Privacy policy

1. Controller

The controller for the processing of personal data on this website is:
Tim Schneider
TradeDay&Night (Einzelunternehmen)
Cranachstr. 2
64546 Mörfelden-Walldorf
Germany
kontakt@tradedaynight.de

No data protection officer has been appointed. The statutory thresholds of § 38 BDSG (the German Federal Data Protection Act) are not met.

2. What data we process

The following data is processed in the course of operating the platform:

• Account data: email address, username, password (stored only as a hash), the times of registration and of signing in. You choose your username yourself when registering (3 to 20 characters, changeable at most every 30 days). It is publicly visible – for example on your table, on reviews and in the chat – so it should contain neither your full name nor contact details. Your date of birth is only requested at registration to check that you are of legal age; we store only the time of this confirmation, not the date.
• Signing in with Google or Apple: If you sign in with your Google account, Google sends us your email address, your name and an identifier of your Google account; we use them to create your account or sign you in. We never learn your Google password. The provider is Google Ireland Limited (Ireland); a transfer to Google LLC (USA) is possible. We will offer signing in with Apple (Apple Distribution International Ltd., Ireland) as soon as it is enabled; there you can hide your email address. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR).
• Profile data: dealer status, membership status, reviews.
• Content: listings, product photos, chat messages, price offers and exchange offers between users. If someone changes the price of a card, lists a new card or deletes one, we store the title of the card, the price – for a change the old and the new one, for a deleted card the last one –, who did it and when; only the owner of the table can see this. We delete these entries automatically after twelve months.
• Chats and how long we keep them: Messages, offers and pictures in the chat of a request are seen only by those involved – on the dealer's side also by the staff they have authorised. With “Hide for me” you remove a finished chat from your list. We delete chats without a paid purchase as soon as everyone involved has hidden them, otherwise seven days after they ended. For a paid purchase we delete the content of the chat (messages and pictures) twelve months after the order last changed; the request, the order, the review and the line with the accepted offer remain as a record. As long as a problem or dispute is open or a report about the chat has not been decided, we do not delete anything. The legal basis is Art. 6(1)(b) GDPR (handling the transaction) and (f) GDPR (evidence in case of chargebacks and claims from the purchase). A chat without a purchase in which nothing has happened for 30 days also counts as ended; we announce the deletion in the chat beforehand. We also email you about new messages, offers and requests in the chat. You can unsubscribe from these emails at any time – under “My account” → “Notifications” or via the link in each of these emails; for this we store a random identifier per account, which we delete together with the account. Notifications in the app are not affected, and emails about orders, payments, deadlines and the security of your account will still reach you.
• Photos and videos: When you upload photos we make them smaller and remove embedded information such as the camera, the time and the place of capture; for videos we remove the place of capture. Photos and videos of your cards are publicly visible as long as the card is offered.
• Shipping address: first name, surname, street, house number, postcode, town and country. This data is only shown to the other contracting party once a deal has been confirmed as binding and paid for – before that it is not visible to the other side. We do not ask for a telephone number and do not store one as long as we do not offer shipping labels; we have deleted numbers provided voluntarily in the past.
• Order and payment data: order number, amount, shipping costs, commission rate, status of the order, the times of payment, dispatch and confirmation of receipt, and the payment's identifier at the payment service provider. Card, bank account and identity document data is not processed by us but exclusively by the payment service provider Stripe; we do not see it at any point.
• Payment methods at checkout: You pay on Stripe's payment page. Which payment methods appear there depends on your country, the amount and your device: card, Apple Pay, Google Pay, Link (payment details saved with Stripe), bank transfer, iDEAL, Bancontact, EPS, Przelewy24, Revolut Pay, Amazon Pay, MobilePay, MB WAY, Multibanco and Satispay. You enter your payment details directly with Stripe or the service concerned; we only see the amount, the time, the payment method and the payment's identifier. Depending on the method, the following also process data under their own responsibility: the card schemes and your bank; Apple or Google for the approval on your device (Apple Pay, Google Pay); for Revolut Pay, Amazon Pay, MobilePay, MB WAY and Satispay the provider concerned; for iDEAL, Bancontact, EPS, Przelewy24, Multibanco and bank transfer your bank and the operator of the scheme. Their privacy notices apply. The legal basis is Art. 6(1)(b) GDPR. If Stripe offers you PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) additionally processes your data under its own responsibility.
