Privacy policy

The person responsible within the meaning of the General Data Protection Regulation (GDPR) is ERTZU UG i.G (limited liability), Dietrichinger Weg 7, 13437 Berlin, Germany. You can reach us by email at info@ertzu.de.

A data protection officer has not currently been named. If a legal obligation to name arises, we will add the contact details here.

ERTZU processes personal data to the extent necessary for the operation and use of the platform.

• Account and registration data, such as name, email address, login details and language settings.
• Profile, communication and marketplace data, such as listings, bids, purchases, sales, messages, wish lists, notifications and complaints.
• Product, verification and transaction data as necessary for purchasing, selling, authentication, health checking, fulfillment, support and fraud prevention.
• Payment, payout and KYC/identification data as part of payment processing via Stripe Connect.
• Shipping and logistics data, in particular names, delivery and sender addresses as well as shipment and status information.
• Usage and log data, such as IP address, timestamp, device and access data, to the extent necessary for technical or security purposes.
• Tax-reportable data from sellers to the extent that ERTZU is subject to statutory platform, commercial or tax obligations.

Depending on the purpose, processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR to fulfill the contract or to carry out pre-contractual measures, Article 6 Paragraph 1 Letter c GDPR to fulfill legal obligations, Article 6 Paragraph 1 Letter f GDPR based on legitimate interests and Article 6 Paragraph 1 Letter a GDPR, insofar as consent is required.

Legitimate interests include, in particular, secure platform operation, fraud prevention, misuse detection, authentication, enforcement of claims, product security, support and the technical development of ERTZU.

ERTZU uses technical service providers who, depending on the processing operation, can process personal data as processors or independently responsible parties. If necessary, contracts are concluded with processors in accordance with Art. 28 GDPR.

• Vercel: Hosting, provision, delivery, CDN and technical access data of the website.
• Supabase: Authentication, database, storage, session management and server-side platform functions. According to the current project status, the primary database location is Western EU/Ireland.
• Stripe and Stripe Connect: payment processing, payment authorization, payout preparation, webhooks, and KYC/identification processes for platform payments.
• Resend: Sending transactional emails, such as notifications of bids, purchases, sales, and support communications.

Some service providers used or their affiliates and subcontractors may process personal data outside the European Union or the European Economic Area, particularly in the USA.

If a third country transfer takes place, it takes place in accordance with appropriate guarantees within the meaning of Art. 44 ff. GDPR, in particular on the basis of EU standard contractual clauses, additional protective measures and/or certification in accordance with the EU-US Data Privacy Framework, provided that the respective provider is certified thereunder.

ERTZU only stores personal data for as long as it is necessary for the respective purposes or as long as there are legal retention requirements.

• Account and profile data are generally stored for the duration of the user account and are removed or restricted after the account has been deleted, provided that there are no legal obligations or legitimate interests to the contrary.
• Contract, payment, transaction, invoice and tax-relevant data are regularly stored for up to 6 or 10 years in accordance with commercial and tax obligations.
• Communication, support and complaint data are stored for as long as necessary for processing, proof and legal defense.
• Technical protocol and security data are generally stored for a short period of time unless they are needed for a longer period of time due to security incidents, suspected misuse or legal obligations.
• Data based on consent will be deleted or no longer processed for the relevant purpose if consent is revoked and no other legal basis applies.

ERTZU uses technically necessary cookies and comparable storage technologies, in particular for authentication, session management and security via Supabase.

In addition, ERTZU currently uses local browser storage for language, theme, intro status as well as display and page positions in the product overview. This storage serves the usability and personalization of the interface.

The current code does not include any analytics, advertising or reach measurement SDKs such as PostHog, Google Analytics or comparable tracking tools. If ERTZU uses cookies or analysis tools that require consent in the future, a corresponding cookie notice or consent mechanism will be added in advance.

ERTZU uses Stripe or Stripe Connect for payments. During payment processes, Stripe processes in particular payment data, transaction data, technical data and, if necessary, identification or KYC data.

Card data is not stored by ERTZU itself. Payment data is processed via Stripe. ERTZU only stores the payment references and status information required for marketplace, ordering, status, verification and processing purposes.

ERTZU may send transactional emails regarding, for example, registration, bids, accepted bids, purchases, sales, order status, support and security-related processes. Shipping is currently via Resend.

The content of such emails will be limited to what is necessary for the particular occasion.

In accordance with the GDPR, data subjects have the right to information, correction, deletion, restriction of processing, data portability and objection. If the processing is based on consent, the consent can be revoked at any time with future effect. Inquiries can be made to info@ertzu.de .

There is also a right to lodge a complaint with a data protection supervisory authority, in particular with the supervisory authority responsible for ERTZU's place of residence or registered office.

ERTZU adapts this data protection declaration if the processing of personal data, service providers used, technical functions or the legal situation change. The published version is relevant.