Current version: as at 2 September 2026

Previous versions are archived in Customer Service.

Suchen Technology GmbH, Dieselstraße 11, 30916 Isernhagen, Germany

(hereinafter referred to as “Suchen Technology GmbH” or “we”) is the data controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data when using the suchen.expert platform.

This Privacy Policy applies to all German and multilingual websites under suchen. expert, the associated mobile applications and other online services provided by us (hereinafter collectively referred to as the ‘Platform’).

The protection of your personal data and your privacy is of the utmost importance to us. We process your data exclusively in accordance with the applicable data protection regulations, in particular the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

§ 1 General Information

1.1 Suchen Technology GmbH attaches great importance to the careful and responsible handling of personal data. We process personal data exclusively in accordance with the relevant data protection regulations, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG).

1.2 This Privacy Policy provides you with information, in accordance with Articles 13 and 14 of the GDPR, regarding the nature, scope, purposes and legal bases for the processing of your personal data, as well as your rights as a data subject in connection with the use of our platform suchen.expert.

1.3 This Privacy Policy applies to all data processing operations that take place when you visit and use suchen.expert. For other processing situations (for example, in the context of job applications, contractual relationships with business partners or other offline processes), we may provide separate privacy notices where applicable.

1.4 Use of suchen.expert requires that you acknowledge this privacy policy. However, the processing of your personal data takes place – depending on the specific process – on the respective legal basis stated (e.g. Article 6(1)(b) of the GDPR for contractual relationships or Article 6(1)(f) of the GDPR for legitimate interests). Where consent is required, this will be obtained separately.

1.5 The purpose of this privacy policy is to ensure transparent and appropriate protection of your personal data against unauthorised access, unauthorised disclosure, loss or misuse, and to inform you about our data processing in a clear and understandable manner.

1. 6 This Privacy Policy applies to all personal data that we collect, use or store about you in connection with your use of the suchen.expert platform.

1.7 If you do not consent to the data processing described in this privacy policy, you may not be able to use certain services or functions of suchen.expert, or may only be able to use them to a limited extent. Legal claims, in particular your rights as a data subject under the GDPR, remain unaffected by this.

1.8 This privacy policy applies exclusively to the suchen.expert platform. We accept no responsibility for the content and offers of third parties, to which we provide links or which are integrated via interfaces (e.g. external websites), we accept no responsibility. The processing of your data by such third parties is governed by their own privacy policies.

1.9 We provide technical and organisational means by which you can view and update your personal data in your user account. Nevertheless, you are required to ensure that the data you provide is accurate and up to date.

1.10 By registering or using the platform, users confirm that they have read and understood the privacy policy.

However, the processing of personal data takes place exclusively on the basis of the relevant statutory provisions or – where necessary – on the basis of consent obtained separately.

The current versions of the Privacy Policy, the General Terms of Use and any other Usage Guidelines are available at any time on suchen.expert.

§ 2 Definitions

In this Privacy Policy, the following terms – unless otherwise expressly stated – are used in accordance with the General Data Protection Regulation (GDPR):

2.1 ‘personal data’

Personal data means any information relating to an identified or identifiable natural person (Article 4(1) of the GDPR). A person is considered identifiable if they can be identified, directly or indirectly, in particular by association with a name, an identification number, location data, an online identifier or one or more specific characteristics (e.g. name, address, telephone number, email address, username, date of birth, payment details).

2.2 ‘Processing’

Processing means any operation or set of operations which is carried out on personal data, whether or not by automated means (Article 4(2) of the GDPR), such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2.3 “Data Subject”

A data subject is any identified or identifiable natural person whose personal data is processed by us.

2.4 “User”

A user is any person who visits the suchen.expert platform, registers an account or uses services provided by suchen.expert – regardless of whether they are an individual acting in a private capacity, a company or another organisation.

2.5 “Data controller”

The data controller is Suchen Technology GmbH, which, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4( 7 of the GDPR).

2.6 “Data Processor”

A data processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller (Article 4(8) of the GDPR).

2.7 “Profile”

“Profile” refers to the personal or business user area on suchen.expert, where the user can manage their details, post and view listings, and configure certain settings (e.g. contact details, visibility, notifications).

2.8 “Services”

Services are all functions and services provided by Suchen Technology GmbH via the platform, in particular the ability to search for, view or publish information about found, lost, missing or stolen items, listings, services, incidents and other content.

2.9 ‘Data’

Data comprises all information and content provided by users in the course of using suchen.expert (e.g. advertisement texts, images, messages), including personal data, insofar as this is contained within the information provided.

§ 3 Data Controller (Art. 4(7) GDPR)

3.1 Data Controller

The data controller for the processing of personal data on the suchen.expert platform within the meaning of the General Data Protection Regulation (GDPR) is:

Suchen Technology GmbH

Dieselstraße 11

30916 Isernhagen, Germany

Email: datenschutz@suchen.technology

The data controller determines the purposes and means of data processing. Data protection enquiries may be addressed at any time via the contact form or by post to the above address.

3. 2 Data Protection Officer

Under current legislation, Suchen Technology GmbH is not obliged to appoint a Data Protection Officer in accordance with Article 37 of the GDPR.

3.3 Competent supervisory authority

Without prejudice to your rights under Article 77 of the GDPR, you may lodge a complaint with a data protection supervisory authority. The competent authority for us is:

The State Data Protection Commissioner for Lower Saxony

Prinzenstraße 5

30159 Hanover

Telephone: +49 (0)511 120 45 00

Fax: +49 (0)511 120 45 99

Email: poststelle@lfd.niedersachsen.de

§ 4 Terms of Use relating to data protection

4.1 Registration and conditions of use

No registration is required to visit and use the publicly accessible areas of the platform.

4.2 Obligation to provide accurate and up-to-date information

The user undertakes to provide accurate, truthful and up-to-date personal data during registration and whilst using the platform. The user must update any changes to their profile themselves without delay.

4.3 Visibility of publicly shared data

Where the user voluntarily makes information or content (e.g. name, profile details, listings, texts, images, reviews) publicly available, this may be viewed, stored or shared by other users and – depending on visibility settings – also by internet users. The user bears responsibility for information published voluntarily.

4.4 Limitations on deletion

Certain content provided by the user cannot be completely deleted retrospectively if it has already been copied by other users or stored outside the platform. Statutory retention obligations remain unaffected.

4.5 Acknowledgement of the Privacy Policy

The user confirms that they have taken note of this Privacy Policy. The processing of personal data is however – depending on the specific process – on the relevant legal basis (Art. 6 GDPR). Where consent is required, this will be obtained separately and unambiguously.

4.6 Responsibility for information provided

Suchen Technology GmbH is under no obligation to verify the accuracy, completeness or timeliness of content provided by the user. Such verification shall only take place where required by law (e.g. to fulfil legal obligations) or where necessary to ensure the proper functioning of the platform.

4.7 Measures in the Event of Breaches

In the event of breaches of these terms and conditions – in particular in the case of false information, misuse or unlawful publications – Suchen Technology GmbH reserves the right to restrict or suspend user accounts or to remove content. Further legal claims remain unaffected.

§ 5 Purposes and Legal Bases for Data Processing

5.1 Overview

We process the personal data of users of suchen.expert for clearly defined purposes and on the basis of the legal grounds provided for in Article 6 of the GDPR. The most important purposes and legal grounds are summarised below. The relevant categories of personal data are described in § 6.

5.2 Contractual relationship and use of the platform (Article 6(1)(b) of the GDPR)

A key purpose of data processing is the initiation, conclusion, performance and termination of the user agreement relating to the suchen.expert platform. This includes, in particular:

- Registration and administration of the user account,

- Provision of platform functions (e.g. creating, managing and displaying listings, messaging functions, reviews),

- Processing of paid services, including invoicing and payment processing,

- Verification of accounts and identity, where necessary,

- Processing enquiries regarding existing contracts.

Without the processing of the data required for these purposes, use of the platform is either limited or not possible.

The above processing activities also include registration and authentication via external login services (e.g. Google),

 where such login procedures are offered.

5.3 Communication with users (Art. 6(1)(b) and (f) of the GDPR)

We process data to communicate with users, in particular:

- Responding to contact enquiries (e.g. via the contact form or by email),

- Support and technical assistance,

- Information on changes to services, functions or legal

frameworks.

Where the communication is directly related to an existing or proposed contractual relationship, the legal basis is Article 6(1)(b) of the GDPR. In all other cases, processing is carried out to safeguard our legitimate interests in appropriate and efficient communication (Article 6(1)(f) of the GDPR).

5.4 Operation, security and prevention of misuse

(Article 6(1)(f) of the GDPR)

To ensure the secure and stable operation of suchen.expert, we process technical data and log data (e.g. IP address, time of access, device and browser information) in order to:

- ensure the technical functionality of the platform,

- detect and rectify malfunctions and errors,

- prevent and investigate misuse or unlawful use,

- ensure the security of systems, networks and data.

Our legitimate interest in this regard lies in maintaining a secure, stable and fully functional online service.

This also includes the processing of technical security and abuse indicators to prevent automated mass registrations, unusual registration and deletion cycles, circumvention of technical safeguards, excessive server loads and any other misuse or unlawful use of the platform. To this end, the following may be processed in particular: the timestamps of security-related events, IP-based security events, device and browser information, rate-limiting events and pseudonymised identifiers may be processed.