• Chargebacks: If a buyer reverses a payment through their bank, we send the payment service provider Stripe evidence from the order, which Stripe passes on to the buyer's bank: order number, type of order and titles of the cards, the name of the table with the information whether it sells privately or commercially, the TradeDay&Night usernames of seller and buyer, amount and time of the payment, carrier, tracking number and shipping date, postcode and country of the delivery address, whether and when receipt was confirmed, and the history of the order (payment, shipment, receipt, reported problems, refunds). If that is not enough, we add further evidence from the order in individual cases, such as an extract from its chat. The legal basis is our legitimate interest, and that of the dealer, in defending against unjustified chargebacks (Art. 6(1)(f) GDPR).
• Balances of dealers' payment accounts: Once a day we read from Stripe the balance of every dealer payment account – amount, currency and whether the direct debit for a negative balance is set up – and store only the latest status with the dealer's account; it is visible only to us. This lets us spot a negative balance, for example after a chargeback, and claim outstanding amounts. When we reconcile the payment account, we also store the country and currency of the linked bank account and whether Stripe can settle a negative balance by direct debit; this determines the waiting period before payouts (7 or 30 days). The legal basis is Art. 6(1)(b) and (f) GDPR.
• Minimum age of dealers: Each time we reconcile a dealer payment account, we check whether Stripe lists the account holder as a minor – from the date of birth, where Stripe passes it on to us, and from whether Stripe requires or has recorded a legal guardian. We store only the result, not the date of birth. If the account holder is under 18, opening a table and selling stay blocked, because TradeDay&Night can only be used from 18. The legal basis is Art. 6(1)(b) and (f) GDPR.
• Outstanding claims and debt collection: If a user owes us an amount after a chargeback, we store the claim with the account, order, amount, fee, reason and status. If it remains unpaid, we may hand it over to a debt collection agency together with the details needed for that – name, address, email address, order and amount; this only happens if a claim is outstanding. The legal basis is our legitimate interest in enforcing our claims (Art. 6(1)(f) GDPR). We keep the details of the claim like the other order and payment data (section 6).
• Documents for a police report on a part-exchange: If a dealer does not return the buyer's cards in time on a part-exchange, we provide the buyer with documents for a police report. Besides the details of the order, they contain the dealer's name and address – the shipping address that was already released to the buyer for the part-exchange – and, for commercial dealers, the seller information. The legal basis is the buyer's legitimate interest in reclaiming their cards and reporting the matter (Art. 6(1)(f) GDPR). We give these details to the law enforcement authorities on request (Art. 6(1)(c) or (f) GDPR).
• Approximate location: When you open a page, our host Vercel derives your country and an approximate location (roughly city level) from your IP address and passes both to our servers. We use this only to sort fairs and dealer tables by proximity and to tell you whether a table ships to your country. If you are signed in and have saved a shipping address, we use the country of that address instead. This information is not stored, not linked to your account and not passed on to third parties; nothing is shown or hidden because of it, only the order changes. The legal basis is our legitimate interest in a clear presentation that suits you (Art. 6(1)(f) GDPR). We also use this country to choose the language if you open an address without a language in it and neither a language you chose earlier nor your browser's language setting matches one of our languages.
• Dealers' tax details: Dealers provide their name, address, date of birth or commercial register number, tax identification number, their VAT identification number where applicable and, voluntarily, their bank details. Under the German Platform Tax Transparency Act (EU Directive DAC7), platform operators must report sellers, the number of their sales, their revenue and the fees withheld to the Federal Central Tax Office (BZSt) once a year; the BZSt may pass the data on to the tax authorities of other EU states. Only sellers who reach the statutory thresholds are reported (30 sales or more than €2,000 a year). If the details are missing once a seller becomes reportable, we request them and send two reminders (after 20 and 40 days); if they are still missing after 60 days, new sales are paused until they are provided (Section 22 PStTG). We check a VAT identification number that has been provided – from dealers and, for purchases on behalf of a company, also from buyers – in the European Commission's VAT Information Exchange System (VIES); only the number is sent there, and the reply states whether it is valid and, where applicable, the name registered for it. The legal basis is Art. 6(1)(c) GDPR. The details are kept for ten years, as required by law. Dealers without tax details can voluntarily provide a billing address (name or company and address) in their payment account so that their commission statements receive a statement number (Art. 6(1)(b) GDPR); it can be removed at any time and is deleted together with the account, while statements already issued are retained like invoices.
• Private sellers – count, review pause and self-assessment: For tables run as private, we count the paid sales and their total per calendar year. From 20 sales or €1,500 we point this out; from 30 sales or €2,000 new sales are paused until the seller has provided complete tax details and answered a self-assessment (for example: do you buy specifically in order to resell? do you sell new, sealed goods?). For this we also look at the cards on their table – how often the same card appears and how much sealed product there is. If the answers are unremarkable, the pause ends automatically; otherwise a human reviews the case. The pause arises automatically and is provisional; a block is always imposed by a human. Via the contact form you can ask at any time for a human to review the case. We keep the count, the answers and the decision until the end of the third year after the calendar year concerned. No message to the tax office is connected with this. The legal basis is our legitimate interest, and that of buyers, in nobody presenting themselves as private while acting commercially (Art. 6(1)(f) GDPR).
• Records under Section 22f of the German VAT Act: For every sale on TradeDay&Night we record what Section 22f of the German VAT Act (UStG) requires: the seller's name and address (for private sellers also the date of birth, for business sellers the email address and VAT identification number), tax number and bank details where known, the country of dispatch, the country, postcode and town of delivery, the time and amount, the cards sold and the order number. If a dealer changes their trader details or tax details or deletes their account, we keep the earlier version as far as earlier sales require it. We keep these records for ten years and provide them electronically to the tax office on request (Section 22f(4) UStG; Art. 6(1)(c) GDPR). Anyone reported under the Platform Tax Transparency Act learns by 31 January of the following year, by email and in the dealer area, what we reported. Dealers can download their sales as a spreadsheet; it contains the buyer's username and the country, postcode and town of delivery, which they receive for shipping anyway.
• Seller details of commercial sellers: Commercial sellers must give buyers their name or company, address and contact details (§ 312l BGB, Art. 246d EGBGB). These details are on a separate page of the table. The email address only appears after a click; for this we count the requests per visitor – when signed in via the user identifier, otherwise via a non-reversible key derived from the IP address – and delete this count after two days, so that nobody can harvest the addresses automatically. We only show the telephone number if the seller has expressly released it. With every order we record the details as they applied at the time of purchase. The legal basis is Art. 6(1)(c) GDPR, and point (f) for the request limit.
• Waiting list for further countries: If you join the waiting list for a country in which dealer accounts are not yet possible, we store the country, the language of the page and the time with your account. As soon as dealer accounts are possible there, we email you at your account's address; 30 days after this email we delete the entry. You can leave the waiting list at any time in the same place, and the entry is also deleted together with your account. The legal basis is your consent (Art. 6(1)(a) GDPR), which you withdraw by leaving the waiting list.
• Launch list: If you sign up for the launch list before we open, we store your email address, the language of the page, the version of the consent text and the times of sign-up and confirmation – based on your consent (Art. 6(1)(a) GDPR). You first receive an email to confirm; without confirmation, we delete the entry after 7 days. At launch, we send you exactly one email and then delete your address. You can unsubscribe at any time via the link in the confirmation email; this withdraws your consent. To prevent abuse, we count sign-ups per address and per IP address, as described under the rate limits. The emails are sent via Resend.
• Address suggestions and address check: When you enter your shipping address, we suggest matching addresses and check on saving whether the address exists. For this, our server sends the address text you entered – without your name and without your IP address – to Photon, an address service of komoot GmbH (Germany) based on the open map data of OpenStreetMap. We do not store these requests. The legal basis is the performance of the contract, which requires a deliverable address (Art. 6(1)(b) GDPR), and our legitimate interest in error-free shipments (Art. 6(1)(f) GDPR).
• Protection against automated requests: In the forms for signing in, registering, resetting your password, contacting us, redeeming vouchers, submitting wishes and cancelling contracts, our host Vercel (BotID) checks whether a human is submitting them. For this, technical characteristics of your browser and your IP address are evaluated; no cookies for advertising or analytics are created. The legal basis is our legitimate interest in protecting the platform and its users from abuse such as mass sign-in attempts and spam (Art. 6(1)(f) GDPR). In the forms for signing in, registering, resetting your password, contacting us and reporting content, Cloudflare Turnstile is also used (see section 4). A box to tick only appears if we suspect an automated request – for example after many failed attempts.
