Controller
Controller of data processing on this website is PFF Medien GmbH, Musterstraße 1, 12345 Musterstadt, Germany. Contact: datenschutz@pff.de.
Data Collected
Each visit to the website automatically collects technical data (IP address, timestamp, requested page). When you register and use the marketplace, we additionally collect account data: username, email address, listing content, and communication metadata.
Purposes of Processing
- Provision of the marketplace and its functionality
- Communication between buyers and sellers
- Abuse detection and moderation
- Compliance with statutory retention obligations
Cookies and Tracking
Strictly necessary cookies are set without consent. Analytics and marketing cookies are only activated after explicit consent via the cookie banner.
Data Subject Rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Requests to datenschutz@pff.de. Complaints may be filed with the competent supervisory authority.
Retention and Pseudonymisation
When an account is deleted (self-service or via deletion of the associated forum account), we perform pseudonymisation: username and email address are obfuscated, the session version is invalidated (immediate logout), and active listings are marked as expired and no longer publicly visible.
The following content remains — with a pseudonymised author — for legal and trust reasons:
- Reviews: indefinitely (author appears as “Deleted user”). Reason: the reviewed party must retain their reputation data.
- Message threads: 3 years from last activity. Content remains readable for the counterpart; replies are no longer possible.
- Completed transactions (sold listings): 2 years — to satisfy commercial-law retention obligations (§ 257 HGB).
All other account data is removed on pseudonymisation. Active and expired listing data is retained for moderation purposes for up to 24 months.
Data Transfers to Third Parties
Data is shared with third parties only where necessary for contract performance (e.g. hosting, email delivery) or where legally required. Data processing agreements under Article 28 GDPR are in place with all processors.