5.5 Analysis, improvement and further development

(Article 6(1)(f) of the GDPR, or, where applicable, Article 6(1)(a) of the GDPR)

We process usage and behavioural data in aggregated or pseudonymised form in order to:

- better understand usage behaviour,

- continuously improve our services and develop new features,

- optimise the platform’s user-friendliness and performance.

Where cookies or similar technologies are used for this purpose that are not technically necessary (e.g. for analysis or marketing purposes), this is done exclusively on the basis of your consent (Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR). Furthermore, we base the analysis on our legitimate interest in ensuring our offering is economically viable and user-friendly (Article 6(1)(f) of the GDPR).

5.6 Marketing, newsletters and direct marketing

(Article 6(1)(a) and (f) of the GDPR, Section 7 of the Unfair Competition Act (UWG))

We may use your data for marketing and informational purposes, in particular:

- sending newsletters and informational emails about our products and services (only with prior consent, Article 6(1)(a) of the GDPR),

- personalised content and offers, provided you have consented to this,

- direct marketing to existing customers for our own similar products and services by email, subject to the conditions set out in Section 7(3) of the UWG (legitimate interest, Article 6(1)(f) of the GDPR).

You may object to the use of your data for direct marketing purposes at any time and withdraw any consent you have given (see Section 14 of this Privacy Policy, Article 21 of the GDPR).

5.7 Cooperation with partners and service providers

(Article 6(1)(b), (f) and, where applicable, (a) of the GDPR)

We work with selected service providers and partners to provide certain functions (e.g. payments, map and mapping services, analytics and marketing tools, app tracking). The processing of data is carried out:

- to fulfil the user agreement with you (Article 6(1)(b) of the GDPR),

- to safeguard our legitimate interests in the efficient and secure provision of services (Article 6(1)(f) of the GDPR),

- and – where necessary – on the basis of your consent (Article 6(1)(a) of the GDPR), in particular in the case of advertising IDs (e.g. GAID, IDFA),

app tracking and personalised advertising.

Further details on the tools and service providers used can be found in the relevant sections of this privacy policy (e.g. cookies, tracking tools, payment service providers).

5.8 Contact form and other forms of contact

(Article 6(1)(b) and (f) of the GDPR)

If you send us enquiries via the contact form, by email or by other means, we process your details (e.g. name, contact details, content of the enquiry) solely for the purpose of handling and responding to the enquiry and, where applicable, for follow-up enquiries.

The legal bases are:

- Article 6(1)(b) of the GDPR, provided the enquiry relates to an existing or prospective contractual relationship,

- Article 6(1)(f) of the GDPR, our legitimate interest in the proper handling of customer and user enquiries.

The data will be deleted as soon as the purpose of the processing no longer applies and there are no statutory retention obligations to the contrary.

5.9 Processing of location data (geolocation)

(Article 6(1)(b) and (f) of the GDPR, where applicable Article 6(1)(a) of the GDPR)

Where you use functions based on location information, we process location data (e.g. IP-based localisation, GPS data) in order to:

- display geographically relevant content and adverts to you,

- personalise search results and recommendations,

- carry out statistical analyses of the use of location-based features.

You can disable the transmission of precise location data via your device at any time in your browser or operating system settings.

The legal bases are:

- Article 6(1)(b) of the GDPR, insofar as the processing of location data is necessary for specific contractual functions,

- Article 6(1)(f) of the GDPR, our legitimate interest in providing a user-friendly, locally relevant service,

- and, where applicable, your consent under Article 6(1)(a) of the GDPR, insofar as we use location-based data for further personalised services.

5.10 Communication and notification tools

(Article 6(1)(b), (f) and, where applicable, (a) of the GDPR)

We use communication and notification tools (e.g. email, SMS, in-app or push notifications) to:

- send security-related notices, system messages or information about your account,

- inform you about new messages, activities or relevant changes on the platform,

- to provide you with marketing information, provided you have given your consent.

Security-related and contract-related messages are based on Article 6(1)(b) of the GDPR (performance of a contract) and Article 6(1)(f) of the GDPR (legitimate interest in security and user information) . For marketing communications, we obtain your consent in accordance with Article 6(1)(a) of the GDPR.

5.11 Cooperation with law enforcement and supervisory authorities

(Article 6(1)(c) and (f) of the GDPR)

We may transfer personal data to law enforcement or supervisory authorities where we are legally obliged to do so (Article 6(1)(c) of the GDPR) or where this is necessary to safeguard our legitimate interests (Article 6(1)(f) of the GDPR), e.g. to investigate cases of misuse, to defend against legal claims or to cooperate in administrative or judicial proceedings.

In this context, data will be stored for as long as is necessary to fulfil legal obligations or to establish, exercise or defend legal claims.

5.12 Legal obligations

(Article 6(1)(c) of the GDPR)

We are subject to various legal obligations which may require the processing of personal data. These include, in particular:

- retention periods under commercial and tax law,

- regulatory and reporting requirements,

- other legal documentation and evidence obligations.

In these cases, processing is carried out on the basis of Article 6(1)(c) of the GDPR.

5.13 Enforcement of rights and defence

(Article 6(1)( f of the GDPR)

We also process personal data in order to assert and enforce our rights and to defend ourselves against legal claims. This includes, for example:

- the preservation of evidence,

- the out-of-court and judicial enforcement of claims,

- the defence against unjustified claims.

The legal basis is Article 6(1)( f of the GDPR, namely our legitimate interest in safeguarding and enforcing our rights.

5.14 Consent and withdrawal

(Article 6(1)(a) of the GDPR)

Where we process data on the basis of your consent (e.g. for newsletters, certain marketing activities, location-based services, app tracking or personalised advertising), the processing is carried out exclusively for the purposes specified in the consent .

You may withdraw your consent at any time with effect for the future. This does not affect the lawfulness of the processing carried out prior to the withdrawal. Information on withdrawal can be found in this privacy policy as well as in the respective consent forms.

§ 6 Categories of personal data

Depending on your use of the platform and the functions you have activated, we process – the categories of personal data described below. Not all data is collected from every user.

6.1 Master data

This includes, in particular:

- Full name

- Address (primary), and any additional addresses where applicable

- Telephone number(s)

- Email address(es)

- Company-related data (e.g. company name, VAT number, commercial register details)

Depending on usage, this data is required for registration, identification, communication and the performance of the contract.

When using external login services, identification data transmitted by the respective provider may also be processed, in particular external user IDs, verified email addresses, profile names or profile pictures.

6.2 Contract and billing data

This includes, in particular:

- User account information

- Booking/service data

- Payment information (e.g. IBAN, invoices, transactions)

- Details of paid services booked

- Verification data (e.g. account/identity verification)

We process this data for the purposes of contract performance and billing.

6.3 Profile data and content provided by the user

This includes, in particular:

- Profile picture and other uploaded photos

- Public profile details and descriptive texts

- Listings (texts, images, categories, metadata)

- Reviews, star ratings, comments

- Interactions with other users (e.g. follows, subscriptions)

- Content shared via social media

This information is publicly visible, depending on its visibility settings.

6.4 Communication data

This includes:

- Messages via internal messaging functions

- Emails, support enquiries, contact forms

- Push notifications and system settings

- Verification codes (e.g. SMS or email for login)

This data is used for communication and account security.

6.5 Usage and behavioural data

This includes, in particular:

- Date and time of registration

- Login history, online status, activity logs

- Sections/categories visited and duration of visit

- Interactions with listings (creating, saving, sharing, clicking)

- Favourites lists

- Profiles followed and own followers

- User activity within the rating system

- Reports, complaints, disputes

- Invitations, referral codes, referrals

- Mentions by other users

This data is used to improve, analyse and personalise the platform’s features.

6.6 Location and geolocation data

This includes:

- IP-based approximate location determination

- Precise location data via device/operating system services (e.g. GPS),

provided the user has given their consent

- Time/region settings

We only process this data if you use the relevant functions or give your consent.

6.7 Technical data and server log data (web)

These include, in particular:

- Date and time of access

- Browser type and version

- Operating system type and version

- Browser language settings

- Referrer URL

- Hostname of the accessing device

- Screen resolution and device information

- User-agent data - Server request logs (“log files”)

This data is necessary for functionality, security and fault analysis.

6.8 Device data when using Android

If you use our Android app, the following

data may be processed, depending on the permissions granted by your device:

- Device type, device name, model

- Android operating system version

- Manufacturer ID (if provided by the system)

- GAID (Google Advertising ID) – only with consent

- OpenUDID or AppFlyer ID (only for authorised marketing tools)

- Time zone, preferred language

- Wi-Fi information (SSID, MAC address) – only if the OS transmits this

- Mobile network information (network operator, MNC)

- Type of internet connection (mobile/Wi-Fi)

- App version and technical device status

Some of these characteristics are considered unique identifiers under data protection law and may only be used for marketing or tracking purposes with your consent.

6.9 Device data for iOS - Usage

When using our iOS app, the following categories of data may be processed, depending on your settings:

- Device type, device name, model and OS version

- IDFA (Identifier for Advertisers) – only with consent / ‘App Tracking Transparency’

- OpenUDID/AppsFlyer UID (only if enabled)

- Time zone, preferred language

- Manufacturer’s device ID (where available)

- Wi-Fi information (SSID/MAC, only if permitted by the OS)

- Mobile network information (network operator, MNC)

- App version, technical status

The same applies here: advertising IDs may only be used with consent.

