Privacy Policy

This English version is provided for convenience only. In the event of any inconsistency or conflict between the German and English versions, the German version shall prevail.

1. Controller

Price4Parts GmbH
Freiheit 27
46348 Raesfeld
Germany

Email: info@price4parts.com

Price4Parts is solely responsible for the processing of personal data in connection with the provision of the platform.

For the processing of personal data within the framework of contracts between Buyer and Seller, the respective parties are solely responsible.

2. Data Protection Officer

Price4Parts has appointed an external data protection officer:

Simply Legal GmbH
Sebastian Schenk
Burkaderstr. 36
97082 Würzburg
Germany

Email: dpo@dieter-datenschutz.de

The data protection officer is the contact person for all questions relating to data protection as well as for the exercise of data subject rights.

3. Collection and Storage of Personal Data

When using the platform, the following data may be processed:

• Name
• Company data
• Email address
• Login information
• IP address
• Communication data & manufacturing data

This data is collected when users:

• register an account
• use the platform
• exchange messages via the platform
• create projects or submit offers

3a. Processing of Technical Data (in particular CAD files)

In the course of using the platform, users may upload and process technical data, in particular CAD files, drawings, models, or other design data.

This data may contain confidential business and trade secrets.

Such data is processed exclusively for the provision of platform functions, in particular for the execution of projects and communication between users.

Price4Parts does not carry out any content review of this data and assumes no responsibility for its accuracy, completeness, or suitability.

Responsibility for the protection, transfer, and confidentiality of such data lies solely with the respective users.

There is no entitlement to permanent storage of this data.

Price4Parts is entitled to delete technical data after completion of a project or after a reasonable period, provided that no statutory retention obligations exist.

Processing may also be carried out via external service providers (e.g. Cloudinary).

4. Purposes of Data Processing

Processing is carried out in particular for:

• registration of user accounts
• provision of platform functions
• communication between users
• contract processing
• technical security of the platform
• improvement of platform services
• intermediation of business contacts
• monitoring and evaluation of communication content for compliance with platform rules
• prevention of misuse and fraud
• enforcement of contractual terms of use
• processing of rating data for the display of user reviews and quality assurance of the platform
• processing of payments via external payment service providers (e.g. Stripe)

4a. Ensuring Platform Integrity, Security and Misuse Prevention

Price4Parts is entitled to review and evaluate communication data as well as other content exchanged via the platform on a random basis or where there is cause, insofar as this is necessary for:

• compliance with the terms of use and contractual provisions
• ensuring the security and integrity of the platform
• prevention of misuse, fraud, or unlawful activities

Permanent or arbitrary monitoring of communication does not take place.

Processing is carried out exclusively to the extent necessary and in compliance with applicable data protection regulations.

The review may be partially automated, in particular through the use of technical systems for detecting anomalies or potential violations.

Automated reviews serve exclusively to prepare measures and are reviewed by Price4Parts.

Processing is carried out on the basis of a legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR, in particular to ensure platform integrity, prevent misuse, and enforce platform rules.

4b. Legal Bases

Processing is carried out on the basis of:

• Art. 6 para. 1 lit. b GDPR (performance of a contract)
• Art. 6 para. 1 lit. f GDPR (legitimate interest in security, misuse prevention, and enforcement of platform rules)

4c. Payment Processing

Payment data is processed exclusively by external payment service providers.

Price4Parts has no access to complete payment information and does not store payment data.

4d. Use of Third Parties and Processors

To provide the platform, Price4Parts uses external service providers (processors). These process personal data exclusively on behalf of and in accordance with the instructions of Price4Parts.

A current list of all service providers used can be viewed here: Third-party services overview

Stripe (Payment Processing)

For payment processing, Price4Parts uses external payment service providers, in particular Stripe Payments Europe Ltd. as well as Stripe, Inc.

In the course of payment processing, the following data is processed in particular:

• payment data (by Stripe itself)
• transaction IDs
• customer IDs
• payment status

Further information: https://stripe.com/privacy

Cloudinary (File and Media Processing)

For the processing and storage of uploaded files (e.g. images, documents, CAD files), Price4Parts uses the Cloudinary service.

The following data may be processed:

• uploaded files
• metadata
• generated file links (CDN)

Further information: https://cloudinary.com/privacy

SendGrid (Email Delivery)

Price4Parts uses the SendGrid service for sending transactional emails.

The following data is processed in particular:

• email address
• email content
• sending and delivery information

Further information: https://www.twilio.com/en-us/legal/privacy

Hosting and Databases

For the storage and processing of data, Price4Parts uses hosting and database solutions (e.g. MongoDB or comparable providers).

The following data is processed in particular:

• account data
• communication data
• project data
• transaction data

Additional Services

The following services may also be used:

• Google Fonts (display of fonts)
• YouTube (integration of videos)
• Google Translate (optional translation function)

These services may process technical data (e.g. IP address, browser data).

Further information on the specific third-party providers and processors used can be found in the separate overview "Third Parties & Subprocessors" on the platform.

4e. Data Transfer to Third Countries

Some of the service providers used are based in countries outside the European Union (in particular the USA).

In these cases, data transfer takes place on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular:

• conclusion of standard contractual clauses (SCC)
• adequacy decisions of the EU Commission (where available)

It cannot be ruled out that authorities in third countries may gain access to personal data.

