Privacy Policy

2. Data collected

We collect and process the following personal data in connection with the use of our platform:

2.1 When you register

• Name (first and last name)
• Email address
• Password (stored in encrypted form)
• Telephone number (optional)

2.2 When you use the platform

• Vehicle listings and associated data (images, descriptions, prices)
• Purchase enquiries to sellers (name, email address, optional telephone number, message)
• Enquiries submitted via the contact form
• Watchlist, saved searches and newsletter sign-up (each only if you use these functions)

2.3 Data collected automatically

• IP address
• Browser type and version
• Operating system
• Date and time of access
• Referrer URL

2.4 Vehicle listings, image uploads and vehicle documents

When you create vehicle listings, we process the vehicle images you upload together with the listing data (descriptions, technical details, prices, location). This processing is necessary for the performance of the user agreement and is carried out on the basis of Art. 6(1)(b) GDPR (performance of a contract). Once the listing is published, the content becomes visible to other users of the platform.

You may additionally upload vehicle documents (e.g. registration papers, invoices, appraisals) to a listing. These documents are not published. They can be retrieved only by you and are made available to interested buyers only if you expressly release them for a specific purchase enquiry — via a time-limited link that expires after seven days or a limited number of retrievals and which you can revoke at any time. The legal basis is Art. 6(1)(b) GDPR.

The legal basis for this processing is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interests).

3. Cookies and consent

We use cookies on our website. Cookies are small text files stored on your device. Strictly necessary cookies are required in order to provide basic website functions, in particular authentication and session management (login). These cookies are set without separate consent; the legal basis is Section 25(2) TDDDG in conjunction with Art. 6(1)(f) GDPR (legitimate interest in providing a secure and functional website).

In addition, we use optional statistics cookies (e.g. Google Analytics 4) only where you have given your express consent beforehand via our cookie banner. The legal basis for this is your consent under Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. No statistics or analytics cookies are set without your consent.

Your consent is given voluntarily and may be withdrawn at any time with effect for the future. You can adjust or withdraw your choices at any time via the “Cookie settings” link in the website footer. IP anonymisation is enabled when statistical data is collected.

3.1 Google Analytics

If you have given your consent in the cookie banner (“Accept”, or statistics enabled in the settings), we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland (“Google”). Without your consent, Google Analytics is not loaded: no analytics cookies are set and no usage data is transmitted to Google. Google Analytics is used for audience measurement and helps us to evaluate and improve the use of our website statistically. In doing so, usage data (e.g. pages viewed, time and duration of the visit, approximate location, device and browser types used) is processed by means of cookies (_ga, _ga_*). Your IP address is truncated; Google Analytics 4 does not store complete IP addresses. Google signals (cross-device analysis), advertising features and the sharing of data with Google for its own purposes (data sharing settings) are disabled. Event data is deleted automatically after 14 months.

Google processes the data on our behalf; a data processing agreement pursuant to Art. 28 GDPR is in place. Data may also be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC is certified; in addition, the European Commission’s standard contractual clauses form part of Google’s data processing terms. The sole legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future via the “Cookie settings” link in the footer; Google Analytics is then switched off and the analytics cookies are deleted. Further information: https://policies.google.com/privacy

4. Hosting

Our website is hosted by DigitalOcean (App Platform). The servers are located in the data centre in Frankfurt am Main, Germany (EU). The provider is:

DigitalOcean, LLC
101 Avenue of the Americas, 10th Floor
New York, NY 10013, USA

Data is processed on servers within the European Union. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with DigitalOcean. Where access from the USA cannot be ruled out, for example in the course of maintenance or support, such a transfer is safeguarded by the European Commission’s standard contractual clauses incorporated into the DPA (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the website reliably).

The platform’s database is operated as a managed database service by DigitalOcean in the same region. The provider automatically creates a backup every day, which is kept for seven days and then overwritten; backups are used solely for recovery after an outage.

When the website is accessed, technical access and error logs (IP address, time, address requested, browser identifier) arise in the hosting provider’s infrastructure. The hosting provider keeps them only for a short time for error analysis and to defend against malfunctions and attacks; we do not pass them on to third parties and do not evaluate them for any other purpose.