6. 10 Data from third-party sources and data generated by third parties

This may include, in particular:

- User feedback from other users (comments, reviews),

- Reports of breaches, complaints or disputes,

- Mentions and links within the platform,

- invitations or recommendations via referral systems,

- data from external login services or payment service providers,

- data from cooperation partners, insofar as this is necessary for the performance of the contract, fraud prevention, identity verification or the handling of support enquiries.

Where personal data is not collected directly from the data subject, but from third-party sources, we process such data only on the basis of a relevant legal basis. In such cases, the data subject will be informed, in accordance with Article 14 of the GDPR, of the data source, data categories, purposes of processing, legal bases and recipients, provided that no statutory exception applies.

6.11 Sensitive data (special categories of personal data)

We do not collect special categories of personal data within the meaning of Article 9 of the GDPR (e.g. health data, religious affiliation), unless the user voluntarily publishes such information in content or messages. Such publication is the sole responsibility of the user.

§ 7 Principles governing the processing of personal data

In all processing operations involving personal data, Suchen Technology GmbH complies with the legal principles set out in Article 5 of the GDPR.

These principles ensure the responsible and lawful handling of personal data.

7.1 Lawfulness, processing in good faith and transparency

Personal data is processed exclusively on a legal basis and only in a manner that is comprehensible and transparent to data subjects. Users are informed, in accordance with Articles 13 and 14 of the GDPR, about the purposes, legal bases, recipients, retention periods and their rights.

7.2 Purpose limitation

Data is collected only for specified, explicit and legitimate purposes. Further processing for other purposes takes place only if there is a legal basis or the user has given their consent.

7.3 Data minimisation

Only personal data necessary for the respective purposes is processed. The collection of data, its scope and the retention period are limited to what is strictly necessary.

7.4 Accuracy

Suchen Technology GmbH takes appropriate measures to ensure that the personal data processed is factually accurate and – where necessary – up to date. Users may update their data themselves in their profile at any time or request a correction (Art. 16 GDPR).

7.5 Storage limitation

Personal data is stored only for as long as is necessary for the purposes of processing or where statutory retention obligations apply. Thereafter, the data will be erased or anonymised (see Section 12 of this Privacy Policy).

7.6 Integrity and Confidentiality

We ensure, through appropriate technical and organisational measures, that personal data is protected against unauthorised or unlawful processing, and against accidental loss, destruction or damage. This includes, amongst other things, access restrictions, encryption technologies, logging, and security and authorisation policies.

7.7 Accountability

Suchen Technology GmbH is responsible for ensuring compliance with data protection regulations, and can demonstrate this where necessary (Art. 5(2) GDPR). This includes, amongst other things, the documentation of processing activities, risk analyses, technical and organisational measures, and data processing agreements.

7.8 No unauthorised data linking

Data sets collected for different, incompatible purposes are not merged. Data will only be combined if there is a legal basis for doing so or if the user has given their explicit consent.

7.9 Data protection through design and privacy-friendly default settings

The ‘Search for a platform’ expert is designed in such a way that data protection and data minimisation are taken into account at a technical level (Art. 25 GDPR). By default, only those functions necessary for normal use are activated (‘Privacy by Default’).

7.10 User responsibility

Users are responsible for the accuracy and visibility of the data they voluntarily publish (e.g. listings, photos, reviews). We recommend that users carefully consider what content they wish to make publicly available, particularly where sensitive data is concerned.

§ 8 Use of cookies and similar technologies

8.1 General information

Our website uses cookies and similar technologies (e.g. local storage, session storage, pixels, tracking codes) to provide certain functions, analyse usage and technically operate our service. Cookies are small text files that are stored on your device and do not contain any malicious programmes or viruses.

We distinguish between technically necessary cookies and those for which consent is required (Section 25 of the TDDDG and Article 6 of the GDPR).

8.2 Types of cookies and technologies

(1) Technically necessary cookies

These cookies are absolutely essential for the operation and basic functions of the website, e.g.:

- Login / session management

- Security functions

- Cookie consent management

- Language selection / default settings

Legal basis:

§ 25(2)(2) TDDDG (permitted without consent)

Art. 6(1)(f) GDPR (legitimate interest in the operation of the website)

(2) Functional cookies

Functional cookies and similar technologies enable certain settings, convenience features and optional website displays.

Where such technologies are technically essential for a service expressly service, we treat them as technically necessary.

Where they merely enable additional convenience or optional functions, we use them only on the basis of the relevant consent.

Legal basis:

Where functional technologies are strictly necessary for a service expressly requested by the user, their use is based on Section 25(2)(2) of the TDDDG and Article 6( 1(f) of the GDPR.

Where they merely provide additional convenience or optional functions, their use is based exclusively on your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.

(3) Analytics / statistics cookies

These are used to analyse user behaviour (e.g. page views, duration of use, click behaviour).

Legal basis:

Section 25(1) of the TDDDG + Article 6(1)(a) of the GDPR (only with consent)

(4) Marketing / tracking cookies

Enable personalised advertising, retargeting, the display of adverts or audience measurement across various services. Examples: Google Ads, Google AdSense, remarketing, Microsoft Advertising and app tracking.

Legal basis:

Section 25(1) of the TDDDG + Article 6(1)(a) of the GDPR (only with consent)

(5) Third-party cookies

These are set by external providers (e.g. analytics, marketing, map or video services) and may, where applicable, enable tracking across multiple websites.

(6) Session cookies

These are automatically deleted when the browser is closed.

(7) Persistent cookies

These remain stored for a defined period and enable recognition when you visit the site again.

(8) Secure cookies (Secure, HttpOnly)

These are transmitted exclusively via HTTPS and, in some cases, cannot be read via JavaScript ( protection against XSS).

8.3 Cookie Consent Tool

On your first visit to our website, a notification banner appears, allowing you to select, reject or later change non-essential cookies and similar technologies. Your selection is stored so that your consent preferences can be taken into account when you visit the site again.

Legal basis:

- Section 25(2)(2) of the TDDDG, insofar as storage or access is technically absolutely necessary to provide the consent management service expressly requested by the user,

- Article 6(1)(f) of the GDPR, insofar as the processing serves the legally compliant management and documentation of consents granted or refused.

The selection you have made is stored locally in your browser, so that your consent preferences can be taken into account when you visit the site again. In the current implementation, there is no server-side logging of your consent decision involving personal data.

You can change your selection at any time via our cookie consent tool or withdraw it with effect for the future. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

8.4 Management and withdrawal of consent for cookies

You can:

- disable all non-essential cookies in the consent banner,

- withdraw your consent at any time with future effect,

- manually delete cookies in your browser,

- configure cookie settings in your browser (blocking, exceptions).

Please note: Disabling technically necessary cookies may impair the functionality of the website.

8.5 Cloudflare Turnstile (CAPTCHA)

To protect our platform against automated requests, bots and misuse, we use the ‘Turnstile’ security and validation procedure, provided by:

Cloudflare, Inc.

101 Townsend St, San Francisco, CA 94107, USA

For EU/EEA data processing:

Cloudflare Portugal, Unipessoal Lda or other Cloudflare branches within the EU.

8.5.1 Nature of the processing

As part of the Turnstile service, Cloudflare processes certain technical information to assess whether access originates from a human or an automated system. The specific data processed depends on the technical procedures provided by Cloudflare. This may include, amongst other things:

- IP address

- Browser and device information

- Referrer URL

- Technical connection data

- Interaction and system signals automatically transmitted by the end device.

The actual processing is carried out by Cloudflare in accordance with its own technical procedures.

8.5.2 Purpose

The use of Turnstile serves to:

- Protect our website and forms against bots,

- Maintain the functionality of our services,

- Reduce abusive or harmful access attempts.

These measures are in line with our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

8.5.3 Legal basis

The use of Turnstile is based on our legitimate interest in the security, stability, functionality and prevention of misuse of the platform pursuant to Article 6(1)(f) of the GDPR.

Insofar as the service involves accessing information on the user’s terminal equipment or storing such information, this is done only to the extent permitted under Section 25 of the TDDDG.

8.5.4 Data transfer

Where personal data is transferred to recipients outside the EU/EEA in connection with Turnstile, this is done solely on the basis of the relevant data protection transfer mechanisms.

Where required by law, a copy of appropriate safeguards may be provided on request, provided that this does not infringe the rights of third parties.

8.5.5 Further information

Cloudflare’s privacy policy:

https://www.cloudflare.com/privacypolicy/

8.5.6 Note

Without Turnstile, the use of certain functions – in particular forms or registration – may be technically restricted.

8.6 Google Analytics (GA4)

We use the web analytics service Google Analytics (GA4) on our website, provided by:

Google Ireland Limited

Gordon House, Barrow Street

Dublin 4, Ireland

(“Google”)

8.6.1 Nature of data processing

Google Analytics uses technologies such as cookies, pixels or device-specific identifiers to analyse information about the use of our website. The specific data collected and how it is processed are determined by Google’s technical specifications. This may include, in particular:

- Page views, click and scroll behaviour

- Duration and frequency of sessions

- Browser and device information

- Operating system, language settings

- Referrer URL

- Timestamps and interaction events

- Truncated or anonymised IP addresses (where provided by Google)

The actual data processing is carried out by Google in accordance with its own technical procedures and settings.

8.6.2 Purpose

Google Analytics may be used to analyse the use of our website, measure reach and improve our online offering.

