PRIVACY POLICY

This is a convenience translation. The German version is the legally binding version.

1. Introduction

Thank you for your interest in DomainHeld.de and the sales pages of our domains. Protecting your personal data is an important concern for us. Below we inform you about which data we collect, how we use it and what rights you have.

2. Controller

The party responsible for data processing on this website and the sales pages of our domains is:

kobayashi software innovations UG (haftungsbeschränkt)
Kolonnenstr. 8
10827 Berlin, Germany
Andre Westphal
mail (at) domainheld.de

3. Collection and Processing of Personal Data

We collect and process personal data only to the extent necessary to provide our website and to sell our domains. This includes in particular:

• Order and invoice data: name, company and VAT ID where applicable, postal address, email address, domain purchased, amount; payment data (e.g. card details) is processed exclusively by the respective payment provider
• Inquiry and offer data: the details you enter in the inquiry form (incl. name, contact details, price proposal, message) and our offers
• Protection against advertising and abuse in the inquiry form: we check inquiries automatically based on the message, phone number, IP address with its hostname and the domain of your email address. For the domain we query public registration data (RDAP, including via rdap.org); only the domain name is transmitted. Legal basis: Art. 6(1)(f) GDPR (protection against unsolicited advertising and abuse). In the inquiry form on our sales pages we also use Cloudflare Turnstile (Cloudflare, Inc., see below) to detect automated submissions by programs. Turnstile is loaded from www.domainheld.de and evaluates, among other things, your IP address and technical characteristics of your browser and device; it does not set advertising cookies. We send the result of the check to Cloudflare together with the form for confirmation.
• Price alert: email address, domain and proof of consent (see section 9)
• Usage data: IP address, log data, access times
• Communication data: email enquiries, support requests

4. Purpose of Data Processing

Your data is processed for the following purposes:

• Provision and operation of the website
• Handling of purchase and sale processes
• Communication with users
• Improvement and analysis of our services
• Compliance with legal obligations

5. Legal Bases for Processing

We process your data on the basis of the following legal grounds:

• Performance of a contract (Art. 6(1)(b) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)
• Consent (Art. 6(1)(a) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)

6. Recipients / Disclosure of Data to Third Parties

Your data is only disclosed where this is necessary for the performance of a contract, based on your consent, or due to a legal obligation. In particular, we use the following recipients / processors:

• Payment processing – Stripe: For direct payment, the data required for payment (incl. name, email, billing address, payment data) is transmitted to Stripe Payments Europe, Ltd. (Ireland) or Stripe, Inc. (USA). Your full card details are processed exclusively by Stripe – we neither receive nor store them. Legal basis: Art. 6(1)(b) GDPR.
• Escrow payment – Escrow.com: If you choose the optional escrow purchase, the data required for the transaction (incl. name, email, and where applicable address) is transmitted to Escrow.com, Inc., 400 Spectrum Center Drive, Suite 500, Irvine, CA 92618, USA. Escrow.com handles payment and release as a neutral escrow agent. This involves a transfer to a third country (USA), safeguarded by the EU Standard Contractual Clauses and Escrow.com's contractual commitments. Legal basis: Art. 6(1)(b) GDPR – only if you actively select this payment method.
• Payment methods at Stripe: If you choose a particular payment method in the Stripe checkout (e.g. Klarna, Apple Pay, Google Pay, Amazon Pay, Revolut Pay) or save your details with Stripe’s “Link”, Stripe passes the necessary data to the respective provider; for Klarna to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden, which may carry out an identity and credit check. The privacy notices of the respective provider also apply. Legal basis: Art. 6(1)(b) GDPR.
• Domain marketplace – Sedo: Our domains are also listed on the marketplace of Sedo GmbH, Im Mediapark 6b, 50670 Cologne, Germany. For this we only transmit domain details (name, price), no personal data of visitors to this website. If you buy a domain via Sedo, Sedo is responsible for the data collected there; we receive from Sedo the details needed for the transfer. Legal basis: Art. 6(1)(b) GDPR.
• Analytics – Google Analytics: Only with your explicit consent; provider Google Ireland Limited (Ireland) or Google LLC (USA), with IP anonymisation enabled. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time via “Cookie settings” in the footer.
• Hosting / infrastructure: The website and the sales pages run on a server operated for us by Sharpness Solutions GmbH, Wilhelmshavener Heerstraße 63, 26125 Oldenburg, Germany. The server is located in the data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (Nuremberg site). All data arising when the pages are accessed (incl. IP address, time, page requested, browser details) and the form data you submit are processed there. Data processing agreements are in place with both providers. Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of the website).
• Content delivery and protection – Cloudflare: Requests to our website and sales pages are routed through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects against attacks and delivers content faster, processing your IP address and technical request details for this purpose. This may involve a transfer to the USA; Cloudflare is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses also apply. Legal basis: Art. 6(1)(f) GDPR (security and availability).
• Email delivery: We send inquiry, offer and notification emails via the mail server on our own server (see hosting).
• Authorities, where required by law.

7. Storage Period and Deletion

We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention periods exist:

• Invoice and contract data: 10 years (§ 147 AO, § 257 HGB – German tax and commercial law).
• Contact and purchase enquiries: until your request has been fully handled; afterwards deleted, unless a statutory retention obligation applies.
• Inquiries sorted out as advertising or abuse: 30 days, then deleted automatically.
• Price alert: until you unsubscribe or the domain is sold; unconfirmed sign-ups 7 days; afterwards proof of consent for up to three years.
• Reach / access statistics: IP addresses are stored only in anonymised (truncated) form; analysis is aggregated.
• Server and login logs: kept briefly for security and operational purposes, then automatically overwritten or deleted.

8. Your Rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority

9. Cookies and Analytics

We set technically necessary cookies (e.g. session, language selection, storing your cookie consent) on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Google Analytics is loaded only after your consent via our cookie banner (with IP anonymisation). You can change or withdraw your choice at any time via the “Cookie settings” link in the footer. For the anonymous demand/traffic display of our domains, we evaluate access only with an anonymised IP address.

Open tracking in offer emails: When we send you a personal domain offer by email upon request, that email may contain open tracking via a small, invisible image (“tracking pixel”). When the image is loaded, the time of retrieval, your IP address and technical details of your email client (user agent) are processed in order to determine whether and when our offer was opened. The legal basis is our legitimate interest in measuring the success of our individual offer communication (Art. 6(1)(f) GDPR). You can prevent this at any time by disabling the automatic loading of external images in your email client; on request we will also send offers without open tracking – simply contact us.

Price alert: On the sales pages you can ask to be notified when the price of a domain drops. For this we store your email address, the domain, the selected language, the price at the time of sign-up as well as the time and IP address of the sign-up and the time of confirmation (proof of consent). The price alert only becomes active once you click the link in the confirmation email (double opt-in); unconfirmed sign-ups are deleted after 7 days. We use the address exclusively for price alerts for this domain. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in every email or by contacting us. After you unsubscribe or once the domain is sold, the price alert ends; we then keep the details only as proof for up to three years.

10. Data Security

We take technical and organisational measures to protect your data against unauthorised access, loss or misuse.

11. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy. The current version is always available on DomainHeld.de.

12. Contact

If you have any questions about data protection, you can reach us using the contact details provided above.