Privacy Policy

1. Controller

Elektronikhandel Michael Gräf
Breitscheidstraße 84, 70176 Stuttgart
Germany
Phone: 0174 3292357
E-Mail: info@ampario.de

VAT ID according to § 27a UStG: DE311588656

2. Collection and Storage of Personal Data

When visiting our website, the following data is automatically collected by the web server (server log files):

• IP address of the requesting computer
• Date and time of access
• Name and URL of the accessed page
• Browser type and version, operating system
• Referrer URL

This data is technically required to deliver the website and ensure security. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Log files are automatically deleted after 14 days.

During registration, we collect: name, email address, password (stored encrypted), account type (private/business), and if applicable company name, business address, and VAT ID. Processing is based on contract fulfillment (Art. 6(1)(b) GDPR).

3. Platform Usage

When creating listings, title, description, images, price, location, and category are stored and publicly displayed. For orders, we store order and payment information for contract processing. Messages between users are stored to enable communication. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment).

4. Cookies

This website uses technically necessary cookies and optional anonymous usage statistics. No marketing cookies or advertising trackers are used.

The cookies listed above are required for the operation of the platform and cannot be disabled. Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and § 25(2) TDDDG (technically necessary cookies are exempt from consent requirements).

The key "ampario-cookie-consent" is stored in the browser's localStorage to record whether usage statistics were accepted or declined. When accepted, a random session ID is also stored in sessionStorage (key "__ops_sid"), which only exists for the duration of the browser tab and cannot be associated with any person. These values contain no personal data and can be deleted via browser settings.

5. Payment Processing (Stripe)

Payment processing is handled by Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA). When using Stripe, payment data is processed directly by Stripe. We do not receive complete credit card data. Stripe is PCI DSS Level 1 certified.

For sellers, Stripe Connect is used. Additional data for identity verification is collected and processed directly by Stripe. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment).

More information: stripe.com/privacy

6. Email Service (Resend)

We use Resend (Resend, Inc., San Francisco, USA) for sending transactional emails (registration confirmation, password reset, order notifications). Your email address is transmitted to Resend for this purpose. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment).

7. Email Link Tracking

Emails may contain links for which we record whether and when they were clicked, as well as technical access data (IP address, user agent) generated in the process. This only happens if you have given your consent (see legal basis below) — without your consent, no click-tracking takes place.

Purpose of Processing

The purpose is to detect broken or non-functioning links and to measure which email content is relevant to users, in order to improve our communication.

Legal Basis

Art. 6(1)(a) GDPR (consent). You can voluntarily agree at registration, or at any later point in your account settings, to let us record clicks on links in emails. Your consent is voluntary, has no effect on whether you receive the emails themselves, and can be withdrawn at any time with effect for the future in your account settings (Art. 7(3) GDPR) — alternatively, contact: info@ampario.de.

Exception: Security and Authentication Emails

Security and authentication emails (e.g. password reset, login notifications, 2FA codes) are sent via a separate, untracked sender address and are always excluded from this processing — regardless of your consent.

Retention Period

Click events are automatically deleted after 30 days.

No Open-Tracking

We do not use an open-tracking pixel — we only record link clicks, not whether the email itself was opened.

8. Hosting (Vercel)

Our website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Vercel processes the access data mentioned in section 2. A data processing agreement according to Art. 28 GDPR is in place with Vercel.

9. Database (Neon)

Platform data is stored in a PostgreSQL database at Neon Inc. (100 Bush St, Suite 1600, San Francisco, CA 94104, USA). The database is located in the EU-Central-1 region (Frankfurt). Neon processes data under a data processing agreement according to Art. 28 GDPR. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment).

10. Image Storage (Vercel Blob)

Uploaded images are stored via Vercel Blob. Images are publicly accessible via URL and associated with listings. Legal basis: Art. 6(1)(b) GDPR (contract fulfillment).

11. Map and Location Services

For displaying maps and converting addresses into coordinates, we use three external services. All three are based on OpenStreetMap data but are provided by different operators and differ in purpose, recipient, and third-country status.

Map Tiles (CARTO)

When visiting pages with a map display (e.g. listing location, location search, route search), map tiles are loaded directly from CARTO / CartoDB, Inc. (307 Fifth Avenue, Floor 9, New York, NY 10016, USA). In the process, your IP address and the displayed map section are transmitted to CARTO.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Balancing test: our interest in a functioning, performant map display without operating our own map infrastructure prevails, since only technically necessary tile requests (no account or order data) are transmitted and you can reasonably expect a map display when visiting a map page. The impact is also minor because the page remains usable even without loaded map tiles — only the map view is affected, no other function. CARTO is certified under the EU-US Data Privacy Framework (third-country transfer to the USA, see section "Data Transfers to Third Countries"). You can object to this processing under Art. 21 GDPR (see section "Your Rights").

