Privacy Policy
The protection of your personal data is important to us. Below, we inform you about which personal data we process when operating our online marketplace 99WAVES, for what purposes, and on what legal basis. Personal data is any data that can be related to you personally (e.g., name, address, email address, usage behavior).
1. Responsible person
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
KONEKT media GmbH
Hausener Str. 8, 87665 Mauerstetten, Germany
Represented by the managing directors: Sonnya Endhart, Manuel Endhart
Commercial Register: Munich Local Court, HRB 259935
VAT ID No.: DE297856758
Email: [email protected]
A data protection officer has not been appointed. For questions regarding data protection, please contact us using the contact details above.
2. General information on data processing, legal bases
We process personal data only to the extent necessary for providing a functional platform and our content and services. The legal bases for this processing are, in particular: Article 6(1)(a) GDPR (consent), Article 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Article 6(1)(c) GDPR (legal obligation), and Article 6(1)(f) GDPR (legitimate interest). We specify the relevant legal basis for each processing activity below.
The service providers we use process data partly on our behalf on the basis of a data processing agreement (Art. 28 GDPR).
3. Provision of the website and server log files
When you access our platform, information is automatically transmitted to our hosting provider's server and stored in log files (including IP address, date and time of access, page/file accessed, amount of data transferred, referrer, browser type, and operating system). This is technically necessary to display the website and ensure its stability and security. The legal basis for this is Article 6(1)(f) GDPR (legitimate interest in secure, uninterrupted operation). The log files are deleted after 30 days.
Hosting: Our platform is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. The hosting provider processes the aforementioned data on our behalf based on a data processing agreement.
4. SSL/TLS encryption
This site uses SSL/TLS encryption for security reasons and to protect the transmission of confidential information. You can recognize an encrypted connection by the "https://" in your browser's address bar.
5. Registration and user account
A user account is required to use the platform as a buyer or seller. During registration, we process the data you provide (including your name, email address, and password; for commercial sellers, we also process legally required information such as company name, address, and registration details). The legal basis for this processing is Article 6(1)(b) GDPR (performance of the user agreement). The data is stored for the duration of the user relationship and subsequently deleted, unless statutory retention obligations apply.
The account can also be accessed via our mobile app; login is done using a token-based authentication process with our platform. The same processing purposes and legal bases apply as for the website.
6. Processing of purchases (marketplace)
99WAVES is a marketplace for online purchases; sales contracts are concluded directly between sellers and buyers. To process an order, we process the necessary data (including name, delivery and billing address, email address, order and item details) and forward the data required for contract fulfillment to the respective contractual partner (seller or buyer) as well as to the integrated payment and shipping service providers. The legal basis for this is Article 6(1)(b) GDPR. Where tax and commercial law retention obligations exist, we store certain data for the statutory periods (Article 6(1)(c) GDPR).
7. Payment processing (Stripe)
Payment processing is handled by the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland („Stripe“), using Stripe Connect (escrow payment and payout processing). The data required for payment (including name, payment details, and amount) is transmitted directly to Stripe and processed there; we ourselves do not have access to complete payment details. Before the first payout, Stripe conducts a legally required identity and due diligence check (KYC). The legal basis for this is Article 6(1)(b) GDPR (contractual necessity) and Article 6(1)(c) GDPR (legal obligation). Stripe's privacy policy also applies. https://stripe.com/de/privacy.
8. Shipping processing (Sendcloud and logistics partners)
For shipping and shipment management, we use the service Sendcloud (Sendcloud BV, Stationsplein 32, 5611 AC Eindhoven, Netherlands). To create shipping labels and track shipments, the necessary data (including name, delivery address, and, if applicable, email/phone number for notifications) is transmitted to Sendcloud and the respective logistics partner. The legal basis for this is Article 6(1)(b) GDPR. Sendcloud's privacy policy also applies. https://www.sendcloud.de/datenschutz/.
9. Cookies and consent management
We use cookies and similar technologies. Technically necessary cookies (e.g., for registration, shopping cart, session and consent management) are required for the operation of the platform; the legal basis is Art. 6 para. 1 lit. f GDPR or § 25 para. 2 TDDDG.
For all non-essential cookies and services (statistics and marketing), we obtain your consent via our consent banner. You can change or withdraw your selection at any time via the "Cookie settings" link in the page footer. The legal basis is Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG.
Use of analytics and marketing services on a consent basis
We use the following analytics and marketing services to evaluate the use of our services and to measure the reach of our advertising. These services are Only activated after you have given your consent via our cookie banner.. The legal basis for processing is your consent according to Article 6 paragraph 1 letter a GDPR (as well as Section 25 Paragraph 1 of the German Telemedia Act (TDDG)). You can withdraw your consent at any time with effect for the future via the "Cookie Settings" link in the footer of the page. The services listed below may involve the transfer of personal data to the USA; this is based on the EU-US Data Privacy Framework or the EU Commission's Standard Contractual Clauses. A third-country risk associated with the respective provider cannot be completely ruled out in every case.