• Limits against abuse: To protect accounts and mailboxes from mass attempts, we count failed sign-ins as well as registrations, password reset requests, contact messages, reports without an account and voucher redemptions – each per email address or account and per IP address. For this we store neither the address nor the IP address itself, only a check value formed with our key (HMAC) that cannot be reversed without this key; it is deleted after one day at the latest, and the failed attempts for an address already at the next successful sign-in. If a limit is reached, we ask for a short confirmation or a little patience. The legal basis is our legitimate interest in protecting the platform and its users from abuse (Art. 6(1)(f) GDPR).
• Automatic chat filter and warnings: Before a message is sent, the chat automatically checks it for telephone numbers, email addresses, postal addresses, contacts in other services and external links – this protects buyers and sellers from fraud outside the platform. Clear cases are not delivered and lead to a warning; unclear cases are only not delivered. After three warnings within 30 days the chat is blocked for 30 days; browsing, buying and orders in progress remain possible. We store the warning, its time and the reason. This block arises automatically: via the contact form you can ask at any time for a human to review it, state your point of view and contest it; if it was not justified, we lift it. The legal basis is our legitimate interest in running the platform securely and free of misuse (Art. 6(1)(f) GDPR).
• Reports of content: Anyone who reports content via “Report” sends us the reason, a description, voluntarily an email address and – when signed in – up to five pictures as evidence; a report made while signed in is linked to the account; for a report from a chat we look at the chat history concerned. We decide on the report and inform the person reporting and the person concerned of the decision with reasons (Art. 16 and 17 Digital Services Act). We keep the report as a record of the decision; we delete the pictures six months after the decision, once the period for a complaint has expired. The legal basis is Art. 6(1)(c) GDPR in conjunction with the Digital Services Act and our legitimate interest in a safe platform (point (f)).
• Blocking: If you block an account, we store who blocked whom, so that no new requests or messages arise between you. Orders in progress are still completed. The block applies until you lift it or one of the accounts is deleted. The legal basis is Art. 6(1)(b) and (f) GDPR.
• Contact form and email: If you write to us via the contact form, we process your name, email address and message in order to reply. The message reaches us through our mail service (Resend) as an email in our mailbox at Google (Gmail). We keep the correspondence for as long as your request needs it, and beyond that only where a statutory retention obligation applies (for example for business letters under § 257 HGB). The legal basis is Art. 6(1)(b) or (f) GDPR.
• Cancelling via “Cancel contracts here”: For a cancellation via the cancellation button (§ 312k BGB) we process your name, email address, the contract cancelled, the type of cancellation, its reason where given and the time, and we confirm the cancellation by email. We keep the cancellation as evidence until claims under the contract are time-barred (three years from the end of the year of the cancellation). The legal basis is Art. 6(1)(c) GDPR in conjunction with § 312k BGB.
• App and notifications: The same rules apply in our app for Android and iOS as on the website. If you allow notifications, we store per device an identifier for notifications (push token), the operating system and the language of the app, in order to tell you about new messages or incoming payments, for example. Notifications are sent via Google's Firebase Cloud Messaging (Google Ireland Limited; processing in the USA is possible). We delete the identifier when you sign out, when Google reports it as invalid or when you delete your account. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time in your device settings. We do not sell memberships in the app. If an error occurs in the app or it crashes, it reports this to our error log – only with the app version, operating system, the affected screen and the error message, without your account and without any content. For this, the app notes on your device whether it was last closed properly. The legal basis is our legitimate interest in an error-free app (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG).
• Recommendation links to Amazon: Some recommendations for fair equipment link to Amazon with our partner tag. Before you click such a link, Amazon receives no data from us. After the click, Amazon's privacy notice and cookies apply; if you buy there, we receive a commission without learning who bought. The legal basis is our legitimate interest in financing the platform (Art. 6(1)(f) GDPR).
• Backups and logs: We back up our database daily into non-public storage at our database provider Supabase in the EU; we delete each backup after 14 days. Our host Vercel logs technical data when pages are opened (IP address, time, address requested, browser identifier) for secure operation and troubleshooting and deletes it after a short time. We record errors on our servers in our own error log – without IP address and without form contents, only the address, type and message of the error – in order to fix them; we delete a fixed error from the log 90 days later. The legal basis is our legitimate interest in secure, available operation (Art. 6(1)(f) GDPR). [Enter the retention period of Vercel's server logs (depends on the plan)]

