Privacy Notice

1. Controller

Bart and Buy
Contact: contact@bartandbuy.de
Privacy contact: contact@bartandbuy.de

Data protection officer/contact person: Data Protection Team
Contact: contact@bartandbuy.de

2. Categories of personal data processed

• Account data (email address, display name, profile image URL).
• Authentication/session data (session identifiers, login timestamps).
• Uploaded trade data and import history.
• Security and operational logs required for service protection.

3. Processing purposes

• User authentication and account administration.
• Provision of dashboard and trade import functionality.
• Security, abuse prevention, and system operations.
• Legal compliance and incident handling where required.

4. Legal bases

• Art. 6(1)(b) GDPR (contract performance or pre-contractual steps).
• Art. 6(1)(f) GDPR (legitimate interests in secure operation).
• Art. 6(1)(c) GDPR (legal obligations), where applicable.

5. Recipients and processors

• Hosting provider(s) and infrastructure service providers.
• Identity provider(s) for sign-in.
• Technical subprocessors required to operate the service.

6. International transfers

If personal data is transferred outside the EU/EEA, appropriate safeguards (for example Standard Contractual Clauses) are implemented.

7. Retention periods

• Account profile data: until account deletion and expiration of legal retention duties.
• Imported trade records: until user deletion request or configured retention expiry.
• Security logs: limited retention period required for incident investigation.
• Backups: rolling encrypted backups with time-limited retention.

8. Data subject rights

• Right of access (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to erasure (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR).
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

9. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.

10. Contact for privacy requests

contact@bartandbuy.de

11. Versioning

Effective date: 2026-02-11
Last updated: 2026-02-11