Privacy Policy

for the machinery-market.eu platform

1. Data Controller and Scope

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection legislation for the processing of personal data in connection with the machinery-market.eu platform is:

GSK – TechTrade
Owner: Uwe Schrenk

An den Gewerbewiesen 17

67374 Hanhofen

Germany

Telephone: +49 6344 9261444

Email: info@machinery-market.eu

This privacy policy applies to the processing of personal data in connection with the use of the website https://machinery-market.eu, its subdomains, mobile versions and associated online services.

2. Data Protection Officer

We have not currently appointed a Data Protection Officer, as we do not meet the requirements set out in Article 37 of the GDPR in conjunction with Section 38 of the BDSG. If you have any questions regarding data protection, please contact us directly at info@machinery-market.eu.

3. General information on data processing

(1) As a general rule, we process our users’ personal data only to the extent necessary to provide a fully functional website, our content and services, or where such processing is permitted on another legal basis.

(2) The processing of personal data generally takes place only with the user’s consent or on one of the legal bases set out in Article 6(1) of the GDPR, in particular for the performance of a contract, to comply with legal obligations or to safeguard legitimate interests.

(3) Where we obtain the data subject’s consent for the processing of personal data, Article 6(1)(a) of the GDPR serves as the legal basis. Where processing is carried out for the performance of a contract, Article 6(1)(b) of the GDPR serves as the legal basis. Where processing is necessary for compliance with a legal obligation, Article 6(1)(c) of the GDPR serves as the legal basis. Where processing is necessary to safeguard a legitimate interest of our company or a third party, and the data subject’s interests, fundamental rights and freedoms do not override the aforementioned interest, Article 6(1)(f) of the GDPR serves as the legal basis.

4. Provision of the website and creation of log files

(1) Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected in server log files:

  • IP address of the requesting device (usually anonymised or truncated shortly afterwards);
  • Date and time of access;
  • URL accessed and HTTP method;
  • Referrer URL;
  • Browser and operating system used (user agent);
  • Status code and amount of data transferred.

(2) This data is not stored together with any other personal data relating to the user.

(3) The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the technical provision of the website, ensuring the stability and security of the systems, and investigating any attempts at misuse.

(4) Log files are generally deleted or anonymised after a maximum of 30 days, unless longer storage is required in individual cases to investigate a specific security incident.

4a. Counting visits from social networks (without cookies)

(1) We would like to know whether visitors reach our platform via social networks (TikTok, Instagram, YouTube, Facebook, LinkedIn), for example through our own posts. For this purpose, when a page is requested, our server checks whether the requested address contains a campaign parameter (e.g. “utm_source=instagram”) or a Facebook/Instagram click identifier (“fbclid”), or whether your browser transmits one of these networks as the previously visited page (referrer).

(2) We store only a daily counter per network, campaign information and requested page (example: “26 Oct: Instagram, campaign ‘Reel’, listing 4085 – 3 visits”). We do not store IP addresses, device identifiers, the click identifier itself or any other information about you for this purpose. No cookies are set for this counting; we only evaluate information that your browser transmits anyway when requesting a page.

(3) In order to recognise whether such visits lead to enquiries, we note in the server-side session of our platform which network you came from. This session exists anyway for technical reasons (session cookie, see Section 5); no additional cookie is set. If you subsequently send an enquiry (message to a seller, click on WhatsApp or Telegram, leasing or hire-purchase enquiry), we merely increase a counter (e.g. “Instagram, listing 4085: 1 enquiry”). Your enquiry itself and your contact details are not stored linked to the network. The note is no longer taken into account after 7 days at the latest and is deleted when the session expires.

(4) The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in measuring the effectiveness of our posts on social networks and aligning our offering accordingly. The daily counters do not allow any conclusions to be drawn about individual persons and are retained for statistical purposes. You may object to this processing as described in Section 14.

4b. Our presence on social networks

(1) We maintain accounts on Instagram (@machinerymarket.eu; provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), TikTok (@machinerymarket.e; provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland) and YouTube (@machinerymarket_eu; provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you visit these accounts, the respective provider processes your data under its own responsibility in accordance with its own privacy policy; data may also be transferred to countries outside the European Union.