Google Analytics 4 — Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). We use Google Analytics 4 to statistically analyze the use of our platform (e.g., pages visited, articles viewed, orders). Pseudonymous user profiles are created and cookies are used. Integration is via the "Statistics" consent group; no data is transferred to Google without your consent (Google Consent Mode v2). Further information: https://policies.google.com/privacy.
Meta Pixel and Conversions API (Facebook/Instagram) — Provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (parent company: Meta Platforms, Inc., USA). We use the Meta Pixel and the server-side Conversions API to measure the effectiveness of our advertising on Meta's platforms and to deliver more targeted advertising. Events such as page views, article views, adding items to the shopping cart, and completed orders are transmitted to Meta; browser and server events are combined using a common identifier to prevent double counting. Integration is done via the "Marketing" consent group; no data is transmitted without your consent. Further information: https://www.facebook.com/privacy/policy.
TikTok Pixel and Events API — Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland (for users in the EEA jointly with TikTok Information Technologies UK Limited, London). We use the TikTok pixel and the server-side events API to measure the effectiveness of our advertising on TikTok and to deliver more targeted ads. Events such as page views, article views, adding items to the shopping cart, and completed orders are transmitted to TikTok. This integration is done via the "Marketing" consent group; no data is transmitted without your consent. Further information: https://www.tiktok.com/legal/page/eea/privacy-policy/de.
10th Newsletter
When you subscribe to our newsletter, we process the email address you provide in order to send you information and offers related to 99WAVES via email. The legal basis for this is your consent pursuant to Art. 6 para. 1 lit. a GDPR. You can unsubscribe from the newsletter at any time (via the unsubscribe link in each email) and thereby revoke your consent for the future.
We use the Mailchimp service for sending our newsletters (provider: The Rocket Science Group LLC („Mailchimp“), 405 N. Angier Ave. NE, Atlanta, GA 30308, USA, an Intuit Inc. company). The registration form is integrated via the „Mailchimp for WordPress“ plugin. Your newsletter data is stored and processed on Mailchimp's servers; this may involve transferring data to the USA (legal basis: EU-US Data Privacy Framework or Standard Contractual Clauses of the EU Commission). Registration uses a double opt-in process: After registering, you will receive an email in which you must confirm your subscription. Further information: https://mailchimp.com/legal/privacy/.
11. Integration of Google Fonts
To ensure consistent font display, we use fonts from the "Google Fonts" service (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA). When you access a page, your browser loads the necessary fonts from Google's servers; in doing so, your IP address is transmitted to Google. The legal basis for this is our legitimate interest in a uniform and appealing presentation of our website (Art. 6 para. 1 lit. f GDPR); where consent is obtained, Art. 6 para. 1 lit. a GDPR also applies. Further information: https://policies.google.com/privacy as well as https://developers.google.com/fonts/faq.
12. Map display in our directories
In our directories (surf spots, surf shops, and surf schools), we integrate interactive maps as needed. For this, we use the Leaflet map library, which is loaded via the unpkg content delivery network (unpkg.com; delivered via Cloudflare, Inc., USA), as well as map tiles from OpenStreetMap (provider: OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom; © OpenStreetMap contributors). When a map is loaded, your browser establishes a connection to the servers of the aforementioned providers and transmits, among other things, your IP address. The map tiles are provided by servers of the OpenStreetMap Foundation in the United Kingdom, for which there is an adequacy decision by the European Commission. Loading the program library via unpkg may result in data being transferred to the USA; this is based on the EU-US Data Privacy Framework or the EU Commission's Standard Contractual Clauses. The legal basis is Art. 6 para. 1 lit. f GDPR (legitimate interest in the presentation of locations); insofar as consent is obtained for this purpose, Art. 6 para. 1 lit. a GDPR is also applicable.
13. Making contact
When you contact us by email or via platform-internal messaging, we process your information to handle your inquiry. The legal basis for this is Article 6(1)(b) GDPR (for contract-related inquiries) or Article 6(1)(f) GDPR (legitimate interest in responding to inquiries). The data will be deleted as soon as the inquiry has been resolved and no statutory retention obligations apply.
14. Reviews
After a transaction is completed, buyers and sellers can rate each other. The information provided is published and assigned to the respective user account. The legal basis for this is Article 6(1)(f) GDPR (legitimate interest in a transparent marketplace).
15. Recipients and transfer of data
Your data will only be shared to the extent necessary for the performance of the contract (with seller/buyer as well as payment and shipping service providers), if you have given your consent, or if we are legally obligated to do so. Data processors are contractually bound in accordance with Article 28 of the GDPR.
16. Storage duration
We only store personal data for as long as it is necessary for the respective purposes or as required by statutory retention periods (in particular under commercial and tax law). Afterwards, the data is deleted or blocked.
17. Your rights
Under the GDPR, you have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object (Art. 21). You can withdraw your consent at any time with effect for the future (Art. 7 para. 3 GDPR); the lawfulness of the processing carried out until the withdrawal remains unaffected.
To exercise your rights, simply send a message to the contact details listed under point 1.
18. Right to lodge a complaint with the supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.
19. Currentness of this privacy policy
This privacy policy is current as of September 2026. We will update it if data processing changes or if legal requirements necessitate it.
