Privacy Policy

The controller responsible for the processing of your personal data is Tourbiene GmbH, Friedrichstraße 123, 10117 Berlin, Germany, email privacy@tourbiene.com.

You can reach our Data Protection Officer at privacy@tourbiene.com or by post at the above address, marked "Data Protection Officer".

Depending on how you use the Platform, we may collect the following categories of personal data:

• Account and identity data: name, username, email address, password (stored in hashed form), date of birth or age confirmation, profile photo and bio, language and locale.
• Verification data (KYC): where you sell, receive payouts, or invest, identity documents and verification information, including — where a document photo or a liveness/selfie check is used — biometric data (see the Section on identity verification).
• Transaction data: orders, purchases, sales, rentals, bids, investments, amounts, delivery and billing addresses, and order history. Full payment-card numbers are handled by our payment providers, not stored by us.
• Content and activity data: listings, shorts and videos, live streams, images, reviews, comments, questions, messages, follows, saved items, and interactions.
• Communications: messages you send to us or through the Platform, and support requests.
• Device and technical data: IP address, device and browser identifiers, operating system, app version, and diagnostic and crash data. On mobile, with your permission, camera, microphone, photo-library, and notification access as needed for features you use.
• Usage and analytics data: pages and content viewed, features used, referring sources, and approximate location derived from your IP address.
• Cookies and similar technologies: identifiers stored on your device (see the Section on cookies).

We collect personal data directly from you when you register, set up a profile, transact, post content, or contact us; automatically when you use the Platform (device, usage, and cookie data); and from third parties such as payment and verification providers, other users you transact with, and, where you choose to connect them, authentication or social-login providers.

We process personal data on the following legal bases under Article 6 GDPR:

• To provide and operate the Platform, create and manage your account, and enable transactions and content — performance of a contract (Art. 6(1)(b)).
• To process payments, payouts, and refunds — performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c)).
• To verify identity and comply with anti-money-laundering, tax-transparency (DAC7/PStTG), accounting, and other legal obligations — legal obligation (Art. 6(1)(c)).
• To secure the Platform, prevent and detect fraud and abuse, moderate content, and enforce our terms — legitimate interests (Art. 6(1)(f)).
• To improve and develop our services and analyse usage — legitimate interests, or consent where required (Art. 6(1)(f) or (a)).
• To personalise content and recommendations — legitimate interests or consent, as applicable.
• To send you service communications — performance of a contract; and to send electronic marketing — your consent, or the narrow existing-customer exception (see the Section on marketing).
• To establish, exercise, or defend legal claims and comply with lawful requests — legitimate interests or legal obligation (Art. 6(1)(f) or (c)).

We also create aggregated and irreversibly anonymised data and statistics from usage of the Platform, on the basis of our legitimate interest in analytics, security, and product development (Art. 6(1)(f) GDPR). Once anonymised, the data no longer identifies you, falls outside the GDPR (Recital 26), and may be retained and used without the time limits set out in this Policy. Where we rely on legitimate interests, we balance those interests against your rights and freedoms, and you may object as described in the Section on your rights.

Some personal data is necessary to enter into or perform your contract with us or to meet our legal obligations — for example your email and password to create an account, delivery and payment details to complete a purchase, and identity, tax, and beneficial-ownership information to sell, receive payouts, or invest (KYC, anti-money-laundering, and tax-transparency law). If you do not provide it, we cannot create your account, complete the relevant transaction, or let you use the affected feature. Other data (for example an optional profile photo, or marketing consent) is voluntary, and not providing it has no consequence beyond the related feature being unavailable.

Where you sell, receive payouts, or invest, we and our verification and payment partners verify your identity to comply with anti-money-laundering law (in particular the Geldwäschegesetz, GwG) and other legal obligations (Art. 6(1)(c) GDPR).

This may involve identity documents and, where a document photo or a "liveness"/selfie check confirms you are the person shown, biometric data within the meaning of Art. 9(1) GDPR, which we process only with your explicit consent under Art. 9(2)(a) GDPR. You may refuse or withdraw this consent, in which case alternative or manual verification may apply and certain features may be unavailable. German identity cards are processed in accordance with the Personalausweisgesetz (PAuswG). Identity-verification providers may act as independent or joint controllers under their own privacy policies.

The storage of information on your device and access to information already stored on it is governed by § 25 of the Telecommunications Digital Services Data Protection Act (TDDDG). For strictly necessary cookies and technologies required to provide a service you have expressly requested, we rely on § 25(2) TDDDG; no consent is required.

For all other cookies and similar technologies — in particular preferences, analytics (for example PostHog, Segment), error monitoring (for example Sentry), and advertising or measurement (for example the Meta pixel) — we set and read them only on the basis of your prior consent under § 25(1) TDDDG, which also serves as the legal basis under Art. 6(1)(a) GDPR for any related processing of personal data. You give this consent through our consent banner, where you can accept or refuse each category and change or withdraw your choices at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Details of each cookie, its provider, purpose, and storage duration are set out in our cookie settings.

Because there is no uniform industry standard for browser "Do Not Track" signals, we do not currently respond to them. Where required by applicable law, we honour recognised opt-out signals such as Global Privacy Control (GPC) as a request to opt out of non-essential tracking. In any case you can manage non-essential cookies and tracking through our consent banner and your device settings.

