Privacy policy

1. Data controller

The company identified in full below is responsible for the processing of personal information described on this page.

2. Purpose and scope

This policy explains how personal data is processed when you use this website, send an enquiry, place a bid, submit a purchase request, offer a listing for sale or use a private transaction page. We process contact and transaction information only to answer enquiries, administer bids, complete orders and meet legal obligations.

3. Website access data

The server may process the IP address, access time, requested page, referrer, browser and device information in technical logs. This information supports secure operation, error analysis, abuse prevention and traceability of commercial activity. In addition, the website keeps its own visitor log (IP address, requested page, referrer, browser identifier, language and time), limited to the most recent 5,000 page views; older entries are overwritten automatically. To determine the approximate country of origin, the IP address may be sent to the geolocation service ipwho.is. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and stable operation of the website and the prevention of abuse and fraud.

4. Enquiries, offers and bids

When you use a form, we process the contact, message, offer and bid information that you provide. This is necessary to answer your request, take pre-contractual steps and administer a transparent bidding process. For bids and seller offers, we also store the IP address and the approximate country derived from it in order to prevent abuse. The legal basis is Art. 6(1)(b) GDPR (steps prior to and performance of a contract) and, for general enquiries and abuse prevention, Art. 6(1)(f) GDPR.

5. Buyer verification and transaction data

For a purchase request, we process identity, contact, address, company, VAT, order and payment-proof information. Uploaded identity and company documents are used only for buyer verification, fraud prevention, contract administration and legal record-keeping. The legal bases are Art. 6(1)(b) GDPR (steps prior to and performance of a contract), Art. 6(1)(c) GDPR (legal obligations such as tax and commercial record-keeping) and Art. 6(1)(f) GDPR (protection against fraud and identity misuse). See below for advice on blacking out identity document copies.

6. Contracts, invoices and electronic signatures

Contracts and invoices are generated from verified information. When an electronic signature is submitted, the signer name, signature image, acceptance confirmation and timestamp are stored with the transaction to document contractual intent. The legal bases are Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with commercial and tax retention obligations.

7. Recipients and service providers

Information is disclosed only when required for hosting, email delivery, payment administration, legal obligations, transport or completion of the transaction. Service providers may process data only for the agreed purpose and within the permitted scope. Recipients or categories of recipients are in particular: our hosting provider, which provides the website and the stored data on our behalf; the email service (SMTP server) we use to send confirmations and messages; the SMS service provider MsgRush for status messages by text message (phone number and message text); the AI service routellm.abacus.ai, to which chat messages are sent for automated replies; the messaging service Telegram, through which our team receives internal notifications (for example name, email address, IP address and approximate country for transaction events); the geolocation service ipwho.is (IP address); banks for payment processing, appointed carriers, tax advisers and auditors, and authorities and courts where we are legally obliged to disclose data. Service providers processing data on our behalf are bound by data processing agreements under Art. 28 GDPR.

8. Retention and security

Information is kept for as long as necessary for the stated purposes, transaction completion and applicable retention or evidentiary duties. Technical and organisational measures separate public website content from protected transaction documents and reduce unauthorised access. In detail: server log files kept by the hosting provider are deleted or anonymised after a short period unless a specific security incident requires longer storage. The website visitor log contains only the most recent 5,000 page views, the email and SMS logs the most recent 1,000 entries each and the activity log the most recent 2,000 entries. Enquiries, bids and chat histories that do not lead to a contract are deleted once they are no longer required for their purpose, unless a retention obligation applies or they are needed to establish, exercise or defend legal claims (standard limitation period of three years, Section 195 BGB). We retain commercial and business correspondence including emails for six years, invoices and accounting vouchers for eight years and books and records for ten years (Section 257 HGB, Section 147 AO, Section 14b UStG); these periods start at the end of the respective calendar year. Copies of identity documents are deleted once the purpose of buyer verification has been achieved and no legal obligation requires longer retention. Session data is deleted when the session expires.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing. Consent may be withdrawn for the future. Mandatory retention and legal-record obligations remain unaffected. In detail, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR), and the right to withdraw consent at any time (Art. 7(3) GDPR). Your right to object (Art. 21 GDPR) and your right to lodge a complaint (Art. 77 GDPR) are explained separately below.