(2) The providers make aggregated statistics on the use of our accounts available to us (e.g. views, reach). We do not receive any data from these statistics that would allow individual persons to be identified. Insofar as we are jointly responsible with the provider for these statistics (Article 26 GDPR), the agreements provided by the provider for this purpose apply; in the case of Meta, this is the joint controller agreement for Insights data, under which Meta assumes primary responsibility for the processing and for fulfilling the rights of data subjects.

(3) The legal basis for our accounts is Article 6(1)(f) of the GDPR; our legitimate interest lies in providing information about our platform and communicating with interested parties. If you send us a message via these accounts, we process your information in order to handle your request (Article 6(1)(b) or (f) GDPR). You can assert your rights both against us and against the respective provider; as a rule, only the provider itself can provide complete information about the data it processes.

4c. Our own reach measurement without cookies (counting page views and visits)

(1) So that we and the sellers on our platform know how often listings, seller pages, categories, the home page and the search are actually viewed by people, we use our own reach measurement, which runs on our server. No third-party provider is involved: the data is processed exclusively on our own server at our hosting provider (see Section 9) and is not passed on to third parties. Sellers only see totals (e.g. “181 visitors”), no information about individual visitors.

(2) Without your consent in the cookie banner, we do not set any cookies for this measurement and do not store anything in your browser (including localStorage or sessionStorage). A small script on the page only reports a view to our server once you have interacted with the page (e.g. scrolling, tapping, clicking); for listing, seller and search pages it is also sufficient if the page has been visibly open for at least 6 seconds. Only the page type and the number of the listing, seller or category viewed are transmitted. So that automated requests (e.g. crawlers and remote-controlled browsers) are not counted, the script also checks a few technical characteristics of your browser (e.g. whether it is flagged as automated, whether a language setting is present, the window size, the time since the page was loaded and the time on your device) and only transmits the result as a short code or number. This information is not stored; we only count how many views were not counted and for which reason (without reference to individual visitors). In addition, we filter out automated requests on the basis of the browser identifier.

(3) To ensure that the same visitor is counted only once per day, our server generates a check value (a hash value using a secret key) from your IP address, your browser identifier (user agent) and the date. We do not store your IP address or your browser identifier themselves for this purpose. For each view, we store one record containing the date and time, the page type, the number of the listing, seller or category, the type of visitor (guest, logged-in customer, seller) and the check value.

(4) On the first page of your visit, the script additionally transmits which website you came from (only the domain name, e.g. “google.com”, not the full address), any campaign parameter (“utm_source”) contained in the requested address, and whether the address contains a Google Ads or Google Shopping click identifier (the identifier itself is not transmitted). From this, our server derives only a broad entry source – such as “Google”, “Google Ads”, “Google Shopping”, “Bing”, “other search engine”, a social network (e.g. LinkedIn, Facebook, Instagram, YouTube, X), “messenger”, “AI assistant”, “seller website”, “email/newsletter”, “campaign”, “other website” or “direct” – and stores only this category. The domain name, the campaign parameter and the full referrer address are not stored.

(5) We only need the check value to avoid counting the same visitor more than once on the same day and across midnight. It is therefore stored for at least one day and generally until the end of the following day, and is then irreversibly replaced by a random value in the next daily deletion run (usually immediately after midnight); the random key used for this is not stored. Example: the check value of a view on 26 October is replaced after 27 October has ended. After that, no record can be attributed to an IP address or a device. What remains are purely statistical counts (views and visits per day, page and entry source) without any personal reference, which we keep for statistical purposes; the time of the view is reduced to the date after 12 months at the latest.

(6) If you consent to the service “Own reach measurement (views for sellers)” (category “Performance cookies”) in the cookie banner, the script additionally keeps a random session ID and the entry source for the duration of your browser session (sessionStorage) and one marker per page and day so that nothing is counted twice (localStorage). In that case we also store the session ID (cleared after 12 months), the domain name of the referring website and which listings you clicked on from an overview page. The legal basis for this is your consent (Section 25(1) TDDDG in conjunction with Article 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the cookie settings.

(7) The legal basis for counting without consent as described in paragraphs 2 to 5 is Article 6(1)(f) GDPR. Our legitimate interest lies in measuring the reach of our platform and of individual listings, providing our sellers with reliable view figures free of bot traffic, assessing the success of our advertising and search engine presence, and aligning our offering accordingly. The processing is limited to what is necessary: no cookies, no storage of IP addresses, no disclosure to third parties, and the check value is generally replaced after the end of the following day. You can object to this processing at any time as described in Section 14; please contact us using the details given in Section 1.

4d. Improving our inquiry form (step measurement without cookies)

(1) To find out where the “Message seller” form causes difficulties and to improve it, we record on our own server which steps of the form are completed – for example: form opened, first field clicked, required fields filled in, “Send” clicked, notice about a missing or invalid field (only which field, not its content), confirmation e-mail sent, confirmation completed, message delivered, form closed or page left. No third-party provider is involved.

(2) For this purpose, a script generates a random identifier for this single pass through the form when the form is opened. It exists only in the memory of the open page and is not stored in a cookie, in localStorage or in sessionStorage; it disappears when the page is closed or reloaded. For each step we store: this identifier, the step, the time and the time elapsed since opening, the device type (smartphone, tablet or computer – our server derives it from the browser identification that is sent anyway; the browser identification itself is not stored), the language of the page, whether you are writing as a guest or signed in, and the number of the listing and of the seller.

(3) We do not store your entries (name, company, e-mail address, phone number, message text), your IP address, your browser identification or your customer account. The measurement data is not linked to your inquiry and is not passed on to sellers or third parties. Automated access (e.g. crawlers) is discarded. We delete the measurement data after 400 days.

(4) The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to identify and remove technical and language barriers in the inquiry form so that your inquiries reliably reach the sellers. You may object to this processing at any time in accordance with Section 14; please use the contact details given in Section 1.

5. Cookies and similar technologies

(1) Our website uses cookies and, where applicable, similar technologies (e.g. localStorage). Cookies are small text files that are stored in the user’s browser and contain certain information.

(2) We use the following categories of cookies:

  • Technically necessary cookies: required to ensure the website functions properly (e.g. session cookies, shopping basket/wishlist cookies, language selection, cookie consent storage). Legal basis: Section 25(2)(2) of the TDDDG (formerly the TTDSG) and Article 6(1)(b) and (f) of the GDPR.
  • Functional cookies: enable convenience features such as saving filter settings or recently viewed machines. Legal basis: consent in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR.
  • Statistical/analytical cookies: are used to measure reach and improve the service. Legal basis: Consent in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR.
  • Marketing/third-party cookies: enable, amongst other things, interest-based advertising. Legal basis: Consent in accordance with Section 25(1) of the TDDDG in conjunction with Article 6(1)(a) of the GDPR.

(3) A detailed overview of the cookies used, along with their providers, purposes and retention periods, can be found in our separate Cookie Policy.

(4) Analytics and marketing tools used: We use Google Tag Manager, Google Analytics 4 and Google Ads conversion tracking provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics and advertising cookies are only set once you have given your consent via the cookie banner (Section 25(1) of the TDDDG, Article 6(1)(a) of the GDPR); without consent, this storage is rejected by default via Google Consent Mode. Even without consent, cookie-free signals (e.g. that a page has been accessed) may be transmitted to Google. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework (Article 45 of the GDPR). You may withdraw your consent at any time via the cookie settings. Further details on cookies can be found in our Cookie Policy.

6. Registration and management of user accounts

(1) To register as a seller or buyer on the platform, we collect the information required for registration. This includes, in particular:

  • Company name and legal form;
  • Name and role of the contact person;
  • Address, country;
  • Email address, telephone number;
  • VAT registration number (if applicable);
  • Login details (username, password – the password is stored in encrypted form only);
  • for sellers additionally: selected tariff, desired number of listings, payment details, and, where applicable, bank details or payment service provider details.

(2) The legal basis for the processing is Article 6(1)(b) of the GDPR (performance of a contract or implementation of pre-contractual measures) and Article 6(1)(f) of the GDPR (legitimate interest in the smooth and abuse-free operation of the platform).

(3) The data is stored for the duration of the user agreement and beyond that to fulfil statutory retention obligations (in particular under commercial and tax law, typically six to ten years).

7. Contact form, enquiry function and messages between buyers and sellers

(1) When a buyer uses the contact form or enquiry function to contact a seller, we collect at least the following data:

  • Surname, first name, company name;
  • Address (if provided);
  • Email address, telephone number (if provided);
  • Content of the message and reference to the relevant advert;
  • Time of the enquiry.

(2) This data is used exclusively to respond to the enquiry or to forward it to the seller in question. The legal basis is Article 6(1)(b) of the GDPR (pre-contractual measures) or Article 6(1)(f) of the GDPR (legitimate interest in the efficient facilitation of transactions between sellers and buyers).

(3) Messages exchanged via an internal messaging system are stored for documentation purposes and to prevent misuse or fraud. We reserve the right to review messages in individual cases where there is reasonable suspicion of legal infringements.

8. Newsletters and marketing emails

(1) We do not currently offer a newsletter.

(2) We send newsletters and marketing emails exclusively with the express consent of the recipients (Article 6(1)(a) of the GDPR, Section 7(2) of the Unfair Commercial Practices Act (UWG)) or in accordance with the conditions set out in Section 7(3) of the Unfair Commercial Practices Act (UWG) (email advertising to existing customers).

(3) Consent may be withdrawn at any time with future effect, e.g. via the unsubscribe link in each email or by notifying us using the contact details set out in section 1.

9. Recipients of personal data and data processing on behalf of others

(1) Personal data will only be disclosed to third parties insofar as this is necessary for the performance of the contract, where there is a legal obligation to do so, or where you have given your express consent.

(2) In the course of operating the platform, we use the following categories of recipients:

  • Hosting service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (Privacy Policy: hetzner.com/de/rechtliches/datenschutz);
  • Payment service providers: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg (Privacy Policy: paypal.com/de/webapps/mpp/ua/privacy-full);
  • Email/transaction email services: ALL-INKL.COM — Neue Medien Münnich, owned by René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany (Privacy Policy: all-inkl.com/datenschutzinformationen);
  • Analytics, tracking and advertising service providers: see section 5;
  • IT service providers for maintenance and support;
  • Tax advisers, auditors and legal advisers to the extent necessary.

(3) Where we engage third parties to process personal data on our behalf, we enter into contracts with the relevant data processors in accordance with Article 28 of the GDPR.

(4) The data published by the seller as part of an advertisement (in particular company name, address and contact details) forms part of the advertisement and is displayed publicly.

10. Data transfers to third countries

(1) Where we transfer personal data to recipients outside the European Economic Area (EEA), this shall only take place if an adequate level of data protection exists or suitable safeguards (in particular, the European Commission’s standard contractual clauses pursuant to Article 46 of the GDPR) are in place, or where there is another legal basis under Article 49 of the GDPR.

(2) Data transfers to third countries take place only within the scope of the services described in the section ‘Direct contact with sellers’ (WhatsApp, Telegram) and the services provided by Google (clause 5(4)) mentioned in this policy. All our technical service providers (hosting by Hetzner Online GmbH in Germany, email dispatch via ALL-INKL.COM in Germany, payment processing via PayPal in Luxembourg) process your data exclusively within the European Economic Area (EEA) in accordance with the GDPR.

(3) In addition to paragraph 2: for advertising under the section “Advertising the platform with listings” we transmit listing data to Google and publish content on Meta, TikTok and LinkedIn. These providers may also transfer the data to third countries, in particular to the USA; according to their own information they rely on adequacy decisions (e.g. EU-US Data Privacy Framework) or on standard contractual clauses (Art. 46 GDPR).

11. Retention period

(1) We process and store personal data only for as long as is necessary to fulfil the respective purpose of processing or to the extent required by statutory retention obligations.

(2) User account master data is stored for the duration of the user agreement. Upon termination of the contract, the data will be deleted, provided that no statutory retention obligations prevent this. In particular, accounting documents and tax-relevant documents are retained for ten years, whilst other business correspondence is retained for six years (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)).

(3) Data from contact enquiries shall be deleted at the latest once the purpose for which it was processed no longer applies, provided that no retention obligations or legitimate interests preclude longer storage.

12. Rights of data subjects

You have the following rights in relation to us regarding your personal data:

  • Right of access (Article 15 of the GDPR);
  • Right to rectification (Article 16 of the GDPR);
  • Right to erasure (Art. 17 GDPR);
  • Right to restriction of processing (Art. 18 GDPR);
  • Right to object to processing (Art. 21 GDPR);
  • Right to data portability (Art. 20 GDPR);
  • Right to withdraw consent with effect for the future (Article 7(3) of the GDPR).

