1. Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Christoph Böing Zum Tollberg 8a 46499 Hamminkeln Germany Email: info [at] sonictrades [dot] com Phone: +49 179 1524584

I am personally your point of contact for all data protection matters (one-person business). No separate Data Protection Officer has been appointed, as the statutory requirements for this (§ 38 of the German Federal Data Protection Act, BDSG — in particular, regularly employing at least 20 persons involved in automated data processing) are not met.

2. General Information on Data Processing

(1) We process the personal data of our users only to the extent necessary to provide a functioning website and our content and services.

(2) The legal bases relied upon are, in particular:

• Art. 6(1)(a) GDPR (consent, e.g., for analytics cookies, newsletter)
• Art. 6(1)(b) GDPR (performance of a contract/pre-contractual measures, e.g., registration, listing publication, payment processing)
• Art. 6(1)(c) GDPR (legal obligation, e.g., statutory tax retention requirements)
• Art. 6(1)(f) GDPR (legitimate interest, e.g., IT security, fraud prevention)

3. Provision of the Website, Server Log Files

(1) This website is hosted by Strato AG (Pascalstraße 10, 10587 Berlin, Germany). A data processing agreement pursuant to Art. 28 GDPR is in place with Strato. Data processing takes place within the EU.

(2) Each time the website is accessed, Strato automatically collects so-called server log files transmitted by your browser. These include: IP address, date and time of the request, page accessed, browser and operating system used, referrer URL.

(3) This data is necessary for the technical operation of the website and to ensure IT security (Art. 6(1)(f) GDPR) and is automatically deleted after 7 days.

4. Cookies and Consent Management

(1) Our website uses cookies. Technically necessary cookies (e.g., to maintain a login session) are set on the basis of Art. 6(1)(f) GDPR.

(2) For all non-essential cookies (in particular analytics cookies such as Google Analytics, see Section 5), we obtain your consent before their use via the consent tool WPConsent (WordPress plugin), Art. 6(1)(a) GDPR.

(3) You may withdraw or adjust your consent at any time with future effect via the cookie settings button on our website.

5. Google Analytics

(1) Subject to your consent under Section 4, we use the web analytics service Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

(2) Google Analytics uses cookies that enable an analysis of your use of the website (e.g., pages visited, time spent, referral source). The information generated is transmitted to and stored on a Google server, potentially including servers in the USA.

(3) Google is certified under the EU-U.S. Data Privacy Framework, which is intended to ensure an adequate level of data protection for data transfers to the USA.

(4) The legal basis is your consent, Art. 6(1)(a) GDPR. You may withdraw it at any time via the cookie settings tool.

(5) For further information on how Google handles user data, see Google’s privacy policy: https://policies.google.com/privacy

6. Google Fonts (Hosted Locally)

We use Google Fonts on our website. These fonts are hosted locally on our own server using the “OMGF – Host Google Fonts Locally” plugin. As a result, no connection to Google’s servers is established and no data (e.g., your IP address) is transmitted to Google. No consent is required for this.

7. YouTube Videos Embedded by Users

(1) Providers may embed YouTube videos within their listings. If you play such a video, a connection is established to YouTube’s servers (Google Ireland Limited, with data potentially processed in the USA), and personal data (e.g., IP address, device information) may be transmitted to Google.

(2) This processing is outside our control, as the content is inserted by Providers. The privacy policies of Google/YouTube apply in addition: https://policies.google.com/privacy and https://www.youtube.com/intl/ALL/howyoutubeworks/privacy/

(3) The legal basis for displaying the embedded content is your consent given via our cookie/consent tool, provided the video is only loaded after a click/consent; otherwise, Art. 6(1)(f) GDPR applies.

8. Registration as a Provider

(1) To create a listing, registration is required. In this context, we collect: name, email address, password (stored encrypted), username.

(2) This processing serves to fulfill the terms-of-use contract (providing the listing function), Art. 6(1)(b) GDPR.

(3) Providing this information is required for registration; without it, use of the Platform as a Provider is not possible.

9. Listing Content

Text, images, and videos submitted by Providers in their listings are displayed publicly on the Platform. Providers should therefore only upload content they wish to make publicly available and should avoid including unnecessary personal data of third parties in such content.

10. Payment Processing

(1) For the payment of listings, we use the following payment service providers:

• Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; with processing partly also carried out by Stripe, Inc., USA)
• PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; with processing partly also carried out by PayPal, Inc., USA)

(2) In connection with payment processing, the data necessary for the payment (e.g., name, payment amount, payment method) is transmitted to the respective provider. The privacy notices of Stripe and PayPal apply in addition.

(3) The legal basis is the performance of a contract, Art. 6(1)(b) GDPR. To the extent this involves a transfer of data to the USA, this is based on Standard Contractual Clauses or, where certified, the EU-U.S. Data Privacy Framework.

11. Newsletter (Brevo)

(1) If you subscribe to our newsletter, we use the service Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany, and/or Brevo SAS, France) for this purpose.

(2) Registration uses a double opt-in process: after signing up, you receive a confirmation email and must actively confirm your subscription.

(3) The legal basis is your consent, Art. 6(1)(a) GDPR. You may unsubscribe at any time via the unsubscribe link in any email or by messaging info [at] sonictrades [dot] com.

12. Contacting Us

If you contact us by email or phone, we process the data you provide in order to handle your inquiry, Art. 6(1)(b) or (f) GDPR.

13. Retention Periods

(1) Email correspondence: We retain general inquiries and email correspondence for 1 year after the matter is concluded, unless a statutory retention obligation (see below) requires otherwise.

(2) Invoices and payment records: Due to commercial and tax-law retention obligations (§ 147 of the German Fiscal Code (AO), § 257 of the German Commercial Code (HGB), § 14b of the German VAT Act (UStG)), we retain invoices and accounting records for 8 years.

(3) Account and registration data (name, email, username): retained for as long as the account exists, and deleted without delay after account deletion, except to the extent invoice data subject to the retention obligation under paragraph (2) is affected.

(4) Listing content: deleted upon expiry of the purchased duration or upon deletion of the listing, unless a statutory retention obligation requires otherwise.

14. Recipients and Transfers to Third Countries

In connection with the processing described above (Google Analytics, YouTube embeds, Stripe, PayPal), personal data may be transferred to the USA. These providers are either certified under the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses under Art. 46 GDPR are in place as appropriate safeguards.

15. Your Rights as a Data Subject

You have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
• Right to withdraw consent given, with future effect (Art. 7(3) GDPR)
• Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR); the competent authority is the Data Protection and Freedom of Information Commissioner of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

To exercise your rights, an informal email to info [at] sonictrades [dot] com is sufficient.

16. Changes to this Privacy Policy

We will update this Privacy Policy whenever the underlying data processing or the applicable legal framework changes. The version published on the website at the time of your visit shall apply.