Privacy Policy

for the machinery-market.eu platform

1. Data controller and scope

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions for the processing of personal data in connection with the machinery-market.eu platform is:

GSK Handels- und Service GmbH

An den Gewerbewiesen 17

67374 Hanhofen

Germany

Telephone: +49 6344 9261444

Email: info@machinery-market.eu

This privacy policy applies to the processing of personal data in connection with the use of the website https://machinery-market.eu, its subdomains, mobile views and associated online services.

2. Data Protection Officer

We have not currently appointed a Data Protection Officer, as we do not meet the requirements set out in Article 37 of the GDPR in conjunction with Section 38 of the BDSG. If you have any questions regarding data protection, please contact us directly at info@machinery-market.eu.

3. General information on data processing

(1) We generally process our users’ personal data only to the extent necessary to provide a functional website, our content and services, or where processing is permitted on another legal basis.

(2) The processing of personal data generally takes place only with the user’s consent or on one of the legal bases set out in Article 6(1) of the GDPR, in particular for the performance of a contract, to comply with legal obligations or to safeguard legitimate interests.

(3) Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis. Where processing is carried out for the performance of a contract, Article 6(1)(b) of the GDPR serves as the legal basis. Where processing is necessary for compliance with a legal obligation, Article 6(1)(c) of the GDPR serves as the legal basis. If processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6(1)(f) of the GDPR serves as the legal basis.

4. Provision of the website and creation of log files

(1) Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in server log files:

• IP address of the requesting device (usually anonymised or truncated shortly afterwards);
• Date and time of access;
• URL accessed and HTTP method;
• Referrer URL;
• Browser and operating system used (user agent);
• Status code and amount of data transferred.

(2) This data is not stored together with other personal data relating to the user.

(3) The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the technical provision of the website, ensuring the stability and security of the systems, and investigating any attempts at misuse.

(4) Log files are generally deleted or anonymised after a maximum of 30 days, unless longer storage is required in individual cases to investigate a specific security incident.

5. Cookies and similar technologies

(1) Our website uses cookies and, where applicable, similar technologies (e.g. localStorage). Cookies are small text files that are stored in the user’s browser and contain certain information.

(2) We use the following categories of cookies:

• Technically necessary cookies: required to ensure the website functions properly (e.g. session cookies, shopping basket/wishlist cookies, language selection, cookie consent storage). Legal basis: Section 25(2)(2) TDDDG (formerly TTDSG) and Article 6(1)(b) and (f) GDPR.
• Functional cookies: enable convenience features such as saving filter settings or recently viewed machines. Legal basis: Consent pursuant to Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.
• Statistics/analytics cookies: used to measure reach and improve the service. Legal basis: Consent pursuant to Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.
• Marketing/third-party cookies: enable, among other things, interest-based advertising. Legal basis: Consent in accordance with Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR.

(3) A detailed overview of the cookies used, along with their providers, purpose and storage duration, can be found in our separate Cookie Policy.

(4) The analytics and marketing tools used are listed transparently here: We do not currently use any site-wide audience measurement tools (such as Google Analytics, Matomo or similar). Should this change in the future, we will update this section in good time and, where necessary, seek consent via our cookie banner.

6. Registration and management of user accounts

(1) To register as a seller or buyer on the platform, we collect the information required for registration. This includes, in particular:

• Company name and legal form;
• Name and role of the contact person;
• Address, country;
• Email address, telephone number;
• VAT number (if applicable);
• Login details (username, password – password is stored exclusively in encrypted form);
• for sellers additionally: selected tariff, desired number of listings, payment details, bank details or payment service provider details where applicable.

(2) The legal basis for processing is Article 6(1)(b) of the GDPR (performance of a contract or taking steps prior to entering into a contract) and Article 6(1)(f) of the GDPR (legitimate interest in the smooth and abuse-free operation of the platform).

(3) The data is stored for the duration of the user agreement and beyond to fulfil statutory retention obligations (in particular commercial and tax law, typically six to ten years).

7. Contact form, enquiry function and messages between buyer and seller

(1) When using the contact form or the enquiry function to contact a seller, we collect at least the following data:

• Surname, first name, company name;
• Address (if provided);
• Email address, telephone number (if provided);
• Content of the message and reference to the relevant advertisement;
• Time of the enquiry.

(2) This data is used exclusively for the purpose of responding to the enquiry or forwarding it to the seller in question. The legal basis is Article 6(1)(b) of the GDPR (initiation of a contractual relationship) or Article 6(1)(f) of the GDPR (legitimate interest in the efficient initiation of business transactions between sellers and buyers).

(3) Messages exchanged via an internal messaging system are stored for documentation purposes and to prevent misuse or fraud. We reserve the right to review messages in individual cases and where there is reasonable suspicion of legal violations.