8.6.3 Legal basis

The use of Google Analytics takes place exclusively with your consent in accordance with:

- Section 25(1) of the TDDDG

- Article 6(1)(a) of the GDPR

Google Analytics is only used if the relevant consent has been given. The data is processed by Google and is subject to the technical mechanisms provided by Google.

8.6.4 Transfer to third countries

Where personal data is transferred to recipients outside the EU/EEA in connection with Google Analytics, this is done solely on the basis of the relevant data protection transfer mechanisms.

Where required by law, a copy of appropriate safeguards may be provided on request, provided that this does not infringe the rights of third parties.

8.6.5 Retention period

The retention period for event and usage data is configured to the minimum possible duration within the available settings of Google Analytics (currently a maximum of 14 months).

8.6.6 Withdrawal of consent

You may withdraw or amend your consent at any time via our cookie consent tool. The lawfulness of any processing carried out prior to withdrawal remains unaffected.

8.6.7 Google’s privacy policy

Further information on the processing of personal data by Google can be found at:

https://policies.google.com/privacy

8.7 Google Ads and Google Remarketing

Where we use Google Ads or Google Remarketing features on our website, these are only activated if you have given your consent to do so.

Google Ireland Limited

Gordon House, Barrow Street

Dublin 4, Ireland

8.7.1 Nature of the processing

Google may use various technologies to serve, measure or optimise adverts. The data processed in each individual case is determined by the processes defined by Google. This may include, amongst other things:

- information on pages visited and content accessed,

- details of interactions (clicks, page views, navigation behaviour),

- device and browser information,

- pseudonymous advertising IDs such as GAID or IDFA (only where consent has been given),

- technical meta-information,

- IP address (in accordance with Google’s settings).

Google uses this information, amongst other things, to personalise adverts, measure reach or create target groups.

8.7.2 Purpose

Where provided by Google and requested by you, the data may be used for the following purposes:

- Displaying relevant and interest-based advertising,

- Analysing and measuring the success of advertising campaigns (conversion tracking),

- Creating pseudonymous target groups for remarketing.

8.7.3 Legal basis

Any use of Google Ads and remarketing takes place exclusively with your consent, in particular for the use of cookies and similar technologies in accordance with:

- Section 25(1) of the TDDDG

- Article 6(1)(a) of the GDPR

These services will not be activated without your consent.

8.7.4 Transfer to third countries

Where personal data is transferred to recipients outside the EU/EEA in connection with Google Ads or Google Remarketing, this is done solely on the basis of the relevant data protection transfer mechanisms.

Where required by law, a copy of appropriate safeguards may be provided on request, provided that this does not infringe the rights of third parties.

8.7.5 Withdrawal of consent / Opt-out

You may withdraw your consent at any time via our cookie consent tool. Google also offers its own opt-out options:

- https://adssettings.google.com

- https://optout.networkadvertising.org/

8.7.6 Google’s privacy policy

Further information on data processing by Google can be found at:

https://policies.google.com/privacy

8.8 Google AdSense

We use Google AdSense on our website, a service for displaying advertisements provided by:

Google Ireland Limited

Gordon House, Barrow Street

Dublin 4, Ireland

(“Google”).

Google AdSense enables us to display adverts from Google and other advertising partners on our platform.

8.8.1 Nature of data processing

When accessing pages on which Google AdSense is integrated, the following data in particular may be processed – depending on the consent given and the functions provided by Google:

- IP address and approximate location information derived from it,

- URL accessed and referrer URL,

- browser, device and operating system information,

- date and time of access,

- information about adverts displayed and interactions with these adverts,

- pseudonymous identifiers,

- information from cookies or similar storage and access technologies.

The specific processing and selection of the technologies used depend on Google’s technical settings and on the choices you have made in the cookie consent tool.

8.8.2 Purposes of processing

Processing may serve the following purposes in particular:

- Display and technical delivery of advertisements,

- Selection of context-based advertising,

- Measurement of advertising performance and reach,

- Limiting the frequency of certain advertisements,

- Compiling advertising and performance statistics,

- Detecting and preventing fraud, misuse and unauthorised access,

- Where expressly consented to: personalisation of advertisements.

8.8.3 Legal basis and consent

Where Google AdSense stores cookies or similar technologies on your device or accesses information stored there, this is done on the basis of your consent in accordance with Section 25(1) of the TDDDG.

The associated processing of personal data is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.

Google AdSense is only activated on our platform once you have consented to the relevant marketing and advertising technologies via our cookie consent tool.

Without this consent, Google AdSense will not be loaded or activated by our platform.

8.8.4 Recipients and data controller

Recipients of the data may include Google and other advertising technology providers involved in the display of the advertisements technology providers involved in the display of advertisements.

Google and other providers involved may process personal data under their own data protection responsibility, insofar as they themselves determine the purposes and means of the respective processing.

8.8.5 Data transfer to third countries

Where, in connection with Google AdSense, personal data is transferred to recipients outside the European Union or the European Economic Area, this takes place only on the basis of the relevant data protection transfer .

Where required by law, a copy of appropriate safeguards may be provided on request, provided this does not infringe the rights of third parties.

8.8.6 Withdrawal of consent

You may amend or withdraw your consent at any time with future effect via our Cookie Consent Tool.

The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.

You can adjust additional settings for the personalisation of adverts in Google’s ad settings.

8.8.7 Further information

Further information on the processing of personal data by Google can be found at:

https://policies.google.com/privacy

Information on how Google uses data from websites and apps that utilise Google services can be found at:

https://policies.google.com/technologies/partner-sites

Google advertising settings:

https://adssettings.google.com

8.9 Google Consent Mode v2

We use Google Consent Mode v2 to adapt the integration of certain Google services (e.g. Analytics, Ads, conversion tracking, remarketing) to your chosen consent status. The technical processes of Consent Mode v2 are provided and controlled by Google.

8.9.1 How it works

Consent Mode v2 enables Google to adapt the processing of certain data to the user’s consent status. In doing so, Consent Mode transmits signals such as:

- ad_user_data (granted / denied)

- ad_personalization (granted / denied)

The actual data processing, its scope and the type of information collected are determined by Google and the relevant Google services used. Google adapts its systems in line with the consent settings you have selected.

8.9.2 Purpose

Consent Mode may be used to:

- technically implement your consent decision,

- adapt the integration of Google services to your preferences,

- enable the data protection-compliant control of certain Google functions.

8.9.3 Legal basis

Where Google services use storage technologies or tracking, this is done exclusively on the basis of your consent in accordance with:

- Section 25(1) of the TDDDG

- Article 6(1)(a) of the GDPR

Consent Mode itself constitutes a technical interface for implementing your decision.

8.9.4 Data transfer

Where personal data is transferred to recipients outside the EU/EEA within the framework of Google Consent Mode v2, this takes place solely on the basis of the relevant data protection transfer mechanisms.

Further processing of this information is carried out by the relevant Google services in accordance with their respective data protection responsibilities.

8.9.5 Withdrawal

You may amend or withdraw your consent at any time via our cookie consent tool. Google implements changes to consent in accordance with its technical specifications.

8.9.6 Further information

Google’s privacy policy:

https://policies.google.com/privacy

Further information on Consent Mode:

https://support.google.com/google-ads/answer/13515783

8.10 Apple App Tracking Transparency (ATT)

Where we provide an iOS app and use tracking functions within it, this is done – where necessary – only with your consent, using the functions provided by Apple as part of the ‘App Tracking Transparency’ (ATT) framework.

Apple Inc.

One Apple Park Way

Cupertino, CA 95014

USA

8.10.1 How it works

Within the ATT framework, Apple itself determines the conditions under which apps are permitted to access certain device information.

iOS devices display a consent pop-up for this purpose, which is controlled and managed by Apple. The data that Apple collects or provides in this context depends on the user’s settings and those of the operating system. This may include, amongst other things:

- the Advertising Identifier (IDFA),

- device-related information,

- system-level signals for attribution and reach measurement,

- cross-app interactions, to the extent permitted by Apple.

8.10.2 Data processed

The specific data processed in each individual case depends on the technical mechanisms provided by Apple and the settings of the end device. Depending on the consent given, Apple may share certain information, e.g.:

- IDFA (if permitted by the user),

- device and system information,

- anonymous or pseudonymous attribution data,

- interaction and usage events.

8.10.3 Purpose

The data provided via ATT may – depending on your consent and the functions of the end device – be used for the following purposes:

- Measuring app installations and campaign reach,

- Attribution purposes and technical analysis,

- Optional: personalised advertising (only with consent).

8.10.4 Legal basis

Where personal data is processed via ATT, this is done exclusively on the basis of your consent (Art. 6(1)(a) GDPR, § 25 TDDDG).

The actual processing is carried out by Apple in accordance with its own data protection guidelines.

8.10.5 Withdrawal

You can withdraw or amend your consent at any time via the iOS settings under ‘Settings → Privacy → Tracking’.

8.10.6 Apple privacy notices

Further information:

https://www.apple.com/legal/privacy/

8.11 Android app tracking and Google Advertising ID (GAID)

Where we provide an Android app, this may – provided you give your consent – access functions provided by Google as part of the Google Advertising ID (GAID).

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland.

8.11.1 Identifiers processed

The specific data that may be processed in each individual case depends on the settings of your Android device, the technology provided by the operating system, and the consent you have given.

Depending on the system configuration, this may include, amongst other things:

- Google Advertising ID (GAID),

- device information (model, OS version, language/region),

- basic usage and interaction signals,

- technically provided attribution and installation data.

The actual provision and processing of this information is carried out by Google or Android at system level.

8.11.2 Purpose

Where the GAID or associated data is made available by the system, this may – depending on your consent and the device settings – be used for the following purposes:

- technical attribution and installation measurement,

- analysis of app usage in anonymised or pseudonymised form,

- optional: personalised advertising (only where consent has been given).

8.11.3 Legal basis

Where personal data is processed via the GAID, this is done exclusively on the basis of your consent in accordance with:

- Article 6(1)(a) of the GDPR

- Section 25(1) of the TDDDG

The actual technical processing of data is carried out by Google in accordance with its own privacy policy.

8.11.4 Withdrawal of consent / device settings

You can adjust or disable the provision and use of the GAID at any time in the settings of your Android device:

Settings / Google / ‘Advertising’ / ‘Ads’ –

‘Reset advertising ID’ or ‘Disable personalised advertising’.

8.11.5 Further information

Further information on data processing by Google can be found at:

https://policies.google.com/privacy

8.12 Server-side tracking / server-side tagging

Where we use server-side tracking technologies, these may include, for example, server-side tagging systems, a server-side Google Tag Manager or similar technical solutions.

8.12.1 How it works

With server-side tracking, certain requests are not sent directly from the user’s device to external providers, but are routed via an intermediate technical step. The actual nature of the processing depends on the respective technical settings and the mechanisms of the services used. Which data is further processed or transmitted depends, in particular, on your consent and the specifications of the respective third-party providers.

8.12.2 Data that may be processed

Depending on your consent and the services used, the following information, amongst others, may be processed via the server-side approach:

- technical information provided by the system

(e.g. device or browser data),

- usage events and interaction signals,

- pseudonymous identifiers or comparable technical characteristics (only where consent has been given for this),

- technically necessary meta-information.

The specific data processing is carried out in accordance with the specifications of the respective third-party providers (e.g. Google, Microsoft).

8.12.3 Purpose

Any use of server-side systems serves, amongst other things, the following purposes:

- technically optimised execution of analysis and marketing functions,

- improvement of the stability and reliability of measurement processes,

- reduction of direct connections between end devices and third-party providers.

8.12.4 Legal basis

The legal basis depends on the purpose of the data processing:

- for technically necessary processing: Article 6(1)(f) of the GDPR,

- for analysis, statistical and marketing purposes: exclusively with consent

 in accordance with Section 25(1) of the TDDDG in conjunction with Article 6( 1(a) of the GDPR.

8.12.5 Disclosure to third-party providers

Data will only be transferred to analytics or marketing services (e.g. Google, Microsoft) if you have given your consent for this. Further processing is carried out by the respective providers on their own responsibility.

8.12. 6 Transfers to third countries

Where personal data is transferred to recipients outside the EU/EEA as part of server-side tracking or tagging processes, this is done solely on the basis of the relevant data protection transfer mechanisms.

Where required by law, a copy of appropriate safeguards may be provided on request, provided that this does not infringe the rights of third parties.

8.13 Microsoft Advertising / Universal Event Tracking (UET)

Where we use Microsoft Advertising features, including Universal Event Tracking (UET), these will only be activated if you have given your consent to do so.

Microsoft Corporation

One Microsoft Way, Redmond, WA 98052-6399, USA

For the EU/EEA:

Microsoft Ireland Operations Limited

One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland The specific technical processing is carried out by Microsoft in accordance with the systems and mechanisms provided by Microsoft.

8.13.1 Nature of the processing

Microsoft may use various technologies, such as cookies, pixels or similar identifiers, to carry out advertising and analytics functions.

The data collected or processed in each individual case is determined by Microsoft’s technical specifications. This may include, amongst other things:

- IP address (as determined by Microsoft’s systems),

- browser and device information,

- interaction and usage data (e.g. pages visited, click behaviour),

- pseudonymous Microsoft advertising IDs or comparable identifiers,

- technical meta-information (timestamps, referrers, access events).

Microsoft is solely responsible for the further processing of this information.

8.13.2 Purpose

Where you have requested it and Microsoft has made it available, the data may be used for the following purposes:

- Measuring the success and analysing advertising campaigns (conversion tracking),

- Measuring reach,

- Creating pseudonymous target groups (remarketing),

- serving of interest-based advertising (only with consent).

8.13.3 Legal basis

Any use of Microsoft Advertising / UET is based exclusively on your consent:

- Section 25( 1 TDDDG (storage and access technologies),

- Article 6(1)(a) of the GDPR (consent).

Without your consent, the relevant functions will not be activated.

8.13.4 Transfers to third countries

Where personal data is transferred to recipients outside the EU/EEA in connection with Microsoft Advertising / UET, this is done solely on the basis of the relevant data protection transfer mechanisms.

Where required by law, a copy of appropriate safeguards may be provided on request, provided that this does not infringe the rights of third parties.

8.13.5 Withdrawal / Opt-out

You may amend or withdraw your consent at any time via our cookie consent tool. In addition, Microsoft provides its own options for deactivation:

https://account.microsoft. com/privacy/ad-settings/signedout

8.13.6 Microsoft’s privacy information

Further information on data processing by Microsoft can be found at:

https://privacy.microsoft.com/de-de/privacystatement

8.14 PayPal (payment service provider)

Where PayPal is offered as a payment method on suchen.expert, payments may be processed via the PayPal service. The provider is:

PayPal (Europe) S.à r.l. et Cie, S.C.A.

22–24 Boulevard Royal

L-2449 Luxembourg

(“PayPal” )

8.14.1 Nature of data processing

If PayPal is offered as a payment method and you choose PayPal, certain data relating to the payment will be transmitted to PayPal. The specific data involved is determined by the input fields in the relevant payment form and by the interface provided by PayPal. This may include, in particular:

- Name,

- address,

- email address,

- telephone number (if applicable),

- payment details (e.g. account details, card details, transaction amounts, contract or order information),

- other data required to process the payment.

The actual processing of this data is carried out by PayPal on its own responsibility in accordance with its technical procedures and contractual terms.

8.14.2 Purpose

Where PayPal is offered as a payment method and you choose PayPal, the data is transferred for the purpose of carrying out and processing the payment transaction you have selected, as well as, where applicable, for fraud prevention and risk assessment by PayPal.

8.14.3 Legal basis

The legal basis for any transfer of data to PayPal is generally Article 6(1)(b) of the GDPR (performance of a contract, payment processing). Insofar as PayPal carries out its own risk, creditworthiness or fraud checks, the processing may be based on the legitimate interests of PayPal and ourselves in secure and efficient payment processing (Article 6(1)(f) of the GDPR) .

8.14.4 PayPal’s independent responsibility

Where PayPal is used, PayPal processes the transferred data under its own responsibility under data protection law. PayPal may use the data, amongst other things:

- to execute and process payments,

- to carry out creditworthiness and identity checks,

- for fraud prevention and risk analysis,

- to comply with legal obligations.

PayPal may disclose data to affiliated companies, external service providers or credit reference agencies (e.g. commercial credit reference agencies), insofar as this is necessary for the performance of the contract or on the basis of its own legal grounds.

PayPal’s privacy policy applies exclusively to these processes.

8.14.5 Transfer to third countries

Where PayPal, its affiliated companies or service providers engaged by PayPal process personal data outside the EU/EEA or access such data, this is done solely on the basis of the relevant data protection transfer mechanisms.

Where required by law, a copy of appropriate safeguards may be provided upon request, provided this does not infringe the rights of third parties.

8.14.6 Voluntary use / Alternatives

Where PayPal is offered as a payment method, its use is voluntary. Where we offer alternative payment methods, you may choose these if you do not wish to transmit any data to PayPal.

8.14.7 Further information

For details on data processing by PayPal, please refer to PayPal’s privacy policy:

https://www.paypal.com/de/webapps/mpp/ua/privacy-full

8.15 General note on technical data processing by third-party providers

Where third-party services (e.g. Google, Apple, Microsoft, Cloudflare, PayPal) , the respective data processing takes place within the framework of the technical integration selected by us and the functions provided by the respective provider.

The nature, scope and technical design of the processing may vary in detail depending on the specific service used, the user’s settings, the device used and the technical parameters of the third-party provider.

The description of the respective processing operations in this privacy policy is based on our current knowledge and on the provider information and documentation available to us.

Where third-party providers process data under their own responsibility under data protection law, their respective privacy policies shall apply in addition.

§ 9 Collection and Disclosure of User Data to Third Parties

9.1 Collection of Personal Data

We collect users’ personal data in the following circumstances:

a) Registration and Account Creation

When registering a user account, we request the information necessary for setting up and using the account (e.g. name, email address, password, and any other mandatory details where applicable).

b) Login and authorisation

Each time a user logs in, technical data (e.g. IP address, time, device/browser information) and account data are processed to secure access and manage the session.

c) Profile maintenance and voluntary information

After registration, users may voluntarily add or amend additional details in their profile (e.g. further contact details, profile photo, company details). This data is processed only to the extent that the user actively provides it.

d) Use of services and functions

When using the platform (e.g. when creating listings, submitting reviews, sending messages), the data entered or generated in the process is processed.

e) Communication

When enquiries are made via contact forms, emails or other communication channels, we process the data provided (e.g. name, contact details, content of the message) for the purpose of handling the enquiry.

f) Automated collection of technical data

When visiting the website and using the app, technical data (e.g. IP address, browser type, operating system, referrer URL, date and time of access) as well as log files (see Section 6.7 of this Privacy Policy).

g) Registration via Google (social login)

Users can also register or log in to the platform using an existing account with an external provider (so-called ‘social login’), currently via Google in particular.