Requests to our website pass through the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, which DigitalOcean uses as a sub-processor for the network layer of the App Platform (routing, caching of static files, protection against attacks). In the process, connection data such as your IP address, the time and the address requested is processed. This processing is covered by the DPA with DigitalOcean; where data is transferred to the USA, this is based on the adequacy decision for the EU-US Data Privacy Framework, under which Cloudflare is certified, and on standard contractual clauses. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in delivering the website securely and quickly).

5. Image and document storage (object storage)

Uploaded files are not held on the web server but in the object storage service DigitalOcean Spaces of DigitalOcean, LLC (address: see section 4) in the Frankfurt am Main region, from which they are also delivered. This applies to vehicle images, images for Magazine articles, profile and cover images, the proof documents uploaded as part of dealer verification, vehicle documents attached to listings and the invoices we issue.

The data processed comprises the file content itself, a technically generated file name and the connection data arising when the file is retrieved (in particular IP address and time). Uploaded images are re-encoded on the server before being stored; any metadata they contain (e.g. EXIF data with GPS coordinates) is not carried over.

Vehicle, Magazine and profile images are publicly accessible by design and are delivered through the content delivery network (CDN) of DigitalOcean Spaces, where a copy may remain cached for up to one hour. If our administration blocks a listing, its images are also set to non-public. Proof documents from dealer verification, vehicle documents and invoices are stored exclusively in non-public form and delivered only through verified, signed-in access: proof documents to authorised staff, vehicle documents to the seller and — once released by the seller — to interested buyers via time-limited links (section 2.4), invoices to the account holder.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) for your own uploads and Art. 6(1)(f) GDPR (legitimate interest in fast delivery of files) for retrieval by visitors. The data processing agreement with DigitalOcean pursuant to Art. 28 GDPR (section 4) also covers the object storage and the CDN.

6. Email delivery

We use the mail server of Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany, to send emails (e.g. registration confirmations, password resets, notifications, invoices).

Processing takes place in data centres in Germany. Only the data required for delivery is processed.

The recipient’s email address and the content of the email are transmitted to the provider. A data processing agreement pursuant to Art. 28 GDPR is in place. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

7. Payment processing (Stripe)

We bill paid plans — dealer plans and the private listing — through the payment service provider Stripe: Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you book, you are redirected to a Stripe payment page and enter your payment details (card number or IBAN) directly with Stripe. We do not receive complete card or account details, only the payment method, its last four digits, the expiry date for cards and the status of payments.

We transmit to Stripe your name or company name, your email address, your billing address, your language, an internal customer number as well as the plan or listing booked and the amounts. Stripe processes this data to carry out payments and direct debits. Where Stripe processes data for fraud prevention and to fulfil its own legal obligations (such as anti-money laundering), Stripe is itself the controller.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(c) GDPR (legal obligations). Stripe may also transfer data to Stripe, Inc. in the USA; the transfer is based on the adequacy decision for the EU-US Data Privacy Framework, under which Stripe is certified, and on the European Commission’s standard contractual clauses. Further information: https://stripe.com/privacy

We retain invoices and the related payment data in accordance with commercial and tax law (see section 9). If you delete your account, we arrange for your customer record at Stripe to be deleted; the payment records remain with Stripe and with us within the scope of statutory retention obligations. If dealers based in another EU member state provide a VAT identification number, we check its validity via the European Commission’s VAT Information Exchange System (VIES); only that number and our own VAT identification number are transmitted (Art. 6(1)(b) and (c) GDPR).

8. Fonts and embedded graphics

The fonts used on this website (Cormorant, Inter and JetBrains Mono) are served locally from our own server. They are bundled when the application is built; when the website is loaded, no connection is made to Google Fonts or to any other font service. Your IP address is therefore not transmitted to a font provider.

Icons and country flags are likewise delivered as part of the page itself and are not fetched from an external image service.

When the website is accessed, connections to services outside the hosting infrastructure described in sections 4 and 5 arise solely from the audience measurement described in section 3.1 — and there only after your express consent. When you book a paid package, you are also redirected to Stripe’s payment page (section 7).