To exercise your rights, simply send an informal message to the contact details set out in point 1.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent supervisory authority for us, as the data controller based in Hanhofen, Rheinland-Pfalz, is:

The State Commissioner for Data Protection and Freedom of Information in Rheinland-Pfalz (LfDI RLP)

Hintere Bleiche 34

55116 Mainz

Telephone: +49 6131 8920-0

Email: poststelle@datenschutz.rlp.de

Website: https://www.datenschutz.rlp.de

You may also contact any other supervisory authority in the Member State where you reside, where you work, or where the alleged infringement took place.

14. Right to object to processing based on legitimate interests

Where the processing of your personal data is based on legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation. In the event of an objection, we will cease processing the data in question, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

15. Obligation to provide personal data

The provision of personal data is not required by law or by contract. You are not obliged to provide us with any data. However, failure to provide such data may mean that you are unable to use our services, either in whole or in part (e.g. you will not be able to register as a seller or contact a supplier).

16. Automated decision-making and profiling

17. Data security

We take technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons. Our security measures are continuously improved in line with technological developments. Data transfers via the internet are encrypted (e.g. TLS), where supported by browsers and servers.

18. Changes to this Privacy Policy

We reserve the right to amend this privacy policy to ensure it always complies with current legal requirements or to reflect changes to our services in the privacy policy (e.g. when introducing new services). The new privacy policy will then apply to your next visit.

Last updated: 24 May 2026

Display of reviews (Google reviews)

Our website shows an overview of Google reviews (overall rating, number and selected reviews). Our server retrieves this data regularly from Google via the Google Places API (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; where applicable Google LLC, USA). No data about you as a visitor is transmitted to Google in this process; your browser does not connect to Google to display the reviews. The reviewers' profile pictures and the Google Maps logo are also delivered from our own server.

Only if you click a link such as "View on Google", "All reviews on Google" or "Write a review" will you be taken to Google; Google's privacy policy then applies (https://policies.google.com/privacy).

If you hide the review display with the "×", we store this setting only locally in your browser (localStorage, entry "mm_rb_hidden" with the time). No cookie is set and nothing is transmitted to us. The display reappears after 30 days; you can delete the entry at any time in your browser settings. Legal basis for storing it is Section 25(2) no. 2 TDDDG (function expressly requested by you); for displaying the reviews Art. 6(1)(f) GDPR (our legitimate interest in a transparent presentation of customer reviews).

The following are displayed – as published on Google – the name or display name and profile picture of the reviewers, stars, date and text of the review and a link to the review on Google. Our server stores this information temporarily for display; it is usually updated daily and overwritten or deleted after 30 days at the latest. We also output the overall rating and number of reviews and, where applicable, a single review (with the name of the reviewer) as structured data in the source code of the pages for search engines. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the transparent presentation of publicly available customer reviews. If reviewers change or delete their review on Google, we adopt this with the next update. You can object to the display in accordance with section 14.

Advertising the platform with listings (Google Shopping, Google Ads, social networks)

(1) We advertise our platform and our sellers’ listings. For this purpose we transmit listing data (title, description, images, price, condition, link and name of the seller) via a product feed to Google Merchant Center so that they can appear in Google Shopping and in Google Ads advertisements. We also use images, videos and texts from listings as well as sellers’ company names and logos in posts and short videos (e.g. Reels and Shorts) on our profiles on Instagram, Facebook, TikTok, YouTube and LinkedIn, in our blog and in newsletters.

(2) This content primarily concerns companies. Personal data is only affected insofar as a listing contains it, for example the name of a contact person, a company name containing a personal name or recognisable persons in photos. We do not pass on data of visitors to our website in this context; how we measure whether visitors come to us via ads or posts is described in sections 4a, 4c and 5.

(3) The legal basis is Art. 6(1)(b) GDPR (contract with the seller under the Terms and Conditions for Sellers) and Art. 6(1)(f) GDPR (legitimate interest in advertising the platform and the listings). Published content is processed by the providers under their own responsibility: Google Ireland Limited (Google Shopping, Google Ads, YouTube), Meta Platforms Ireland Limited (Instagram, Facebook), TikTok Technology Limited and LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland). A transfer to third countries is possible (section 10).

