid data
• Transaction data
• Technical usage data, stability and application logs

Processing is carried out for the purpose of conducting online auctions, user management, and contract fulfilment.

Legal basis: Art. 6 Para. 1 lit. b GDPR (contract performance).

The United Kingdom benefits from an adequacy decision by the European Commission pursuant to Art. 45 GDPR.

Data is stored for as long as necessary for the performance of the contract or as required by statutory (in particular commercial and tax law) retention obligations.

5. Technical Monitoring and Error Analysis (Monitoring)

In the course of the technical provision of the auction platform, monitoring and error analysis services may be used to automatically detect software errors, monitor system performance, and ensure the permanent stability of the platform.

In the event of a system crash or software error, technical metadata relating to the error event may be captured. This includes, for example, data about the end device, the operating system used, browser type, log data, and the user's IP address at the time of the error. Such processing is carried out exclusively for the purpose of error resolution and system maintenance.

Where external service providers (such as Functional Software Inc. / Sentry, USA) are involved as subcontractors of our technology partners, processing is carried out on a pseudonymised basis and on the basis of appropriate data protection guarantees pursuant to Art. 46 GDPR (such as EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework).

Legal basis: Art. 6 Para. 1 lit. f GDPR (legitimate interest in ensuring IT security, platform stability, and effective error resolution).

6. Payment Processing (Stripe)

For the processing of payments, we use Stripe. The EU contracting party is Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland.

When a payment is made, payment data is transmitted to Stripe. Stripe processes this data for payment processing and fraud prevention.

Legal basis: Art. 6 Para. 1 lit. b GDPR (contract performance).

Further information: https://stripe.com/en/privacy

7. Google Analytics 4

We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies that enable an analysis of your use of our website. We have enabled IP anonymisation. Google Analytics will only be loaded after you have given your express consent via our cookie consent tool.

Processing is carried out exclusively on the basis of your consent. You may withdraw your consent at any time with effect for the future via our cookie consent tool.

Legal basis: Art. 6 Para. 1 lit. a GDPR.

A transfer of data to third countries cannot be excluded. Google relies on appropriate safeguards pursuant to Art. 46 GDPR (Standard Contractual Clauses).

The retention period for data collected by Google Analytics is a maximum of 14 months.

8. Sending System and Transactional Emails

For sending system messages and transaction-related emails, we use external email service providers. These include in particular Brevo (Brevo GmbH, Berlin, a subsidiary of Sendinblue SAS, Paris, France) and Amazon Web Services – Simple Email Service (AWS SES).

These services are used to send, for example, registration confirmations, system notifications, appointment confirmations and transaction-related information. The following data may be processed in particular: name, email address, communication content, timestamps and sending information.

Legal basis: Art. 6 Para. 1 lit. b GDPR (contract performance) and Art. 6 Para. 1 lit. f GDPR (legitimate interest in reliable communication).

As Brevo's providers are companies based in Germany and France, data processing takes place within the European Union by default, ensuring a high level of data protection. For service providers based in the USA (such as AWS), data is transferred on the basis of Standard Contractual Clauses pursuant to Art. 46 GDPR.

9. Contact Inquiries

If you contact us by email or via a contact form, your details will be stored for the purpose of processing your inquiry. The following data may be processed in particular: name, email address, company information, and the content of the message.

Legal basis: Art. 6 Para. 1 lit. b GDPR or Art. 6 Para. 1 lit. f GDPR.

10. Data Security & IT Security Incidents (Incident Management)

To meet the requirements of Art. 32 GDPR, we implement appropriate security measures in coordination with our technical partners. In the event of potential personal data breaches, structured internal processes are in place to ensure rapid detection, assessment, and where necessary, legally compliant notification to the competent supervisory authorities pursuant to Art. 33, 34 GDPR.

11. Media and Data Carrier Disposal

Our technical service providers have established procedures for the secure deletion and data protection-compliant disposal of data carriers and storage media, in order to prevent data stored thereon from being reconstructed or accessed by unauthorised third parties.

12. Retention Period

Personal data is only stored for as long as necessary for the respective purposes or as required by statutory retention obligations. Server log files are generally deleted after no more than 30 days, unless security-relevant events require longer retention.

13. Your Rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object (Art. 21 GDPR) to processing based on legitimate interests.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority is: