Privacy policy

Privacy Policy

This Privacy Policy applies to data processing by SUPER FLEA MARKET 23 GmbH (“SFM”), registered with the commercial register of the district court of Hamburg under HRB 185018 and with its registered office at Deichstraße 1, 20459 Hamburg, Germany, (“Controller”, "we", "us") when using our website https://superfleamarket.org/ (“Website”) .

SFM sells and markets items of second-hand clothing and accessories previously worn or possessed by celebrities (“Piece(s)”) to customers (“Customers”) via fixed price sales and auctions via the online shop on the Website (“Service”).

When you visit our Website, we process your personal data. "Personal Data" means any information relating to an identified or identifiable natural person. When Personal Data is processed, this means that we collect, store, transmit, delete or otherwise use this data.

When processing your Personal Data, we comply with the applicable data protection laws, in particular the General Data Protection Regulation ("GDPR"), the German Federal Data Protection Act ("BDSG") and the German Telecommunications and Telemedia Data Protection Act (“TTDSG”).

With this Privacy Policy, we inform you about the type, scope and purpose of the collection, use and other processing of Personal Data when using the Website.

If the data processing carried out by us changes, we will adapt our Privacy Policy. We therefore ask you to inform yourself regularly about the content of our Privacy Policy. We will inform you if the change requires any action on your part, such as consent or other individual notification.

1	Controller for Data Processing, Contact The Controller responsible for processing your data is: SUPER FLEA MARKET 23 GmbH Deichstraße 1 20459 Hamburg, Germany If you have any questions regarding data protection or to exercise your rights in accordance with section 10 of this Privacy Policy in connection with the use of our Website you can contact the person responsible for data protection issues at: hello@superfleamarket.org.
2	Collection and Storage of Personal Data; Type and Purpose of Processing and Relevant Legal Basis In the following, we will inform you which Personal Data we process when you use the Website. We also explain the purpose for which we process your data and the legal basis on which we do so.
3	Accessing the Website When you visit our Website in order to use it for information purposes, we collect, store and process so-called “log data”. We store these temporarily and anonymized as so-called serverlog files on our web server in order to ensure the display of our Website and its stability and security. This concerns e.g.: Operating system and information on the Internet browser used, including installed add-ons; IP address (Internet Protocol address) of the end device from which the online offer is accessed; Internet address of the website from which the Website was accessed (so-called origin or referer URL); Name of the service provider used to access the online service; Name of the files or information accessed; Date and time and duration of access. The processing is carried out on the basis of a balancing of interests in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR, which always also takes your interests into account.
4	Customer Account and Orders Upon registration for our Website, a customer account is created and the following personal data is collected from you: Your salutation: Mr. /Mrs. or not specified Your first name and surname Your address and email address Your country If you decide to place an order, we will also collect the following data from you: Your shipping address Your means of payment and your payment details We process the aforementioned data in order to fulfill the contract with you for the Services offered. The legal basis for data processing is therefore Art. 6 para. 1 lit. b) GDPR. In addition, we process your Personal Data for advertising purposes in order to send you personalised advertising, provided you have given your consent in accordance with Art. 6 para. 1 lit. a) GDPR.
5	Newsletter If you decide to register for our newsletter, we will collect and process your email address. We process your email address based on your express consent in accordance with Art. 6 para. 1 lit. a) GDPR. Your consent can be revoked at any time.
6	Website Optimisation, Analysis and Marketing
(a)	Functional cookies Our Website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on your computer or mobile phone. The cookie contains a string of characters that enables your system to be uniquely identified when you return to the Website. Most of the cookies we use (“session cookies”) and the data stored and transmitted in them are automatically deleted at the end of your visit. Other cookies (“persistent cookies”) remain stored on your end device until you delete them. You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. You can delete cookies that have already been saved at any time. If cookies are deactivated, the functionality of the Website may be restricted. Some elements of our Website require that the accessing browser can be identified even after a page change. Cookies may be stored for this purpose, which enable us to recognise your browser on your next visit. If personal data is processed by the cookies, we process it on the basis of a balancing of interests in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR, which always takes your interests into account.
(b)	Analysis and marketing cookies When you visit our Website, cookies are also set that enable your use of the Website to be analysed for reach measurement and advertising purposes (“analysis cookies”). We use analysis cookies exclusively on the basis of your consent in accordance with Section 25 (1) TTDSG and Art. 6 para lit.a) GDPR via our cookie banner. You can also access further information about the cookies we use via our cookie banner. You can also revoke your consent to the processing of your data by analysis cookies at any time via the cookie banner.
(c)	Google Analytics To analyse your use of our Website, we use “Google Analytics”, a service provided by companies in the Google LLC Group, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”), on the basis of a contract for commissioned data processing pursuant to Art. 28 GDPR. Google Analytics uses cookies. The information generated by cookies about your use of our Website is usually transmitted to a Google server in the USA and stored there. The storage of Google Analytics cookies and the use of this analysis tool are based on your express consent in accordance with Art. 6 para. 1 lit. a) GDPR. Your consent can be revoked at any time. We have activated the IP anonymisation function. This means that your IP address will be truncated by Google within member states of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the USA. Google will use this information on our behalf to analyse your use of the website, to compile reports on website activity and to provide us with other services relating to website activity and internet usage. You have the option of preventing the storage of cookies by changing the settings of your browser software accordingly. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address) and from processing this data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. Further information about the processing of user data by Google Analytics can be found in Google's privacy policy at: https://support.google.com/analytics/answer/6004245?hl=en.
(d)	Meta Pixel We use Meta Pixel. “Meta Pixel” is a JavaScript code that is implemented on our Website to track user interactions, such as page views, for advertising and analytic purposes. Meta Pixel enables us to measure the effectiveness of our Meta advertising campaigns by tracking the actions that users take on our Website after clicking on a Meta ad. Data processing is carried out on the basis of a contract for commissioned data processing in accordance with Art. 28 GDPR. Your e-mail address, first name and surname are processed by Meta for matching purposes, to track your use of our Website. The storage of Meta Pixel cookies and the use of this analysis tool are based on your express consent in accordance with Art. 6 para. 1 lit. a) GDPR. Your consent can be revoked at any time. Further information about the processing of user data by Meta Pixel can be found in Meta's Business Tool Terms at: https://www.facebook.com/legal/technology_terms.
