Privacy policy

The person responsible within the meaning of the General Data Protection Regulation (GDPR) is ERTZU UG (limited liability), Triftstraße 37, Workbox 25, 13509 Berlin, Germany. You can reach us by email at info@ertzu.de.

A data protection officer has not currently been named. If a legal obligation to name arises, we will add the contact details here.

ERTZU processes personal data to the extent necessary for the operation and use of the platform.

• Account and registration data, such as name, email address, login details and language settings.
• Profile, communication and marketplace data, such as listings, bids, purchases, sales, messages, wish lists, notifications and complaints.
• Product, verification, and transaction data required for purchasing, selling, authentication, condition checks, fulfilment, support, and fraud prevention.
• Payment, payout and KYC/identification data as part of payment processing via Stripe Connect.
• Shipping and logistics data, in particular names, delivery and sender addresses as well as shipment and status information.
• Usage and log data, such as IP address, timestamp, device and access data, to the extent necessary for technical or security purposes.
• Tax-reportable data from sellers to the extent that ERTZU is subject to statutory platform, commercial or tax obligations.

Depending on the purpose, processing is carried out on the basis of Article 6 Paragraph 1 Letter b GDPR to fulfill the contract or to carry out pre-contractual measures, Article 6 Paragraph 1 Letter c GDPR to fulfill legal obligations, Article 6 Paragraph 1 Letter f GDPR based on legitimate interests and Article 6 Paragraph 1 Letter a GDPR, insofar as consent is required.

Legitimate interests include, in particular, secure platform operation, fraud prevention, misuse detection, authentication, enforcement of claims, product security, support and the technical development of ERTZU.

ERTZU uses technical service providers who, depending on the processing operation, can process personal data as processors or independently responsible parties. If necessary, contracts are concluded with processors in accordance with Art. 28 GDPR.

• Vercel: Hosting, provision, delivery, CDN and technical access data of the website.
• Supabase: Authentication, database, storage, session management and server-side platform functions. According to the current project status, the primary database location is Western EU/Ireland.
• Stripe and Stripe Connect: payment processing, payment authorization, payout preparation, webhooks, and KYC/identification processes for platform payments.
• Resend: Sending transactional emails, such as notifications of bids, purchases, sales, and support communications.
• Cloudinary: delivery and, where enabled, processing of product and marketplace images. This involves technically necessary connection data.
• Google: OAuth sign-in only when users explicitly select “Continue with Google”; the resulting session is then managed by Supabase.
• PostHog Cloud EU: optional pseudonymous product analytics, minimised error diagnostics and masked session recordings exclusively after consent; autocapture, surveys, heatmaps, performance capture, feature flags and person profiles are disabled. Internal admin areas and Stripe payment interfaces are not recorded.
• Vercel Web Analytics and Speed Insights: optional cookieless audience and performance measurement exclusively after consent; Vercel may process data in the United States.

Some service providers used or their affiliates and subcontractors may process personal data outside the European Union or the European Economic Area, particularly in the USA.

If a third country transfer takes place, it takes place in accordance with appropriate guarantees within the meaning of Art. 44 ff. GDPR, in particular on the basis of EU standard contractual clauses, additional protective measures and/or certification in accordance with the EU-US Data Privacy Framework, provided that the respective provider is certified thereunder.

ERTZU only stores personal data for as long as it is necessary for the respective purposes or as long as there are legal retention requirements.

• Account and profile data are generally stored for the duration of the user account and are removed or restricted after the account has been deleted, provided that there are no legal obligations or legitimate interests to the contrary.
• Contract, payment, transaction, invoice and tax-relevant data are regularly stored for up to 6 or 10 years in accordance with commercial and tax obligations.
• Communication, support and complaint data are stored for as long as necessary for processing, proof and legal defense.
• Technical protocol and security data are generally stored for a short period of time unless they are needed for a longer period of time due to security incidents, suspected misuse or legal obligations.
• Data based on consent will be deleted or no longer processed for the relevant purpose if consent is revoked and no other legal basis applies.

ERTZU uses technically necessary cookies and comparable storage technologies for explicitly selected settings, sign-in, security, and purchase and payment flows that have been started. The consent decision is stored for six months.

Local search history, redundant language storage and the saved intro status have been removed. Checkout data in session storage does not contain a shipping address and is technically valid for only 15 minutes.

PostHog, Vercel Web Analytics and Vercel Speed Insights are optional cookie and measurement services and load only after explicit consent. Rejecting and accepting are equally accessible; consent can be withdrawn at any time under Account settings → Cookies & privacy or through “Cookie settings” in the footer.

A complete inventory including names, purposes, triggers, durations and legal bases is available at Cookies & browser storage.

ERTZU uses Stripe or Stripe Connect for payments. During payment processes, Stripe processes in particular payment data, transaction data, technical data and, if necessary, identification or KYC data.

Card data is not stored by ERTZU itself. Payment data is processed via Stripe. ERTZU only stores the payment references and status information required for marketplace, ordering, status, verification and processing purposes.

ERTZU may send transactional emails regarding, for example, registration, bids, accepted bids, purchases, sales, order status, support and security-related processes. Shipping is currently via Resend.

The content of such emails will be limited to what is necessary for the particular occasion.

In accordance with the GDPR, data subjects have the right to information, correction, deletion, restriction of processing, data portability and objection. If the processing is based on consent, the consent can be revoked at any time with future effect. Inquiries can be made to info@ertzu.de .

There is also a right to lodge a complaint with a data protection supervisory authority, in particular with the supervisory authority responsible for ERTZU's place of residence or registered office.

ERTZU adapts this data protection declaration if the processing of personal data, service providers used, technical functions or the legal situation change. The published version is relevant.