By using the platform, users agree to such data transfer insofar as this is necessary for the performance of the contract.

5. Storage Duration

Personal data is only stored for as long as necessary for the respective purposes.

• account data: for the duration of the contractual relationship
• contract and transaction data: 6–10 years (statutory retention obligations)
• communication data: up to 24 months after completion of a project
• technical data (e.g. log files): maximum 90 days

After the purpose ceases to apply, the data will be deleted unless statutory retention obligations prevent this.

6. Cookies

The platform uses cookies for the technical functionality of the website.

Analysis or marketing cookies are only used after consent via a cookie consent tool.

Users can adjust their cookie settings at any time via the consent tool.

6a. Tracking and Marketing Tools

If users give their consent via the consent tool, tracking and marketing tools may be used, in particular:

• Meta Pixel (Facebook / Instagram)
• Google tracking services

These tools enable the analysis of user behavior and the delivery of targeted advertising.

In particular, the following data may be processed:

• IP address
• device information
• user behavior on the platform
• interactions with content

Processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR (consent).

Consent can be withdrawn at any time.

6b. Data Transfer to Third Countries

Insofar as personal data is transferred to service providers outside the European Union, this is carried out exclusively in compliance with Art. 44 et seq. GDPR.

In particular, standard contractual clauses of the European Commission are used for this purpose.

6c. Use of Service Providers

The service providers used may act either as processors within the meaning of Art. 28 GDPR or as independent controllers.

Insofar as processing is carried out on behalf, corresponding data processing agreements exist.

Insofar as service providers act as independent controllers, processing is carried out on the basis of the respective data protection provisions of these providers.

6d. Service Providers and Processors Used (Overview)

To provide the platform, Price4Parts uses various technical service providers.

These may process personal data on behalf or act as independent controllers.

These include in particular:

• Hosting: Hetzner Online GmbH (Germany)
• Payment processing: Stripe Payments Europe Ltd. (Ireland)
• Email communication: Strato AG (Germany)
• Accounting: Lexoffice (Germany)
• Marketing / Outreach: Instantly.ai (third country reference possible)
• Tracking / Marketing: Meta Platforms, Google

Insofar as service providers act as processors, corresponding agreements exist pursuant to Art. 28 GDPR.

Insofar as data is transferred to third countries, this is carried out on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR (in particular standard contractual clauses).

7. Disclosure of Data

Personal data is only disclosed:

• for contract processing between users
• for the provision of platform functions
• in the case of legal obligations
• when using external service providers

External service providers are contractually obligated to comply with data protection regulations.

Some service providers may have independent responsibility under data protection law.

8. Payment Service Providers

External payment providers may be used for payment processing, for example:

• Stripe
• PayPal
• other external payment service providers

When using these services, the data protection provisions of the respective payment provider also apply.

Price4Parts itself is not a payment service provider.

9. Storage Duration

Personal data is only stored for as long as necessary for the respective purposes or as required by statutory retention obligations.

Data subjects may also contact the data protection officer directly.

10. User Rights

Users have the following rights under the GDPR:

• right to access stored data
• right to rectification of incorrect data
• right to erasure ("right to be forgotten")
• right to restriction of processing
• right to data portability
• right to object to processing

Requests can be sent to the contact address above.

11. Right to Lodge a Complaint

Users have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data.

12. Changes to the Privacy Policy

Price4Parts may amend this privacy policy if legal, technical, or organizational changes make this necessary.

The current version published on the website shall apply.

The current version can be viewed at any time on the Price4Parts website.

13. Data Transfer to Third Countries

Some of the service providers used process personal data outside the European Union, in particular in the USA (e.g. Stripe, Meta, Google, Cloudinary, SendGrid, Instantly.ai).

Transfer takes place exclusively in compliance with the legal requirements of the GDPR.

This includes in particular:

• conclusion of EU standard contractual clauses (SCC) pursuant to Art. 46 GDPR
• additional technical and organizational measures
• if applicable, use of providers with EU server locations (where available)

Despite these measures, a residual risk remains that authorities in third countries may gain access to data.

14. Service Providers and Tools Used

For the provision and operation of the platform, Price4Parts uses various external service providers.

Hosting & Infrastructure

• Hetzner (Germany)

Email & Communication

• Strato (Germany)
• SendGrid (USA, email delivery, third country)

Payment Processing

• Stripe (EU / USA)

Accounting

• Lexoffice (Germany)

Telephony

• fonial (Germany)

Marketing & Tracking

• Meta Platforms Ireland Ltd. (Facebook / Instagram, Meta Pixel)
• Google Ireland Ltd. (e.g. Google Analytics)

File and Media Processing

• Cloudinary (USA, file and media processing, third country)

Email Outreach / Marketing

• Instantly.ai (USA)

When using Instantly.ai, the provider may in some cases act as an independent controller, in particular in the analysis and optimization of email deliveries.

In these cases, the provider's data protection provisions also apply.

Processing is carried out depending on the service provider either:

• within the framework of processing on behalf pursuant to Art. 28 GDPR or
• under joint or independent responsibility of the respective provider.

For service providers based outside the EU, processing is carried out in accordance with the provisions in Section 13 of this privacy policy.

15. Rights of Data Subjects

Data subjects have the following rights:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection (Art. 21 GDPR)

In addition, there is a right to lodge a complaint with a data protection supervisory authority.