(4) After the end of a seller contract we create no new posts with its content; posts already published remain available for no more than 12 months. Sellers and persons depicted or named can object to the use in social networks at any time (section 14, e-mail to info@machinery-market.eu); we will then create no new posts and remove existing ones within a reasonable period.

Direct contact with sellers via WhatsApp, Telegram and email

What data is displayed publicly?

Sellers (“Vendors”) on machinery-market.eu may voluntarily provide the following contact details in their vendor profile, which are then publicly visible on the respective seller’s product pages:

  • WhatsApp phone number (as a clickable button)
  • Telegram username (as a clickable button)
  • Enquiry email address (optional)

Legal basis: Article 6(1)(f) of the GDPR (legitimate interest of the seller) and Article 6(1)(a) of the GDPR (consent of the seller through active submission).

Responsibility: The individual seller is responsible for ensuring that the contact details entered are correct, up to date and compliant with the GDPR. machinery-market.eu acts solely as a platform that displays this data.

What happens when you click on the WhatsApp or Telegram button?

When you click on the WhatsApp or Telegram buttons, you will be redirected to the respective third-party platform:

  • WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland — part of the Meta group of companies): Data is transferred to Meta Platforms (IP address, device information, timestamp). Privacy policy: whatsapp.com/legal/privacy-policy-eea
  • Telegram (Telegram FZ-LLC, P.O. Box 502321, Dubai, UAE): Data is transferred to Telegram. Privacy policy: telegram.org/privacy

Data transfers to third countries: WhatsApp data may be transferred to the USA (standard contractual clauses in accordance with EU Commission Decision 2021/914). Telegram processes data in the UAE, amongst other places; the level of protection for personal data there may be lower than that required under the GDPR.

Content of the communication: Any subsequent communication between you and the seller takes place exclusively between you and the seller and is no longer our responsibility. We recommend that you do not transmit any sensitive personal data (bank details, copies of ID documents, etc.) via these channels.

Click tracking

To track the reach of the direct contact buttons (for statistical analysis and vendor billing), we store the following information with every click:

  • Vendor ID (internal seller identifier)
  • Product ID
  • Channel (WhatsApp / Telegram / Message)
  • Timestamp
  • Anonymised hash of the IP address (no plain text, no traceability to individual persons)

Legal basis: Article 6(1)(f) of the GDPR. Retention period: 12 months.

Messaging function on machinery-market.eu (‘Message to seller’)

The ‘Message the seller’ button opens an internal messaging system on the platform. Registration is required to use this feature. Messages are stored in encrypted form on our servers.

Access by the platform operator: As the platform operator, we have technical access to the content exchanged between buyers and sellers via the platform’s internal messaging functions (vendor communications, hire-purchase/leasing enquiries, enquiry forms). There is no systematic or automated analysis of this content. We access it only on a case-by-case basis, namely:

  • to handle complaints and mediate disputes between users,
  • to prevent spam, harassment, fraud or unlawful content,
  • to fulfil statutory obligations to cooperate with and provide information to public authorities,
  • to ensure the technical functionality of the platform.

Legal basis: Article 6(1)(b) of the GDPR (performance of the platform usage agreement) and Article 6(1)(f) of the GDPR (legitimate interest in maintaining a platform free from misuse). As well as obligations under the Digital Services Act (Regulation (EU) 2022/2065), in particular Article 16 et seq. (notice-and-action procedure).

Retention period: Messages and enquiries are retained for 24 months following the last activity in the thread and are subsequently deleted, provided that no statutory retention obligations or an ongoing dispute prevent such deletion.

Recipients: Within machinery-market.eu, messages are visible to: (a) users directly involved in the thread (buyers and sellers), (b) GSK – TechTrade staff authorised to manage the platform (on a case-by-case basis). Information will only be disclosed to third parties where this is strictly necessary to process the matter (e.g. financing partners in the case of leasing enquiries) or where required by law (e.g. law enforcement agencies).

Your rights

You have the right at any time to access, rectify, erase, restrict the processing of, and to data portability in accordance with Articles 15–22 of the GDPR. Contact: info@machinery-market.eu