Access in a dispute: If one side reports a dispute before the payment is released, we look at the chat history and the order data concerned in order to decide on a refund or a release. If no dispute has been reported, we do not read chats. The legal basis is Art. 6(1)(b) and (f) GDPR.

Checklist: If you create a checklist, we store its name and the cards in it with set, number, language, condition, quantity, your maximum price, your note and whether you have ticked them off – in your account, so the website and the app show the same list (Art. 6(1)(b) GDPR). The app keeps a copy on your device so the list also works offline; it is deleted there when you log out. If you create a read-only link, anyone with the link can see the name of the list and the cards – without maximum price, note or account. You can withdraw the link at any time. You delete lists yourself; when you delete your account, all checklists are deleted.

3. Legal bases

The processing takes place in order to perform the contract of use (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR) and on the basis of our legitimate interest in running the platform securely (Art. 6(1)(f) GDPR).

4. Service providers we use

We use the following service providers. A contract under Art. 28 GDPR is in place with each of the processors.

• Vercel (Vercel Inc., USA) – hosting of the website. This project's server functions run in the Dublin, Ireland region (dub1). Processor. [Confirm the data processing agreement – in the Vercel dashboard under Settings, Legal]
• Supabase (Supabase Inc., USA) – database, user accounts, file storage and the real-time updating of the chat. The data is held in the eu-west-1 region (Ireland). Processor. [Confirm the data processing agreement – in the Supabase organisation settings]
• Resend (Resend, Inc., USA) – sending notification emails. The email address and the content of the message concerned are transmitted. Processor; the processing takes place in the USA. [Confirm the data processing agreement and state the basis for the transfer to the USA – adequacy decision (Data Privacy Framework) or standard contractual clauses]
• Cloudflare (Cloudflare, Inc., USA) – Turnstile, a check against automated requests in the sign-in and contact forms. The IP address and technical characteristics of the browser are processed. Processor; processing in the USA is possible. [Confirm the data processing agreement (Cloudflare Data Processing Addendum) and state the basis for the transfer to the USA – adequacy decision (Data Privacy Framework) or standard contractual clauses]
• Stripe (Stripe Payments Europe, Limited, Ireland, and Stripe, Inc., USA) – handling the paid membership, the payments between users and the payouts to dealers. Stripe processes payment data largely as a controller in its own right and not on our behalf, in particular in order to meet its own regulatory obligations (prevention of money laundering, identity verification of dealers). Stripe's own privacy policy applies to that processing. Which payment methods Stripe offers and which services are behind them is explained in section 2 under “Payment methods at checkout”.
• Google (Google Ireland Limited, Ireland, and Google LLC, USA) – signing in with Google at your request, notifications in the app (Firebase Cloud Messaging) and our email mailbox (Gmail), where messages from the contact form arrive. For Firebase Cloud Messaging and the mailbox, Google is a processor; processing in the USA is possible. [Confirm the data processing agreement (Firebase: Data Processing and Security Terms) and state the basis for the transfer to the USA; for the mailbox choose an account with a data processing agreement (Google Workspace) or a mailbox on our own domain]
• YouTube (Google Ireland Limited, Ireland, and Google LLC, USA) – dealers' livestreams on their table page. The player is only loaded when you tap “Load livestream”; until then there is no connection to YouTube. After that, Google receives, among other things, your IP address, information about your browser and device and the page you are viewing, and may set cookies; processing in the USA is possible (Data Privacy Framework). We use the privacy-enhanced mode (youtube-nocookie.com). The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google's privacy policy applies to the processing at YouTube.