9. Retention and erasure periods

We store personal data only for as long as is necessary for the respective purpose or for as long as statutory retention obligations apply. In detail:

• Account data: for the duration of the user relationship. Following a deletion request — via the account settings or by email — all identifying details (name, email address, telephone number, address data, profile and company details, sign-in credentials including second factors) are irreversibly overwritten; the anonymised record is retained only in so far as this is necessary to attribute transactions that have already been completed (such as invoices). Accounts whose email address has not been confirmed within 30 days of registration, and unconfirmed accounts without content of their own that have not been signed in to for 90 days, are deleted automatically.
• Blocked accounts: An account that we have blocked for a breach of the terms of use remains stored with its data and listings for as long as is necessary to keep the case traceable and to prevent abuse – in particular so that the block cannot be circumvented by registering again – but no longer than three years after the block; it is exempt from automatic deletion. After that, we restrict the stored data to what is necessary to enforce the block (email address, date and reason of the block). If a block is lifted, the other periods in this section apply again.
• Vehicle listings: for the term of the plan booked (private listing: 90 days). They are then deactivated automatically and remain stored so that the seller can reactivate them. When the account is deleted, images and vehicle documents are deleted; the listing is deactivated and stripped of the VIN, location and description.
• Sign-in and session tokens: A sign-in remains valid for at most seven days without further use; expired tokens are deleted automatically by a daily maintenance run. They are removed immediately when you sign out or when the account is deleted.
• One-time links and tokens: Links to confirm an email address are valid for seven days, links to reset a password for one hour, links to confirm a change of email address for 24 hours. Expired tokens are deleted by the next daily maintenance run at the latest.
• Purchase enquiries to sellers and messages via the contact form: twelve months from receipt; they are then deleted automatically. Purchase enquiries received by a seller are also deleted when the seller’s account is deleted.
• Releases of vehicle documents: A link with which a seller sends vehicle documents to an interested buyer is valid for seven days and limited to a certain number of retrievals; each retrieval is logged with its time. The release and the retrieval log are deleted 30 days after expiry or revocation.
• Newsletter: until consent is withdrawn. After you unsubscribe, the entry is kept marked as unsubscribed so that the same address is not contacted again; a sign-up that is not confirmed within 30 days is deleted.
• Proof documents for dealer verification: until the check has been completed and for the duration of the dealer relationship as evidence that the verification duty was met. They are deleted 90 days after the dealer relationship ends, 30 days after a rejection, after 90 days without a decision on the document, and immediately when the account is deleted.
• Reports about listings, dealers and enquiries: We retain reports and their handling for as long as is necessary to demonstrate that notices of illegal content have been processed (Regulation (EU) 2022/2065, Digital Services Act) and to prevent repeated infringements, but no longer than twelve months after handling has been completed. If the reporting person deletes their account, their link to the report is removed.
• Administration log: Actions by our staff on accounts and listings (such as approvals, blocks, review notes) are logged with the time, the record concerned and the truncated IP address of the person acting, and deleted after twelve months.
• Server logs: Access and error logs arise at the hosting provider and are kept there only for a short time for error analysis (section 4). Our application itself stores IP addresses only temporarily in memory, to limit the number of requests per sender (protection against abuse), and in truncated form in the administration log.
• Backups: The database is backed up automatically every day by the hosting provider; each backup is kept for seven days and then overwritten. Deleted data may therefore remain in a backup for up to seven days; backups are used solely for recovery after an outage.
• Audience measurement (only with consent): Event data in Google Analytics is deleted automatically after 14 months. The analytics cookies (_ga, _ga_*) expire after two years at the latest and are deleted when you withdraw your consent. We store your choice in the cookie banner for six months in the strictly necessary cookie “stern_consent”.
• Records subject to statutory retention obligations: invoices and accounting records are retained for eight or ten years, depending on the document, under Section 147 AO and Section 257 HGB — also after the account has been deleted. For that period, processing is restricted to storage.

10. Data subject rights

Under the GDPR, you have the following rights in relation to your personal data:

10.1 Right of access (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed. Where that is the case, you have a right of access to that data and to the information referred to in Art. 15 GDPR.

10.2 Right to rectification (Art. 16 GDPR)

You have the right to request the rectification of inaccurate personal data and the completion of incomplete personal data.

10.3 Right to erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data, provided that one of the grounds set out in Art. 17 GDPR applies.

10.4 Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your data where one of the conditions set out in Art. 18 GDPR is met.

10.5 Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit that data to another controller.

10.6 Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you.

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

11. Contact for data protection enquiries

If you have questions about data protection or wish to exercise your data subject rights, please contact:

Markus Kalweit
sternclassics Media UG (haftungsbeschränkt)
An der Germania Brauerei 7
48159 Münster
Email: datenschutz@everstern.eu