We do not sell your personal data. We share personal data only as necessary and with appropriate safeguards, including with:

• Payment providers (for example Stripe) to process payments, payouts, and fraud prevention;
• Identity-verification providers to perform KYC and anti-money-laundering checks;
• Live-streaming and real-time media providers (for example LiveKit) to deliver live features;
• Communications and email providers (for example SendGrid, Resend, and Twilio) to send transactional and, where permitted, marketing messages;
• Analytics and product-measurement providers (for example Segment, PostHog) and error-monitoring providers (for example Sentry), subject to consent where required;
• Hosting, storage, and content-delivery providers (for example Cloudflare, including R2 object storage) to host the Platform and store media;
• Advertising and measurement partners (for example Meta), subject to your consent where required;
• Other users, where necessary to complete a transaction or display content you have chosen to make available (for example a seller receives the information needed to fulfil an order);
• The competent tax authority, to comply with our reporting obligations under DAC7/PStTG (Art. 6(1)(c) GDPR), and other authorities, courts, and advisers where required by law or to establish, exercise, or defend legal claims; and
• Acquirers or successors in the context of a merger, acquisition, or sale of assets, subject to this Policy.

Where we share buyer or renter data with a seller, item owner, or creator to fulfil a transaction, Tourbiene and that party each act as separate and independent controllers for their own processing (not joint controllers under Art. 26 GDPR and not processors for one another under Art. 28 GDPR); each is solely responsible for its own processing. Our other service providers act as processors on our behalf under data-processing agreements, or as independent or joint controllers where they determine their own purposes (in which case their own privacy policies apply).

For certain advertising and audience-measurement tools (for example the Meta pixel), we and the provider may act as joint controllers within the meaning of Art. 26 GDPR for the collection and transmission of the relevant data. In that case we have an arrangement setting out our respective responsibilities: in essence, we are responsible for informing you and, where required, obtaining your consent, and the provider is responsible for its subsequent processing under its own policy. You may exercise your rights against either of us, and we can provide the essence of the arrangement on request. We use these tools only with your consent where required (see the Section on cookies).

Some of our providers may process personal data outside the European Economic Area (EEA). Where this happens, we ensure an adequate level of protection through an EU adequacy decision (including, where applicable, the EU-US Data Privacy Framework), the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism, together with appropriate supplementary measures. You can request more information using the contact details below.

We keep personal data only as long as necessary for the purposes described in this Policy, including to provide the Platform, and thereafter as required to comply with legal retention obligations. Tax and commercial-law retention periods in Germany can be up to ten years; anti-money-laundering records are generally kept for five years and up to ten years where the law or an authority requires. We also retain data as needed to resolve disputes and enforce our agreements. When data is no longer needed, we delete or anonymise it.

By way of guidance, typical retention periods are:

• Account data — for the life of your account, and thereafter as needed to handle disputes and comply with law;
• Order, invoice, and tax records — up to ten (10) years (German commercial and tax law);
• Anti-money-laundering and identity-verification records — generally five (5) years, and up to ten (10) years where required;
• Content you post — until you delete it or your account is closed, subject to backups and legal holds;
• Marketing consents and proof of consent — until you withdraw consent, then as needed to evidence prior lawful processing;
• Security, device, and log data — a short period appropriate to fraud-prevention and security;
• Support communications — for a period appropriate to handling and evidencing the matter.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption in transit (TLS), access controls, and the use of vetted processors. Payment-card data is handled by PCI-DSS-compliant payment providers and is not stored by us. Where a personal-data breach is likely to result in a risk to your rights, we notify the competent supervisory authority and, where required, you, in accordance with Articles 33 and 34 GDPR.

Subject to the conditions and exceptions in applicable law, you have the right to:

• access the personal data we hold about you and obtain a copy;
• have inaccurate or incomplete data rectified;
• have your data erased in certain circumstances;
• restrict or object to certain processing, including processing based on our legitimate interests and processing for direct marketing;
• receive your data in a portable format and have it transmitted to another controller where technically feasible;
• withdraw consent at any time, without affecting processing already carried out; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law.

To exercise your rights, contact privacy@tourbiene.com. You also have the right to lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), or the authority in your place of residence.

We use automated processing to personalise content and recommendations and to detect and prevent fraud and abuse. Where such processing would produce legal or similarly significant effects concerning you, we carry it out only where permitted by law, with appropriate safeguards, and you may request human review, express your point of view, and contest the decision.

Where we use profiling, the logic involves analysing your activity, transactions, device, and content signals to rank and recommend content and to score transactions for fraud and abuse risk. The significance is that you may see more relevant content, and that a high risk score may lead to additional verification, delay, or refusal of a transaction. We do not make decisions producing legal or similarly significant effects about you solely by automated means, except as permitted by law and with the safeguards described above.

We send marketing communications by email, SMS, or push notification only where you have given prior consent (Art. 6(1)(a) GDPR, § 7(2) UWG), or where the existing-customer exception in § 7(3) UWG applies: we obtained your email address in connection with the sale of a product or service, we use it to promote our own similar products or services, you have not objected, and each message tells you clearly that you may object at any time at no cost beyond basic transmission rates. We do not rely on legitimate interests alone to send electronic direct marketing.

You can withdraw consent or object at any time via the unsubscribe link, your notification settings, or privacy@tourbiene.com. Opting out of marketing does not stop essential service communications.

The Platform is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. Where consent is a valid basis for an information-society service, the age of digital consent in Germany is 16. If you believe a child has provided us with personal data, please contact privacy@tourbiene.com and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. We will post the updated version on the Platform and, where the change is material, provide additional notice. The "effective date" indicates when the current version took effect.

For any questions about this Policy or your personal data, contact Tourbiene GmbH, Friedrichstraße 123, 10117 Berlin, Germany, or email our Data Protection Officer at privacy@tourbiene.com.