8. Newsletters and marketing emails

(1) We do not currently offer a newsletter.

(2) We send newsletters and marketing emails exclusively with the express consent of the recipients (Article 6(1)(a) GDPR, Section 7(2) of the Unfair Commercial Practices Act) or in accordance with the conditions set out in Section 7(3) of the Unfair Commercial Practices Act (email advertising to existing customers).

(3) Consent may be withdrawn at any time with effect for the future, e.g. via the unsubscribe link in every email or by notifying us using the contact details provided in section 1.

9. Recipients of personal data and data processing on behalf of others

(1) Personal data will only be disclosed to third parties where this is necessary for the performance of the contract, where there is a legal obligation to do so, or where you have given your express consent.

(2) In the course of operating the platform, we use the following categories of recipients:

• Hosting service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (Privacy Policy: hetzner.com/de/rechtliches/datenschutz);
• Payment service providers: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (Privacy Policy: paypal.com/de/webapps/mpp/ua/privacy-full);
• Email/transaction email services: ALL-INKL.COM — Neue Medien Münnich, owned by René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (Privacy Policy: all-inkl.com/datenschutzinformationen);
• Analytics, tracking and advertising service providers: see section 5;
• IT service providers for maintenance and support;
• Tax advisors, auditors and legal advisors to the extent necessary.

(3) Where we engage third parties to process personal data on our behalf, we enter into contracts with the respective data processors in accordance with Article 28 of the GDPR.

(4) The data published by the seller in connection with an advertisement (in particular company name, address, contact details) forms part of the advertisement and is displayed publicly.

10. Data transfers to third countries

(1) Where we transfer personal data to recipients outside the European Economic Area (EEA), this is done only if an adequate level of data protection exists or suitable safeguards (in particular, standard contractual clauses of the European Commission in accordance with Article 46 of the GDPR) are in place, or if there is another legal basis under Article 49 of the GDPR.

(2) Data transfers to third countries take place exclusively within the scope of the services described in the section ‘Direct contact with sellers’ (WhatsApp, Telegram). All our technical service providers (hosting by Hetzner Online GmbH in Germany, email dispatch via ALL-INKL.COM in Germany, payment processing via PayPal in Luxembourg) process your data exclusively within the European Economic Area (EEA) in accordance with the GDPR.

11. Retention period

(1) We process and store personal data only for as long as is necessary to achieve the respective processing purpose or to the extent required by statutory retention obligations.

(2) Master data from user accounts is stored for the duration of the user agreement. Upon termination of the contract, the data will be deleted, provided that no statutory retention obligations prevent this. In particular, accounting documents and tax-relevant documents are retained for ten years, and other business correspondence for six years (Section 147 AO, Section 257 HGB).

(3) Data from contact enquiries shall be deleted at the latest once the purpose of processing no longer applies, provided that no retention obligations or legitimate interests preclude longer storage.

12. Rights of data subjects

You have the following rights vis-à-vis us with regard to your personal data:

• Right of access (Art. 15 GDPR);
• Right to rectification (Art. 16 GDPR);
• Right to erasure (Art. 17 GDPR);
• Right to restriction of processing (Art. 18 GDPR);
• Right to object to processing (Art. 21 GDPR);
• Right to data portability (Art. 20 GDPR);
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR).

To exercise your rights, simply send an informal message to the contact details provided in section 1.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent supervisory authority for us as the data controller, based in Hanhofen, Rhineland-Palatinate, is:

The State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate (LfDI RLP)

Hintere Bleiche 34

55116 Mainz

Telephone: +49 6131 8920-0

Email: poststelle@datenschutz.rlp.de

Website: https://www.datenschutz.rlp.de

You may also contact any other supervisory authority in the Member State of your residence, your workplace or the place where the alleged infringement occurred.

14. Right to object to processing based on legitimate interests

Where the processing of your personal data is based on legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. In the event of an objection, we will cease processing the data in question unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

15. Obligation to provide personal data

The provision of personal data is not required by law or contract. You are not obliged to provide us with data. However, failure to provide such data may mean that you are unable to use our services, or only able to use them to a limited extent (e.g. you will not be able to register as a seller or contact a supplier).

16. Automated decision-making and profiling

17. Data security

We take technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments. Data transfers via the internet are encrypted (e.g. TLS) where supported by browsers and servers.

18. Changes to this privacy policy

We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements or to reflect changes to our services in the privacy policy (e.g. when introducing new services). The new privacy policy will then apply to your next visit.

Date: 24 May 2026

Review widget (Elfsight Reviews)

On our website, we use the “All-in-One Reviews” widget from Elfsight Limited to display collected customer reviews.