If the user utilises this function, we receive from Google the personal data required for authentication and for setting up or assigning the user account. This may include, in particular:

- name,

- email address,

- unique external user identifier (e.g. Google ID),

- profile picture, if applicable, provided the user has shared this with Google.

The specific data transmitted depends on the settings of the Google account and the permissions granted by the user.

The processing is carried out for the purposes of registration, authentication, account assignment, account linking, account management and the secure provision of the platform’s functions.

The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of the user relationship, and Article 6(1)( f of the GDPR with regard to ensuring system security, preventing misuse and efficient login management.

A technical link may exist between your user account with us and your Google Account. Where technically possible, the user may manage or remove this link in their user account with us or via Google’s settings.

Removing the link to Google does not automatically result in the deletion of the user account on our platform. The provisions of Section 12 and the rights under Article 17 of the GDPR apply to the deletion of the user account.

Google processes personal data as part of the social login procedure under its own responsibility under data protection law. Google’s privacy policy applies exclusively to data processing by Google.

h) Collection of personal data from third-party sources

Where personal data is not collected directly from the data subject but via other users, cooperation partners, payment service providers, external login services or other third-party sources, we process this data only to the extent that there is a legal basis for doing so.

This may include, in particular, identification data, contact details, transaction and communication data, review, complaint or report data, as well as other data necessary for handling a specific matter.

Processing takes place, in particular, for the purposes of contract performance, account allocation, handling complaints, reports or support enquiries, preventing misuse, and safeguarding the security and integrity of the platform.

The legal basis is – depending on the individual case – Article 6(1)(b), (c) or (f) of the GDPR.

In such cases, the data subject shall be informed, in accordance with Article 14 of the GDPR, of the source of the data, the categories of data concerned, the purposes, the legal bases and the recipients of the processing, provided that no statutory exception applies.

9.2 Storage and processing

Personal data is predominantly processed electronically and stored on servers within the EU or the EEA. Processing is carried out automatically or – in individual cases – manually, e.g. as part of support or audit processes.

We implement appropriate technical and organisational measures to protect the data against unauthorised access, loss, destruction or alteration.

The retention period depends on the purposes of the processing and the statutory retention obligations (see Section 12 of this Privacy Policy).

9.3 Principle: No disclosure without a legal basis

Personal data will only be disclosed to third parties if:

- this is necessary for the performance of a contract with the user (Article 6(1)(b) of the GDPR),

- we are legally obliged to do so (Article 6(1)(c) of the GDPR),

- the disclosure is necessary to safeguard our legitimate interests and there are no overriding interests of the users that prevent this (Article 6(1)(f) of the GDPR),

- or the user has given their explicit consent (Article 6(1)(a) of the GDPR).

There is no ‘sale’ of personal data for the independent marketing purposes of third parties without a legal basis.

9.4 Use of service providers (Data processors)

We use external service providers who process personal data on our behalf and in accordance with our instructions (Article 28 of the GDPR), e.g.:

- hosting and cloud providers,

- email/newsletter service providers,

- payment service providers (insofar as they act as data processors),

- technical support and maintenance service providers,

- analytics and tracking service providers (only with consent).

We enter into data processing agreements with all data processors, which specifically govern data security, confidentiality and compliance with our instructions.

9.5 Independent data controllers (third parties with their own responsibility)

In certain cases, data is transferred to third parties who process it under their own responsibility under data protection law, e.g.:

- payment service providers (e.g. PayPal), banks,

- tax advisers, solicitors,

- platform and cooperation partners with their own contractual relationship with the user,

- app stores (Apple, Google), where users purchase services via these platforms.

These third parties’ own privacy policies apply to the processing carried out by them.

9.6 Disclosure within group and partner structures

Where we collaborate with affiliated companies or selected partners (e.g. for technical provision, fraud prevention or billing purposes), personal data may be disclosed to them provided that:

- this is necessary for the performance of a contract (Article 6(1)(b) of the GDPR),

- or there is a legitimate interest (Article 6(1)(f) of the GDPR),

- and – where necessary – appropriate safeguards are in place for any transfers to third countries

(e.g. standard contractual clauses, the EU-US Data Privacy Framework).

Any further use of the data by these organisations for their own purposes will only take place if there is a separate legal basis (e.g. consent).

9.7 Disclosure to authorities and for law enforcement

We may transfer personal data to authorities, courts or other public bodies if we are legally obliged to do so (Article 6(1)(c) of the GDPR) or if this is necessary for the establishment, exercise or defence of legal claims (Article 6(1)(f) of the GDPR).

This includes, in particular:

- requests for information from law enforcement authorities,

- cooperation in civil or administrative proceedings,

- investigation of cases of misuse or fraud.

9.8 Visibility and publication of profile data

Certain information provided by the user may – depending on their settings – be visible to other users or publicly, e.g.:

- name or profile name,

- profile picture,

- town/region,

- date of registration,

- listings (e.g. in the sections ‘Found, Lost, Free, Incidents, Services, Swaps’),

- reviews, reviews, follower/subscriber counts.

Where the user publishes content in public areas of the platform, this may also be found, stored and redistributed via search engines. Responsibility for the publication of such content lies with the user.

Users can control the visibility of certain information via the privacy settings in their user account, provided that such settings are available.

9.9 Special categories of personal data

We ask users not to publish any special categories of personal data within the meaning of Article 9 of the GDPR (e.g. information relating to health, racial or ethnic origin, political opinions, religious or philosophical beliefs, or sexual orientation).

If users nevertheless voluntarily provide such information in listings, profiles or messages, they do so at their own risk. Please note that once information has been made public, it may be viewed, copied or disseminated by third parties, and we cannot completely prevent this.

9.10 User control and consequences of non-provision

Users generally have control over what voluntary information they provide in their profile or in advertisements, and what information they make available to third parties.

However, the provision of certain personal data is necessary for the use of the platform or individual functions (e.g. registration details, contact details for contract processing). Without this data, we cannot provide the relevant services, or can only do so to a limited extent.

Where processing is based on consent, this is voluntary. However, withdrawal of consent only takes effect for the future; certain functions based on consent (e.g. newsletters, personalised advertising) may then no longer be available.

§ 10 Recipients of personal data

10.1 Internal access within Suchen Technology GmbH

Within our company, only those departments and employees who require personal data to fulfil their duties are granted access. These include, in particular:

- Customer service and support

- Technical development/operations (IT)

- Accounting/finance

- Legal/compliance

- Product management and quality assurance

Access is granted in accordance with the ‘need-to-know’ principle and is subject to strict internal data protection and security policies.

10.2 External service providers (data processors – Art. 28 GDPR)

We use carefully selected external service providers who process personal data on our behalf, e.g.:

- hosting and cloud providers

- email and newsletter service providers

- technical maintenance and IT security service providers

- payment service providers (insofar as they act as data processors)

- analytics/tracking/marketing service providers (only with consent)

These service providers are contractually obliged:

- to process data exclusively in accordance with our instructions,

- to implement appropriate technical and organisational measures (TOMs),

- not to use the data for their own purposes.

10.3 Independent data controllers (own responsibility)

Some partners do not act as data processors but bear the data protection responsibility for the processing themselves. Examples:

- Payment service providers (e.g. PayPal)

- Banks

- Solicitors, tax advisers

- App store providers (Apple, Google)

- Cooperation partners with their own contractual relationship with the user

- Advertising, analytics and audience measurement providers, insofar as they process personal data for their own purposes and under their own responsibility under data protection law

The data protection provisions of the respective third parties apply to these processing operations.

10.4 Disclosure to advisers and auditing bodies

In individual cases, it may be necessary to disclose personal data to persons bound by professional secrecy, e.g.:

- Auditors

- Tax advisers

- Solicitors

These individuals are subject to statutory duties of confidentiality and process the data solely for the purpose of fulfilling their advisory duties.

10.5 Disclosure to public authorities and courts

We may transfer personal data to public authorities or courts if we:

- are legally obliged to do so (Article 6(1)(c) of the GDPR),

- or where the data is necessary for the establishment, exercise or defence of legal claims

(Article 6(1)(f) of the GDPR).

10.6 Transfer to partner companies

Where necessary for the technically secure provision of the platform, for fraud prevention or to fulfil contractual obligations, data may be transferred to affiliated companies or technical partners. No further use for their own purposes shall take place without a separate legal basis or consent.

10.7 Security measures during transmission

We implement appropriate technical and organisational measures for every data transfer, e.g.:

- encrypted transmission channels (TLS/HTTPS),

- access controls,

- contractual safeguards (e.g. standard contractual clauses for transfers to third countries), - regular security audits of service providers.

§ 11 Users’ rights (data subjects’ rights)

Users of the suchen.expert platform – as data subjects within the meaning of the GDPR – have the following rights. These may be exercised at any time via the contact details provided in this privacy policy.

11.1 Access to one’s own data (Art. 15 GDPR)

Users can view the information they . Furthermore, they have the right to obtain from us information regarding all personal data processed.

11.2 Rectification and updating (Art. 16 GDPR)

Users may correct or update their personal data themselves at any time via their account. Furthermore, they may request the rectification of inaccurate data at any time.

