PRIVACY POLICY

This is a convenience translation. The German version is the legally binding version.

1. Introduction

Thank you for your interest in our domain trading platform DomainHeld.de. Protecting your personal data is an important concern for us. Below we inform you about which data we collect, how we use it and what rights you have.

2. Controller

The party responsible for data processing on this platform is:

kobayashi software innovations UG
Kolonnenstr. 8
10827 Berlin, Germany
Andre Westphal
mail (at) domainheld.de

3. Collection and Processing of Personal Data

We collect and process personal data only to the extent necessary for the provision and use of our platform. This includes in particular:

• Registration data: name, email address, postal address, payment information
• Usage data: IP address, log data, access times
• Communication data: email enquiries, support requests

4. Purpose of Data Processing

Your data is processed for the following purposes:

• Provision and operation of the platform
• Handling of purchase and sale processes
• Communication with users
• Improvement and analysis of our services
• Compliance with legal obligations

5. Legal Bases for Processing

We process your data on the basis of the following legal grounds:

• Performance of a contract (Art. 6(1)(b) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)
• Consent (Art. 6(1)(a) GDPR)
• Legal obligation (Art. 6(1)(c) GDPR)

6. Recipients / Disclosure of Data to Third Parties

Your data is only disclosed where this is necessary for the performance of a contract, based on your consent, or due to a legal obligation. In particular, we use the following recipients / processors:

• Payment processing – Stripe: For direct payment, the data required for payment (incl. name, email, billing address, payment data) is transmitted to Stripe Payments Europe, Ltd. (Ireland) or Stripe, Inc. (USA). Your full card details are processed exclusively by Stripe – we neither receive nor store them. Legal basis: Art. 6(1)(b) GDPR.
• Escrow payment – Escrow.com: If you choose the optional escrow purchase, the data required for the transaction (incl. name, email, and where applicable address) is transmitted to Escrow.com, Inc., 400 Spectrum Center Drive, Suite 500, Irvine, CA 92618, USA. Escrow.com handles payment and release as a neutral escrow agent. This involves a transfer to a third country (USA), safeguarded by the EU Standard Contractual Clauses and Escrow.com's contractual commitments. Legal basis: Art. 6(1)(b) GDPR – only if you actively select this payment method.
• Analytics – Google Analytics: Only with your explicit consent; provider Google Ireland Limited (Ireland) or Google LLC (USA), with IP anonymisation enabled. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time via “Cookie settings” in the footer.
• Hosting / infrastructure: Operation of the website by our hosting provider [provider and address – to be completed] on servers within the EU. Legal basis: Art. 6(1)(f) GDPR.
• Email delivery: Enquiry and notification emails are processed via our mail server / email provider.
• Authorities, where required by law.

7. Storage Period and Deletion

We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention periods exist:

• Invoice and contract data: 10 years (§ 147 AO, § 257 HGB – German tax and commercial law).
• Contact and purchase enquiries: until your request has been fully handled; afterwards deleted, unless a statutory retention obligation applies.
• Reach / access statistics: IP addresses are stored only in anonymised (truncated) form; analysis is aggregated.
• Server and login logs: kept briefly for security and operational purposes, then automatically overwritten or deleted.

8. Your Rights

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to lodge a complaint with a supervisory authority

9. Cookies and Analytics

We set technically necessary cookies (e.g. session, language selection, storing your cookie consent) on the basis of our legitimate interest (Art. 6(1)(f) GDPR). Google Analytics is loaded only after your consent via our cookie banner (with IP anonymisation). You can change or withdraw your choice at any time via the “Cookie settings” link in the footer. For the anonymous demand/traffic display of our domains, we evaluate access only with an anonymised IP address.

Open tracking in offer emails: When we send you a personal domain offer by email upon request, that email may contain open tracking via a small, invisible image (“tracking pixel”). When the image is loaded, the time of retrieval, your IP address and technical details of your email client (user agent) are processed in order to determine whether and when our offer was opened. The legal basis is our legitimate interest in measuring the success of our individual offer communication (Art. 6(1)(f) GDPR). You can prevent this at any time by disabling the automatic loading of external images in your email client; on request we will also send offers without open tracking – simply contact us.

10. Data Security

We take technical and organisational measures to protect your data against unauthorised access, loss or misuse.

11. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy. The current version is always available on our platform.

12. Contact

If you have any questions about data protection, you can reach us using the contact details provided above.