If you report a conflict or contact support, personal data may be processed. Data protection does not mean that the matter can be reviewed without processing any data. Rather, the processing must have a legal basis, serve a specified purpose and be limited to what is necessary for that purpose.
What data may be processed in connection with a conflict?
Depending on the circumstances, the data processed may include, in particular, account and contact details, usernames, the advert ID, advert content, messages from internal communications, and complaint, report and support data. Technical data and logs relevant to account security, the prevention of misuse or the investigation of an incident may also be processed.
If you submit evidence yourself, payment confirmations, dispatch information, photographs or other documents may also become part of the case. You should therefore submit only documents that are necessary for the specific enquiry and avoid unnecessary personal data relating to third parties.
For what purposes is the data used?
The data may be processed to handle your enquiry, communicate with you, identify the account or advert concerned, review a report, and prevent and investigate misuse or unlawful use. Processing may also be necessary to ensure the secure operation of the platform, comply with legal obligations, or establish, exercise or defend legal claims.
The applicable legal basis depends on the individual case. In particular, this may be the performance of the user relationship under Article 6(1)(b) GDPR, a legal obligation under Article 6(1)(c) GDPR, legitimate interests under Article 6(1)(f) GDPR or consent under Article 6(1)(a) GDPR, insofar as consent is required by law. Consent is therefore not the only possible legal basis for every instance of processing or disclosure.
Further details about purposes, categories of data and legal bases are set out in the Privacy Policy.
Who within suchen.expert can access the data?
Within Suchen Technology GmbH, access is granted only to the departments and employees who need it to perform their duties. These may include, in particular, customer service and support, technical operations, legal and compliance, and the teams responsible for security or quality assurance. Internal access follows the need-to-know principle and is subject to authorisation and security requirements.
In individual cases, support and review processes may also require relevant information to be examined manually. This does not mean that all employees have general access to every message, document or item of account data.
What information may other users or external recipients receive?
The other party to the conflict can see the information that you provide to them through the messaging function, as well as publicly visible profile and advert details. There is no general access to other users’ non-public personal data. If further information must be processed or disclosed as part of a complaint, a legal basis is required.
Processors may be used for technical operations, such as hosting and cloud providers or technical support and maintenance service providers. These providers process data on our behalf and in accordance with our instructions and are contractually bound to data protection and confidentiality under Article 28 GDPR. In certain cases, recipients acting as independent controllers, such as payment service providers, banks, solicitors or other bodies provided for by law, may also be involved.
Data may be disclosed if this is necessary for the performance of a contract, there is a legal obligation, there is a legitimate interest and no overriding interests of the data subject prevent disclosure, or valid consent has been given. Data may be transferred to authorities or courts, in particular where there is a legal obligation or for the establishment, exercise or defence of legal claims. If criminal conduct is suspected, relevant data may be disclosed to the competent authorities in accordance with the statutory requirements.
A report or enquiry does not automatically result in the disclosure of all available data. Which data may be disclosed depends on the particular purpose, legal basis and statutory requirements.
How long is the data stored?
As a general rule, personal data is stored only for as long as is necessary for the respective purpose. In connection with a conflict, this may include handling the report, necessary follow-up questions, security measures or investigations into misuse, and administering the user relationship.
Statutory retention obligations or the preservation of evidence for the establishment, exercise or defence of legal claims may require longer storage. Data in backups may not be removed until the regular deletion cycles take place and will be blocked from further use until then. Once the relevant purposes and time limits no longer apply, the data is deleted or anonymised.
In accordance with the privacy policy, processing and storage take place predominantly electronically and on servers within the EU or EEA. Further details and any specific retention periods are described in the Privacy Policy.
What data protection rights do you have?
Under the GDPR, you may, in particular, request information about the processing of your personal data and the rectification of inaccurate data or completion of incomplete data. Subject to the applicable statutory conditions, you may also have rights to erasure, restriction of processing, data portability and objection. Consent that has been given may be withdrawn with effect for the future.
These rights do not apply without restriction. Immediate erasure may, for example, be precluded by statutory retention obligations, the need for the data to perform a contract or maintain system security, or the establishment, exercise or defence of legal claims. The rights and freedoms of other people may also need to be taken into account when providing information or copies. It may not be possible to remove content completely if other people have already copied or stored it outside the platform.
Not all data can be viewed, changed or deleted directly in the profile. You can use the designated data protection contact channels for more extensive requests for information, rectification or erasure.
How is the data protected technically?
suchen.expert uses appropriate technical and organisational measures. These include TLS/HTTPS encryption, access restrictions, role and authorisation systems, secure authentication procedures, logging of access events, and regular software and security updates.
These measures are intended to reduce risks such as unauthorised access, loss, alteration or destruction. However, absolute protection cannot be guaranteed. Despite security measures, data transmissions over the internet, particularly communication by email, may have technical security vulnerabilities.
You should therefore also protect your own account. Keep your login details confidential and never send passwords or confirmation codes to support. Do not publish private messages or conflict documents in publicly visible areas.
How can you submit a data protection enquiry or lodge a complaint?
You can submit data protection enquiries through the contact form, by post to the address stated in the Privacy Policy or by email to datenschutz@suchen.technology. To prevent unauthorised enquiries, suchen.expert may request additional information to verify your identity.
Data protection enquiries are generally answered without undue delay and at the latest within one month. For complex or numerous enquiries, this period may be extended by a further two months subject to the statutory conditions. You will be informed of the extension and the reasons for it within the first month.
If you believe that your personal data is being processed in breach of the GDPR, you may lodge a complaint with a data protection supervisory authority. In particular, you may complain to the authority for your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for Suchen Technology GmbH and its contact details are listed in the Privacy Policy.
Further provisions on support, moderation measures and statutory disclosure obligations can be found in the General Terms of Service.