11.3 Erasure (‘right to be forgotten’, Art. 17 GDPR)

The user may request the erasure of their personal data, provided this is not prevented by statutory retention obligations or legitimate interests. Content that has been copied or archived by other users may not be able to be removed in its entirety.

11.4 Restriction of processing (Art. 18 GDPR)

Under certain conditions, the user may request the restriction of the processing of their data, e.g. if its accuracy is disputed or the data is no longer required.

11.5 Data portability (Art. 20 GDPR)

Users may request to receive their personal data in a structured, commonly used and machine-readable format, or to have it transferred directly to another controller.

11.6 Right to object (Art. 21 GDPR)

Users may object at any time to the processing of personal data, provided that such processing is based on Article 6(1)(f) of the GDPR (legitimate interests).

In the case of direct marketing in particular, there is an absolute right to object.

11.7 Withdrawal of consent (Art. 7(3) GDPR)

Consent that has been given (e.g. to cookies, tracking, newsletters) may be withdrawn at any time with effect for the future. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

11.8 Responsibility for published content

Users are personally responsible for the content they make publicly available (e.g. advertisements, photos, reviews). We recommend carefully consider what information is shared in publicly accessible areas.

11.9 Responsibility for account security

The user is obliged to keep their password confidential and to notify us immediately if they suspect unauthorised use of their account.

11.10 Visibility via interfaces

The user is aware that information they make publicly available is accessible to other users and, where applicable, internet users. This also includes sharing via interfaces, social media links or search engines.

11.11 No liability for the actions of third parties

We accept no liability for the use or further dissemination of publicly shared data by other users or third parties. Users themselves determine the visibility of their data.

§ 12 Duration of data storage and erasure of personal data

12.1 Principle: Storage only for as long as necessary

As a general rule, we process and store personal data only for as long as is necessary for the respective purposes (Art. 5(1)(e) GDPR). This also includes periods relating to the initiation of a contract, the performance of a user relationship and the settlement of matters following the termination of the contract.

12.2 Statutory retention obligations

Irrespective of the respective purpose of processing, statutory retention obligations may require data to be stored for a longer period.

12.3 Retention for the purposes of enforcing legal rights

Data may also be stored for the purpose of preserving evidence in accordance with the statutory limitation periods (Sections 194 et seq. of the German Civil Code (BGB)).

The standard limitation period is 3 years; in specific cases, periods of up to 30 years may apply.

12.4 Erasure upon request

Upon request, we shall delete personal data without delay, provided that:

- there is no statutory ground for retention,

- there are no legitimate interests in further processing (e.g. the assertion of claims),

- or the data is not required for the performance of a contract or for system security.

Where statutory retention obligations apply, the data will be blocked.

12.5 Regular review

We regularly review whether personal data is still required. Data for which there is no longer a purpose and which is not subject to any retention obligation will be deleted or anonymised.

12. 6 Withdrawal and Objection

If you exercise your right to withdraw consent (Art. 7(3) GDPR) or your right to object (Art. 21 GDPR), we will delete the data in question, unless there are compelling legitimate grounds or legal obligations to the contrary.

12. 7 Deletion upon termination of the business relationship

Following the closure of a user account, personal data will be deleted as soon as:

- there are no longer any contractual or statutory obligations,

- and no further claims are to be expected.

12.7a Disconnection of external login services

Disconnecting a linked external login service (e.g. Google) is not equivalent to the deletion of the user account.

The user account and the personal data it contains will only be deleted, blocked or anonymised as part of an account deletion in accordance with this Privacy Policy, provided that no statutory retention obligations or legitimate interests prevent this.

12.7b Pseudonymised blocking and security features following account deletion

Following the deletion of a user account, personal profile data, voluntary information and publicly visible account content will be deleted, blocked or anonymised, provided that there are no statutory retention obligations, contractual processing purposes or legitimate interests that prevent this.

 and re-registration cycles, the circumvention of technical safeguards, and to ensure IT and platform security, we may, however, store pseudonymised technical blocking and security measures for a limited period. These may include, in particular, hashed identifiers from external login services, hashed email addresses, the times of registration and account deletion, rate-limiting events, indicators of misuse and security-related technical log data.

12.8 Restrictions due to backups and archiving systems

Data contained in backups can only be removed as part of regular deletion cycles. Until they are finally deleted, this data remains restricted and is not further processed.

12.9 Notification obligations under Article 19 of the GDPR

Where personal data has been erased, rectified or restricted, we shall – where required by law – also inform recipients to whom this data has been disclosed.

12.10 Right to be forgotten (Article 17(2) of the GDPR)

Where personal data has been made public and erasure is requested, we shall, within the limits of what is technically reasonably feasible to inform third parties processing this data of the request for erasure.

12.11 Note on data security during transmission

Data transmissions over the internet may be subject to security vulnerabilities despite comprehensive security measures. Absolute protection against access by third parties is not technically possible.

§ 13 Data security

13.1 General protective measures

We implement comprehensive technical, organisational and legal measures to protect personal data from unauthorised access, loss, alteration, destruction or other security risks (Art. 32 GDPR).

13.2 Technical and organisational measures (TOM)

The measures implemented include, amongst others:

- Encryption of data transmission via TLS/HTTPS

- Access restrictions and role/permission frameworks

- Secure password and authentication procedures

- Logging of access events

- Regular software and security updates

- Protection against malware and attacks (e.g. firewalls, anti-DDoS)

Please note that data transmissions via email may be subject to technical security vulnerabilities. It is not possible to provide complete protection against access by third parties.

13.3 Authorisation and login

Login to suchen.expert is carried out using the email address provided by the user.

The user is obliged to keep their login details confidential and to report any unauthorised use immediately.

13.4 Data integrity and up-to-date status

We ensure that personal data is kept complete, accurate and up to date. Users may update their data themselves at any time or request a correction (Art. 16 GDPR).

13.5 Training and Awareness

Staff who have access to personal data receive regular training on data protection and information security.

13.6 Monitoring, Audits and Incident Response

Security incidents are documented and analysed.

13.7 Erasure and storage management

Personal data is stored only for as long as is necessary for the purposes for which it is processed or as required by law (see Section 12) . Once the retention periods have expired, they are securely deleted or anonymised.

13.8 Data processors

Third parties who process personal data on our behalf are selected subject to strict data protection requirements and are contractually bound in accordance with Article 28 of the GDPR.

13.9 Backup and recovery procedures

We create regular backups, which are stored exclusively in secure system environments. Structured recovery procedures are in place for emergencies to enable operations to resume quickly.

§ 14 Your rights as a data subject

As a data subject within the meaning of the GDPR, you are entitled to the following rights. You may exercise these rights at any time using the contact details provided in this privacy policy.

14. 1 Right of access (Art. 15 GDPR)

You have the right to request information as to whether we process personal data relating to you. If this is the case, you may, in particular, request information regarding:

- the purposes of the processing,

- the categories of personal data,

- the recipients or categories of recipients,

- the intended storage period or the criteria for determining this period,

- the source of the data, if it was not collected directly from you,

- the existence of rights to rectification, erasure, restriction of processing or objection,

- the existence of a right to lodge a complaint with a supervisory authority,

- where applicable, the existence of automated decision-making, including profiling, as well as meaningful information about the logic involved and the scope of the processing,

- where applicable, appropriate safeguards in the event of transfers to third countries.

You also have the right to receive a copy of the personal data being processed. Statutory restrictions (e.g. under Sections 34 and 35 of the BDSG) remain unaffected.

14.2 Rectification (Art. 16 GDPR)

You have the right to request, without undue delay, the rectification of inaccurate personal data or the completion of incomplete personal data. You may also update your data directly in your user account.

14.3 Erasure (‘right to be forgotten’, Article 17 of the GDPR)

You may request the erasure of your personal data if one of the conditions laid down by law is met, in particular if:

- the data are no longer necessary for the purposes for which they were collected,

- you withdraw your consent and there is no other legal basis,

- you object to the processing and there are no overriding legitimate grounds,

- the data were processed lawfully,

- erasure is necessary to comply with a legal obligation.

The right to erasure does not apply, amongst other things, where processing is necessary:

- to comply with a legal obligation,

- to establish, exercise or defend legal claims,

- for archiving, research or statistical purposes in the public interest, provided that the right to erasure would seriously undermine these purposes.

14.4 Restriction of processing (Art. 18 GDPR)

You may request the restriction of processing if:

- you contest the accuracy of the data (for the duration of the verification),

- the processing is unlawful and you request restriction instead of erasure,

- we no longer need the data for the purposes of the processing, but you require it to establish, exercise or defend legal claims,

- you have objected to the processing pursuant to Article 21(1) of the GDPR, until it has been determined whether our legitimate grounds override yours.

In the event of restriction, the data – apart from storage – may only be processed with your consent, or for the purpose of establishing, exercising or defending legal claims, or to protect the rights of another person, or for important reasons of public interest. We will inform you before the restriction is lifted.

14. 5 Data portability (Art. 20 GDPR)

You have the right to receive the personal data which you have provided to us and which we process on the basis of consent (Art. 6(1)(a) GDPR) or a contract (Art. 6(1)(b) GDPR) by automated means, in a structured, commonly used and machine-readable format, or – where technically feasible – to have it transmitted to another controller. This must not adversely affect the rights and freedoms of others.