(e)	Google Tag Manager We use “Google Tag Manager” to integrate content from third-party providers. Google Tag Manager itself does not store or read cookies or similar personal data processing technologies which require consent. Google Tag Manager only controls the conditions under which the other programs, such as Google Analytics, are used on our Website.
7	Data Recipients In addition to the service providers mentioned in section 6, we use other services from external service providers (IT providers, transport companies, payment service providers) to process your personal data. Some of these third parties act as their own data controllers under data protection law, while others act as processors on our behalf and in accordance with our instructions pursuant to Art. 28 GDPR.
7.1	Google Ads (formerly Google AdWords) We use “Google Ads Conversion” and “Google Ads Remarketing” for advertising purposes to promote our Service to users who search for products or services related to our Services on the Google network. If you access our Website via a Google advert, Google Ads will store a cookie on your device. The cookie ID, number of ad impressions per placement, last impression and opt-out information are usually stored as analysis values for this cookie. Each user receives a unique ID. If you visit our Website, Google Ads Remarketing will store a cookie on your device to display targeted ads for our Service to you when using other apps or websites within the Google network. We ourselves do not collect and process any personal data in the aforementioned advertising measures. We only receive statistical analyses from Google. Personal data is only processed and stored by Google. The storage of Google Ads cookies and the use of this analysis tool are based on your express consent in accordance with Art. 6 para. 1 lit. a) GDPR. Your consent can be revoked at any time. Further information about the processing of user data by Google Ads can be found in Google's privacy policy at: https://policies.google.com/privacy?hl=en.
7.2	Mailchimp We use the e-mail service of the Intuit Mailchimp, 405 N Angier Ave. NE Atlanta, GA 30308 USA, (“Mailchimp”) to inform you about the progress of your order and to send you our newsletter. Data processing is carried out on the basis of a contract for commissioned data processing in accordance with Art. 28 GDPR. Mailchimp processes the following personal data of you: e-mail address; first name and surname. The processing of personal data by Mailchimp in relation to your order is carried out in accordance with Art. 6 para. 1 lit.b) GDPR and for the sending of the newsletter only with your prior consent pursuant to Art. 6 para. 1 lit. a) GDPR. Further information about the processing of user data by Mailchimp can be found in Intuit's privacy policy at: https://www.intuit.com/privacy/statement/.
7.3	Shopware We use the modular e-commerce platform shopware from shopware AG, Ebbinghoff 10, 48624 Schöppingen (“shopware”) for our online shop. shopware enables us to manage and process your orders. Data processing is carried out on the basis of a contract for commissioned data processing in accordance with Art. 28 GDPR. shopware processes the following personal data of you: first name and surname, shipping address, e-mail address, payment information (credit card or bank account details and payment address). The processing of personal data by shopware in relation to your order is carried out in accordance with Art. 6 para. 1 lit.b) GDPR.
7.4	HexaMain GmbH – Hosting We process the data stored by us on servers of HexaMain GmbH, Hebelstraße 7, 69214 Eppelheim (“HexaMain”). We store both data that you enter yourself on our Website on the HexaMain server (registration data such as e-mail address) and data that we automatically collect from you when you visit our Website (such as your IP address and your location). We have concluded an order processing contract with HexaMain in accordance with Art. 28 GDPR. Your personal data is stored exclusively on servers in Frankfurt am Main and is therefore not transferred to data recipients outside the European Union.
7.5	Payment Services We work together with the following payment service providers: Paypal (Europe) S.à r.l. et Cie, S.C.A, 22-24 Boulevard Royal, L-2449 Luxembourg (“Paypal”); Google Pay from Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google Pay”); American Express Payments Europe, S.L., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main (“American Express”); Mastercard Europe SA, Chaussée de Tervuren 198a, B-1410 Waterloo, Belgium (“Mastercard“) When you place an order, you can make your payment via one of the aforementioned payment service providers. We transmit to Paypal, Google Pay, American Express or Mastercard the information you provide during the ordering process (name, address, credit card information, invoice amount, currency and transaction number). Your data will only be passed on for the purpose of payment processing with Paypal, Google Pay, American Express or Mastercard and only to the extent that it is necessary for this purpose. The data entered will only be processed by Paypal, Google Pay, American Express or Mastercard and stored by Paypal, Google Pay, American Express or Mastercard. This means that we do not receive any account or credit card-related information, but only information with confirmation or negative information about the payment. The transmission of your data to Paypal, Google Pay, American Express or Mastercard is necessary to fulfill the contract with you for the Services and is therefore based on Art. 6 para. 1 lit. b) GDPR. Further information about the processing of user data by Paypal, Google Pay, American Express or Mastercard can be found in Paypal ́s, Google Pay ́s, American Express ́ or Mastercard ́s privacy policy at: https://www.paypal.com/webapps/mpp/ua/privacy-full, https://policies.google.com/privacy?hl=en; https://www.americanexpress.com/us/company/privacy-center/online-privacy-disclosures/#pr ivacy-notices and https://www.mastercard.us/en-us/vision/corp-responsibility/commitment-to-privacy/privacy.h tml.