Provider: Elfsight Limited, Eptapaterou 24, Mesa Geitonia, 4003 Limassol, Cyprus. Website: https://elfsight.com

Data processed: When a page containing the Elfsight widget is accessed, technical information is transmitted to Elfsight’s servers or their Content Delivery Network (Cloudfront/AWS). This includes, in particular:

• IP address
• Browser type and version
• Operating system
• Referrer URL (previously visited page)
• Date and time of access

Purpose: Displaying aggregated customer reviews to build trust with visitors to our marketplace.

Legal basis: Art. 6(1)(a) GDPR (consent via our cookie banner). Consent may be withdrawn at any time — see cookie settings in the footer.

Transfer to third countries: Elfsight uses servers in the USA and the EU. When data is transferred to the USA, there is a risk that US authorities may access the data. Elfsight undertakes to comply with the EU-US Data Privacy Framework.

Retention period: The exact retention period for individual data can be found in Elfsight’s privacy policy: https://elfsight.com/privacy-policy/

Right to object: You can disable the widget via the cookie settings in our cookie banner.

Direct contact with sellers via WhatsApp, Telegram and email

What data is displayed publicly?

Sellers (“Vendors”) on machinery-market.eu may voluntarily provide the following contact details in their Vendor profile, which are then publicly visible on the product pages of the respective seller:

• WhatsApp phone number (as a clickable button)
• Telegram username (as a clickable button)
• Enquiry email address (optional)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the seller) and Art. 6(1)(a) GDPR (consent of the seller through active submission).

Responsibility: The individual seller is responsible for the accuracy, up-to-date nature and GDPR compliance of the contact details entered. machinery-market.eu acts solely as a platform that displays this data.

What happens when you click on the WhatsApp or Telegram button?

When you click on the WhatsApp or Telegram buttons, you will be redirected to the respective third-party platform:

• WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland — part of the Meta group of companies): Data is transferred to Meta Platforms (IP address, device information, timestamp). Privacy policy: whatsapp.com/legal/privacy-policy-eea
• Telegram (Telegram FZ-LLC, P.O. Box 502321, Dubai, UAE): Data is transferred to Telegram. Privacy policy: telegram.org/privacy

Data transfer to third countries: WhatsApp data may be transferred to the USA (standard contractual clauses in accordance with EU Commission Decision 2021/914). Telegram processes data in the UAE, amongst other places; the protection of personal data there may be lower than that required by the GDPR.

Content of communication: Subsequent communication between you and the seller takes place exclusively between you and the seller and is no longer our responsibility. We recommend that you do not transmit any sensitive personal data (bank details, copies of ID documents, etc.) via these channels.

Click tracking

To track the reach of the direct contact buttons (statistical analysis, vendor billing), we store the following with every click:

• Vendor ID (internal seller identifier)
• Product ID
• Channel (WhatsApp / Telegram / Message)
• Timestamp
• Anonymised hash of the IP address (no plain text, no traceability to individual persons)

Legal basis: Art. 6(1)(f) GDPR. Retention period: 12 months.

Messaging function on machinery-market.eu (“Message to seller”)

The “Message to seller” button opens an internal messaging system on the platform. Registration is required to use this feature. Messages are stored in encrypted form on our servers.

Access by the platform operator: As the platform operator, we have technical access to the content exchanged between buyers and sellers via the platform’s internal messaging functions (vendor communication, hire purchase/leasing enquiries, enquiry forms). There is no systematic or automated analysis of this content. We access it only on an ad hoc basis, namely:

• to handle complaints and mediate disputes between users,
• to prevent spam, harassment, fraud or illegal content,
• to fulfil statutory obligations to cooperate with and provide information to authorities,
• to ensure the technical functionality of the platform.

Legal basis: Article 6(1)(b) of the GDPR (performance of the platform usage agreement) and Article 6(1)(f) of the GDPR (legitimate interest in a platform free from misuse). As well as obligations under the Digital Services Act (Regulation (EU) 2022/2065), in particular Art. 16 et seq. (notice-and-action procedure).

Retention period: Messages and enquiries are retained for 24 months after the last activity in the thread and subsequently deleted, provided that no statutory retention obligations or an ongoing dispute prevent deletion.

Recipients: Within machinery-market.eu, messages are visible to: (a) users directly involved in the thread (buyers and sellers), (b) employees of GSK Handels- und Service GmbH authorised to manage the platform (on a case-by-case basis). Information will only be disclosed to third parties where this is strictly necessary for the processing of the matter (e.g. financing partners in the case of leasing enquiries) or required by law (e.g. law enforcement authorities).

Your rights

You have the right at any time to access, rectify, erase, restrict processing and data portability in accordance with Articles 15–22 of the GDPR. Contact: info@machinery-market.eu