10. Contact and updates

Send privacy requests to the contact address stated in the Imprint. This policy may be updated when processes, features or legal requirements change. The version published on this page applies.

11. Legal bases at a glance

We process personal data on the following legal bases: Art. 6(1)(a) GDPR (consent) where we expressly ask for your consent; Art. 6(1)(b) GDPR (contract and pre-contractual steps) for enquiries, bids, buyer verification, contract, invoice, payment and handover; Art. 6(1)(c) GDPR (legal obligation) for tax and commercial record-keeping and retention duties; Art. 6(1)(f) GDPR (legitimate interests) for secure website operation, logging, fraud and abuse prevention and the establishment and defence of legal claims. We do not use consent-based tracking or advertising tracking on this website.

12. Cookies and similar technologies

This website uses one technically necessary session cookie (usually "PHPSESSID"). It stores your language selection, security tokens against forged form submissions, rate limits and status messages and is deleted when you close your browser. Storing it is strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG); further processing is based on Art. 6(1)(f) GDPR. We do not use analytics, advertising or tracking cookies. If you start a live chat, an identifier of your chat session is stored in your browser's local storage so that the conversation can be continued; you can delete it in your browser settings. Embedded third-party content (see the next section) may use its own cookies or similar technologies.

13. External services and embedded content

Google Fonts: This website loads the icon font "Material Symbols" from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA). When a page is loaded, your browser connects to Google servers and transmits your IP address and browser information. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a consistent and legible presentation. OpenStreetMap: The contact page shows a map based on OpenStreetMap. For this purpose, the Leaflet map library is loaded from the content delivery network unpkg.com and map tiles are loaded from servers of the OpenStreetMap Foundation (United Kingdom); your IP address is transmitted in the process. The legal basis is Art. 6(1)(f) GDPR. Website chat: When you use the chat, we store your messages and, for live chat, the name and email address you provide as a chat history on our server in order to answer your request. Replies from the chat assistant are generated by an external AI service (routellm.abacus.ai); your chat messages, the previous conversation and the context of the page you are viewing are sent to it for this purpose. Please do not enter sensitive data such as identity or bank details in the chat. The legal basis is Art. 6(1)(b) GDPR where your request concerns a purchase and otherwise Art. 6(1)(f) GDPR. WhatsApp: The website contains a link to WhatsApp. Only when you click the link and contact us via WhatsApp does WhatsApp Ireland Limited process your data under its own terms; we receive your phone number and your messages.

14. Transfers to third countries

Some of the services described are provided by companies based outside the EU/EEA, in particular in the USA, or may process data there. This applies in particular to: Google, the AI service used by the chat assistant, the SMS service provider, Telegram. Where the European Commission has adopted an adequacy decision, for example for companies certified under the EU-U.S. Data Privacy Framework or for the United Kingdom, transfers are based on it (Art. 45 GDPR); otherwise they are based on standard contractual clauses (Art. 46(2)(c) GDPR). On request, we will inform you about the safeguards in place.

15. Right to object (Art. 21 GDPR)

Where we process personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process data for direct marketing, you may object to such processing at any time without giving reasons. An informal message to the contact address stated in the Imprint is sufficient.

16. Right to lodge a complaint (Art. 77 GDPR)

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is: the data protection supervisory authority of the German federal state in which we have our registered office.

17. Requirement to provide data

Providing personal data is not generally required by law or contract. However, the details marked as mandatory in the forms, such as name, email address, phone number, address, identity document and, for companies, register details, are necessary to process an enquiry or bid, to conclude and perform a contract and to meet legal obligations. Without these details we cannot process your enquiry, bid or purchase.

18. No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Buyer verification, bid review and contract release are carried out by our staff.

19. Advice on identity document copies

You may black out information on the copy of your identity document that is not needed for buyer verification, in particular the six-digit card access number (CAN) on the front of a German identity card and details such as height and eye colour. Name, date of birth, photograph, document number and validity must remain legible. Where possible, please mark the copy as a copy.

Last updated: 08 Oct 2026