5. Cookies and local storage

We only use cookies and local storage that are technically necessary: the sign-in cookies, without which the account cannot be used; a cookie with the language last chosen (one year); in the app, a cookie that marks the app view (30 minutes); a cookie with the answer to the language suggestion (one year); when signing in with a code or resetting a password, a cookie with the email address entered, so that the code can be matched to it (one hour); after a date of birth under 18 is entered, a cookie that blocks registration (24 hours); until launch, a cookie that unlocks access to the preview (up to 180 days); and, when joining a dealer team, a cookie with the invitation (one hour). In the browser itself (localStorage or sessionStorage), the search terms last used, the choice between light and dark appearance, the contents of the request basket, a dismissed notice about leaving a review and the draft of a product while it is being created are stored – these entries stay on the device.

We do not use analytics or marketing tools. A consent banner is therefore not required.

Note for the operator, not for users: [As soon as an analytics or marketing tool is added, a consent banner becomes mandatory at this point and the paragraph above has to be replaced]

6. Retention periods

We store account data for as long as the account exists. We delete an account on request to the address given above; this does not extend to data that we are required or entitled to keep.

You can delete your account yourself at any time: under “My account” → “Delete account”. The only condition is that no order is still running. Your login details, profile, shipping address, wanted ads, watchlist, favourites, checklists, notifications, votes and warnings are deleted immediately; any active membership ends. Your table and your cards are taken out of the catalogue. What we are required to keep – order, payment and invoice data and dealers' tax details – remains stored and blocked for the statutory period; your profile itself is anonymised. Chat histories and reviews remain readable for the other party, showing “Deleted account” instead of your name. The legal basis for keeping the data is Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB; for continuing to show the chats, it is our legitimate interest and that of the other party in a traceable transaction (Art. 6(1)(f) GDPR).

How long we keep chats is explained in section 2 under “Chats and how long we keep them”. The table at the end of this section gives an overview of all periods.

We keep order, payment and invoice data in line with commercial and tax law requirements: ten years under § 147 Abgabenordnung (the German Fiscal Code) and § 257 Handelsgesetzbuch (the German Commercial Code), counted from the end of the calendar year in which the order was completed. During that time the data is blocked from any further processing.

We delete warnings and blocking periods once they are no longer needed to prevent misuse.

Retention periods at a glance

This table summarises how long we keep which data. Blocked means: the data is only kept for the purpose stated and not processed otherwise.

7. Your rights

You have the rights of access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Hessische Beauftragte für Datenschutz und Informationsfreiheit (the data protection supervisory authority for the German state of Hesse), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

Automated decisions: Some steps run automatically: the chat block after three warnings, the review pause for private sellers once the threshold is reached, and the block of an account if a buyer reverses a payment after having confirmed receipt themselves, if a dealer does not return the buyer's cards in time on a part-exchange, or if a dealer loses two chargebacks through their own fault within 90 days. All of these steps are provisional. You can ask at any time for a human to review the case, state your point of view and contest the decision (Art. 22(3) GDPR) – most easily via the contact form. A final block of your account or of your sales is always decided by a human.