8	Will Your Data be Transferred to Third Countries or International Organisations? As part of our business relationships, your personal data may be passed on or disclosed to third-party companies. These may also be located outside the European Economic Area (EEA), i.e. in third countries. In this case, this concerns the use of the following services: Google: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. In the context of the transfer of personal data to a third country, we will regularly ensure by means of suitable guarantees, for example by concluding the standard contractual clauses of the European Commission, that data is only transferred to a third country on the basis of a level of protection corresponding to the GDPR. With respect to personal data transferred by Google to the USA, the data security is ensured by the EU-US Data Privacy Framework which has been approved by the EU Commission via its Adequacy Decision dated 10 July 2023 (C(2023)4745final).
9	When Do We Delete Your Personal Data? We delete your data when it is no longer required for the purposes for which it was originally collected. Irrespective of this, we store your Personal Data processed when using the Website or otherwise utilizing our services until the expiry of the statutory or possible contractual warranty rights. After this period has expired, we will retain the information required under commercial and tax law relating to the contractual relationship for the periods specified by law. For this period, the Personal Data will only be processed again in the event of a review by the tax authorities.
10	Your Rights With regard to our processing of your Personal Data, you are entitled to the following rights free of charge:
10.1	Right to Information pursuant to Art. 15 GDPR You have the right to obtain information from us as to whether and what Personal Data we process about you. This also includes information on how long and for what purpose we process the Personal Data, from which source it originates and to which recipients or categories of recipients we pass it on. We can also provide you with a copy of this Personal Data.
10.2	Right to Rectification pursuant to Art. 16 GDPR You have the right to demand that we correct any incorrect or no longer correct information about you without delay. You can also request that we complete your incomplete Personal Data. If this is required by law, we will also inform third parties of this correction if we have passed on your Personal Data to them.
10.3	Right to erasure pursuant to Art. 17 GDPR You have the right to request that we erase your Personal Data without undue delay if one of the following applies: Your Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed, or the purpose has been achieved; You withdraw your consent and there is no other legal basis for the processing; You object to the processing and there are no overriding legitimate grounds for the processing; in the case of the use of Personal Data for direct marketing purposes, a mere objection on your part to the processing is sufficient; Your Personal Data has been processed unlawfully; The deletion of your Personal Data is necessary to fulfil a legal obligation under EU law or the law of a member state to which we are subject. Your right to erasure may be restricted on the basis of statutory provisions. This includes in particular the restrictions listed in Art. 17 GDPR.
10.4	Right to restriction of processing pursuant to Art. 18 GDPR You have the right to obtain from us restriction of processing of your Personal Data if one of the following grounds applies: You contest the correctness of your Personal Data for a period of time that enables us to verify the correctness of the Personal Data; the processing is unlawful and you oppose the erasure of the Personal Data and request the restriction of their use instead; We no longer need your Personal Data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims, or You have objected to processing as long as it is not yet clear whether our legitimate grounds override yours. If you have obtained a restriction of processing in accordance with the above list, we will inform you before the restriction is cancelled.
10.5	Right to Data Portability pursuant to Art. 20 GDPR You have the right to receive the Personal Data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those Personal Data to a third party. The exercise of this right does not affect your right to erasure.
10.6	Right to Object pursuant to Art. 21 GDPR Pursuant to Art. 21 GDPR, you have the right to object to the processing of your Personal Data at any time for reasons arising from your particular situation if we base this processing on legitimate interests pursuant to Art. 6 para. 1 lit. f) GDPR. If you file an objection, we will no longer process your Personal Data, except in two cases: We can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or The processing serves the assertion, exercise or defence of legal claims. In particular, if we process your Personal Data for direct marketing purposes, you have the right to object at any time to the processing of your Personal Data for the purpose of such marketing. If you object to the processing of your Personal Data for direct marketing purposes, we will no longer use your Personal Data for this purpose.
10.7	Right to withdrawal of consent pursuant to Art. 7 GDPR You can withdraw the consent you have given us at any time with effect for the future. This withdrawal can be made in the form of an informal notification to the above-mentioned contact addresses. If you withdraw your consent, this will not affect the legitimacy of the Personal Data processing carried out up to that point.
10.8	Right to file a complaint with the supervisory authority If you believe that the processing of your Personal Data by us violates applicable data protection law, you have the right to file a complaint with the competent supervisory authority. The supervisory authority responsible for us is: Der Hamburgische Beauftragte für den Datenschutz und Informationssicherheit Ludwig-Erhard-Str 22, 7. OG 20459 Hamburg Tel.: 040 / 428 54 - 4040 Fax: 040 / 428 54 - 4000 E-Mail: mailbox@datenschutz.hamburg.de In addition, you can file a complaint with the data protection supervisory authority responsible for you at your place of residence.
11	Automated Individual Decision-Making Including Profiling Pursuant to Art. 22 GDPR We do not process your Personal Data for automated decisions in individual cases, including profiling within the meaning of Art. 22 GDPR.