Address Geocoding (Nominatim / OpenStreetMap Foundation)

When creating a listing, using location/route search, and matching shipping transport, your postal code/city is transmitted to Nominatim, operated by the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom), to calculate coordinates from it. The OSM Foundation is an independent controller for this processing.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Balancing test: your interest in automatic radius/route search and transport matching without having to manually mark coordinates on a map, as well as our interest in a functioning location search, prevail over the minor impact (only postal code/city, not a full address). The impact is especially minor because geocoding is not a mandatory step — the respective feature merely remains partially usable on failure instead of failing entirely: a listing can be created even without successful geocoding, and transport matching continues to work without coordinates if necessary — which is why we do not rely on Art. 6(1)(b) GDPR. The transfer is based on the European Commission's adequacy decision for the United Kingdom (Art. 45 GDPR). You can object to this processing under Art. 21 GDPR (see section "Your Rights").

Location Search Autocomplete (Photon / komoot)

As you type in location search fields, your text input is transmitted to Photon, a service operated by komoot GmbH (Kienberger Allee 4, D-12529 Schönefeld, Germany), to show you matching autocomplete suggestions.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Balancing test: your interest in a more convenient, faster input through suggestions already on partial input prevails over the minor impact (only the entered search text, no account or order data) — this is a pure input aid, not a final geocoding result, and location search remains fully usable via manual entry even without suggestions. Since komoot states it uses exclusively EU-based servers (including in Germany), no data is transferred to a third country. You can object to this processing under Art. 21 GDPR (see section "Your Rights").

12. Data Transfers to Third Countries

Through the use of the following service providers, personal data is transferred to third countries (USA, United Kingdom):

Transfers to the USA are based on the EU-US Data Privacy Framework (adequacy decision by the EU Commission pursuant to Art. 45 GDPR) — the listed US service providers are each certified under the EU-US DPF. The transfer to the United Kingdom (OpenStreetMap Foundation) is based on a separate adequacy decision by the EU Commission for the United Kingdom (also Art. 45 GDPR).

13. Browser Extension (Ampario Extension)

We offer an optional browser extension (Chrome/Edge) that allows users to import listings from third-party platforms (e.g. Kleinanzeigen) directly to Ampario.

The extension only accesses third-party platform websites when actively triggered by the user. Listing data (title, description, price, image URLs, location, category, listing ID) is extracted and transmitted encrypted (HTTPS) to Ampario servers. No login credentials of third-party platforms are collected or stored. Legal basis: Art. 6(1)(a) GDPR (consent).

The extension is distributed via the Chrome Web Store (Google LLC). Google's privacy policy additionally applies.

→ Full privacy policy for the browser extension

14. Retention Periods

15. Website Analytics

When consented via the cookie notice, we collect anonymous usage data to improve the platform. The following data is collected:

• Page views (which pages you visit)
• Click behavior (which buttons and links you click)
• Search behavior (which search terms and filters you use)
• Conversion tracking (whether a page visit leads to a contact or purchase)
• Campaign attribution (UTM parameters, e.g. which marketing campaign led you to the site)

Purpose of Processing

The collected data is used exclusively to improve our services. We analyze which features are used and where users encounter difficulties in order to improve usability.

Legal Basis

Art. 6(1)(a) GDPR (consent). Analytics are only activated after your explicit consent via the cookie notice.

Pseudonymization and Data Minimization

No IP addresses are stored, no cookies are set, and no profiling is performed. A random session ID (UUID in sessionStorage) is generated per browser tab, which cannot be associated with any person and only exists for the duration of the tab.

Data Recipients

Data is processed on our own server in Germany (Hetzner, Nuremberg) and is not shared with third parties. No external analytics services (e.g. Google Analytics), social media plugins, or advertising trackers are used.

Retention Period

Raw data (individual events) is deleted after 30 days. Aggregated statistics are automatically deleted after 90 days.

Withdrawal and Opt-out

You can deactivate analytics at any time by selecting "Necessary only" in the cookie notice. If you have already consented, you can withdraw your consent by deleting the "ampario-cookie-consent" key in your browser settings (site data / localStorage) or setting it to "declined". The page will then display the cookie notice again on your next visit.

16. Your Rights (Art. 15–21 GDPR)

You have the following rights regarding your personal data at all times:

• Access (Art. 15 DSGVO) — What data we have stored about you
• Rectification (Art. 16 DSGVO) — Correction of inaccurate data
• Erasure (Art. 17 DSGVO) — Deletion of your data, unless retention obligations apply
• Restriction (Art. 18 DSGVO) — Restriction of processing
• Data Portability (Art. 20 DSGVO) — Your data in machine-readable format (export under Profile → Settings)
• Objection (Art. 21 DSGVO) — Objection to processing based on legitimate interests

To exercise your rights, contact info@ampario.de.

17. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. Responsible supervisory authority:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

18. Express Pickup Service

When using the Express Pickup service, the following additional data is processed:

• Location data (seller pickup address, buyer delivery address) — for route calculation and driver matching
• IBAN (driver) — stored encrypted, for payout of expense reimbursement
• Pickup and delivery codes (6-digit codes) — for handover verification
• Trip data (completed trips, ratings) — for monthly limit compliance and quality assurance
• Insurance disclaimer acknowledgment — for legal compliance

Legal basis: Art. 6(1)(b) GDPR (contract fulfillment). The IBAN is stored encrypted using AES-256-GCM and only decrypted for payouts. Location data is not shared with third parties. Express transport data is retained for 10 years (statutory retention obligation for accounting records per § 147 AO).

19. Currency and Changes

This privacy policy is currently valid. Changes may become necessary due to further development of the website or changed legal requirements.