14.6 Withdrawal of consent (Art. 7(3) GDPR)

You may withdraw any consent you have given us to the processing of personal data at any time with effect for the future. The lawfulness of any processing carried out prior to the withdrawal remains unaffected. Withdrawal may be made informally, e.g. by email to the contact address provided in this policy or via the unsubscribe links provided (e.g. for the newsletter).

14.7 Right to object (Art. 21 GDPR)

a) Objection to processing based on legitimate interests Where we process data on the basis of Art. 6( 1(f) of the GDPR (legitimate interest), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

b) Objection to direct marketing

Where personal data is processed for the purposes of direct marketing, you have the right to object at any time to the processing for the purposes of such marketing. This also applies to profiling insofar as it is related to direct marketing. In the event of an objection, we will no longer process the data for this purpose.

14.8 Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact the supervisory authority for your usual place of residence, your place of work or the place where the alleged infringement occurred.

14.9 Contact details, form and time limits (Art. 12 GDPR)

To exercise your rights, you may contact us at any time:

Suchen Technology GmbH

Dieselstraße 11

30916 Isernhagen, Germany

Email: datenschutz@suchen. technology

We generally respond to enquiries without delay, but no later than one month after receipt. In complex cases, this period may be extended by a further two months; in such cases, we will inform you of the extension and the reasons for it within one month.

Where necessary, we may request additional information to verify your identity and ensure that rights are not asserted by third parties without authorisation. The exercise of your rights is generally free of charge. Only in the case of manifestly unfounded or excessive requests may we charge a reasonable fee or refuse to process the request.

§ 15 Obligation to provide personal data

15.1 Voluntary provision and necessity

The provision of personal data is generally voluntary. However, the provision of certain data is necessary for the use of specific functions or services offered by suchen.expert (e.g. registration, login, communication, payment processing). Without this data, we cannot provide the relevant services, or can only do so to a limited extent.

15.2 Contractual and technical requirements

Where data is necessary for the performance of a contract or for the implementation of pre-contractual measures (Art. 6(1)(b) GDPR), it is not possible to use specific platform functions without this data. This applies, for example, to:

- Creation and operation of a user account

- Contacting others via internal messaging functions

- Publishing advertisements

- Payment processing for paid services

15.3 Indication of voluntary information

Voluntary information is marked as such in the registration or profile section. They are not required, but may contribute to a better user experience or enhanced functionality.

15.4 Legal obligations

For certain services, there may be a legal obligation to provide specific data (e.g. tax law requirements, commercial law documentation obligations). In such cases, we will inform you separately about the scope and consequences of failure to provide such data.

15.5 Consequences of non-provision

If you do not provide the required data, this may result in:

- registration not being completed,

- certain functions being unavailable,

- enquiries not being processed,

- contracts not being performed,

- us being unable to fulfil certain legal obligations.

15.6 Automatically collected technical data

When you visit our website or use our app, certain technical data is collected automatically (e.g. IP address, browser type, operating system). This data is technically necessary in order to:

- deliver content correctly,

- ensure stability, security and system functionality,

- prevent misuse and attacks.

This technical data is only linked to other personal data if there is a legal basis for doing so or if you have given your consent.

15.7 Requirements of third-party providers

Where third-party providers (e.g. map, payment, login, analytics or communication services) are integrated into our platform, it may be necessary to transfer certain data to these providers so that the relevant function can be provided. In such cases, processing takes place on the relevant legal basis.

Where providers process the data under their own responsibility, their privacy notices apply in addition. Details regarding the purpose, legal basis, recipients and any transfers to third countries can be found in the relevant sections of this privacy policy.

§ 16 Automated decision-making and profiling

16.1 No automated decisions in individual cases

We do not use exclusively automated decision-making processes within the meaning of Article 22 of the GDPR. Decisions which produce legal effects or which could similarly significantly affect you are not made exclusively by automated means.

16.2 Profiling and pseudonymous user profiles

Where we use analytics, advertising, remarketing or personalisation services, the creation of pseudonymous usage profiles and the analysis of your usage behaviour may take place – depending on your consent and the settings you have selected. Such data will only be combined with directly identifying data where there is a separate legal basis for doing so.

16.3 Purposes and legal basis

Such processing serves exclusively statistical, technical,

 advertising or user-related optimisation. Where storage or access technologies on end devices are used for this purpose, or where personal data is processed for analysis, advertising or personalisation purposes, this is carried out – where necessary – exclusively on the basis of your consent in accordance with Article 6(1)(a) of the GDPR in conjunction with Section 25( 1 of the TDDDG.

16.4 Transparency and control

Where profiling or the creation of pseudonymous usage profiles is carried out on the basis of your consent, you may withdraw this consent at any time with effect for the future or adjust your settings accordingly. Further information on the services used and your options can be found in the relevant sections of this privacy policy.

§ 17 Newsletters and Direct Marketing

17.1 Subscribing to the newsletter

Where we offer a newsletter and you subscribe to it, we use your email address to send you information about our offers, products or services.

17.2 Legal basis

The processing of your data for the purpose of sending the newsletter is based on your consent in accordance with Article 6(1)(a) of the GDPR.

17.3 Withdrawal

You may withdraw your consent at any time with effect for the future. This can be done, amongst other ways:

- via the unsubscribe link in every newsletter

- or by sending us a message via the contact form.

Any processing carried out up to the point of withdrawal remains lawful.

17. 4 Direct marketing to existing customers

If you are already a customer, we may send you information about our own similar products or services by email without you having to subscribe separately. The legal basis for this is Section 7(3) of the German Unfair Competition Act (UWG) in conjunction with Article 6(1)(f) of the GDPR (legitimate interest in customer-related communication).

You may object to this use at any time without incurring any costs other than the transmission costs charged at standard rates.

§ 18 Social media and plugins

18.1 Our own social media profiles

We maintain publicly accessible company profiles on social media and online platforms, in particular on TikTok, Facebook, Instagram, X, LinkedIn and YouTube, as well as on comparable services.

- your profile or username,

- publicly visible profile information,

- the content of your message, comment or other interaction,

- the date and time of the interaction,

- further information that you voluntarily provide to us.

- Public relations and the presentation of our company,

- Communication with users and interested parties,

- Processing and responding to enquiries,

- Moderation of our social media presence,

- protection against misuse and unlawful content.

 and prospective clients, and the secure and appropriate management of our social media presence.

18.2 Joint controllership (Article 26 of the GDPR)

Where we make joint decisions with platform operators regarding certain processing activities in the operation of our social media presence – in particular in connection with aggregated usage statistics or insights functions – this takes place within the framework of joint controllership pursuant to Article 26 of the GDPR.

The key provisions of the respective agreements on joint controllership are provided by the platform operators. Where provided for by law, data subjects’ rights may be exercised both against us and against the respective platform operator.

Unless another primary point of contact is specified, you may initially contact us regarding data protection matters using the contact details set out in this privacy policy. This does not affect the platform operator’s own responsibility under data protection law for further processing operations.

18.3 Social plugins on our website

Where we use social plugins on our website, these are integrated in a deactivated state by default, meaning that no data is initially transferred to the relevant provider.

18.4 Legal basis

The use of social plugins is based – depending on the type – on your consent (Art. 6(1)(a) GDPR) or our legitimate interest in ensuring our online services are user-friendly (Art. 6(1)(f) GDPR).

§ 19 Information for Minors

19.1 Services are not intended for persons under the age of 16

Our services are not intended for persons under the age of 16.

19.2 No knowingly processing

We do not knowingly collect personal data from persons under the age of 16.

19.3 Deletion of such data

Should we become aware that personal data relating to persons under the age of 16 has been processed without the necessary authorisation, we will delete such data immediately or restrict its processing accordingly, provided that no statutory retention obligation precludes this.

§ 20 Validity and amendments to this Privacy Policy

20. 1 Relationship to the Terms of Use and Terms of Service

This Privacy Policy supplements our Terms of Use and our Terms of Service.

All documents must be read together in order to fully understand the use of the platform and the associated processing of personal data. In the event of any contradictions, the statutory data protection regulations (in particular the GDPR and the BDSG) shall take precedence over the other provisions.

Note:

The Privacy Policy does not form part of any contract .

It serves solely to fulfil our statutory information obligations in accordance with Articles 12–14 of the GDPR. Consent to this Privacy Policy is not required and is not sought.

Consent is only required where this is provided for by law (e.g. for cookies, tracking technologies, marketing communications or app tracking pursuant to Article 6(1)(a) of the GDPR in in conjunction with Section 25 of the TDDDG). All other processing is based on the respective legal grounds specified in each case.

20.2 Regular review

We review this Privacy Policy regularly and update it where legal or technical changes make this necessary.

20.3 Notification of changes

We will inform you of any significant changes in an appropriate manner, e.g.:

- via notices on our website,

- by email,

- or via your user account or the app.

20.4 Validity and versions

The current version of this privacy policy is available on our website at all times.

20.5 Access to previous versions

We archive previous versions of this privacy policy for documentation purposes and these can be viewed on request. You can also find the most recent valid previous versions at any time via our platform in the section:

Support / Legal & Policies / Privacy Policy

(e.g. ‘Last updated: 17 April 2026’ or ‘Last updated: 15 November 2025’).

20.6 Recommendation to review regularly

We recommend that you review the content of the Privacy Policy regularly.

20.7 Continued use following changes

Your continued use of our services following the publication of changes shall be deemed to indicate that you have taken note of the updated provisions. If you do not agree with the changes, you may cease using the services and delete your user account.