Protecting your personal data is important to us. Below we explain which personal data we process when operating our online marketplace 99WAVES (website and app), for which purposes and on which legal basis. Personal data means any information that relates to you personally (e.g. name, address, email address, IP address, usage behaviour).<\/p>\n
The controller within the meaning of the General Data Protection Regulation (GDPR) is:<\/p>\n
KONEKT media GmbH We have not appointed a data protection officer. If you have any questions about data protection, please contact us using the details above.<\/p>\n We process personal data only to the extent necessary to provide a functioning platform, our content and our services, or where you have given your consent. The legal bases are in particular: Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests). Storing information on your device and accessing it (e.g. cookies) is additionally governed by Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We state the applicable legal basis for each processing activity.<\/p>\n Some of the service providers we use process data on our behalf under a data processing agreement (Art. 28 GDPR), others act as independent controllers; we point this out for each service. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.<\/p>\n Our platform is hosted by Mittwald CM Service GmbH & Co. KG, K\u00f6nigsberger Stra\u00dfe 4\u20136, 32339 Espelkamp, Germany. When you access our pages, information is processed automatically and stored in log files (including IP address, date and time of access, page or file requested, amount of data transferred, referring page, browser type and operating system). This is technically necessary to deliver the website and to ensure its stability and security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure, trouble-free operation).<\/p>\n According to the host, access logs are stored only with a shortened IP address and deleted after 60 days; error logs, which may contain the full IP address, are deleted after seven days. The host processes the data on our behalf under a data processing agreement. To deliver pages faster, we cache generated pages; no personal data of visitors is stored in the process.<\/p>\n We send platform emails (e.g. order, shipping and account notifications) via the servers of our host Mittwald. If an email cannot be delivered, we store it in a sending log so that we can send it again. When we are looking for and fixing delivery errors, we temporarily switch on the log for all emails. In each case, the recipient address, subject, time, delivery status and content of the email are stored in our database. Only administrators have access. The entries are deleted automatically, at the latest 8 days after sending. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in reliable delivery of our emails).<\/p>\n Our website is delivered via the Cloudflare network (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). All requests to our website pass through Cloudflare servers. Cloudflare serves files such as images, scripts and style sheets from caches close to you and protects the platform against attacks and abusive access (e.g. through filter rules, rate limiting and automatic checks for suspicious requests). In doing so, Cloudflare processes in particular your IP address, the address requested, date and time, browser information and technical characteristics of the connection. If an automatic check is shown for a suspicious request, Cloudflare may set a technically necessary cookie (cf_clearance) that records the successful check. Cloudflare also protects the email addresses shown on our pages against automated harvesting.<\/p>\n The legal basis is Art. 6(1)(f) GDPR (legitimate interest in fast, secure delivery protected against attacks, cf. Recital 49 GDPR); for the check cookie, Section 25(2) no. 2 TDDDG. Cloudflare processes the data on our behalf under a data processing agreement. Data may be transferred to the USA in the process (see section 22). Further information: https:\/\/www.cloudflare.com\/privacypolicy\/<\/a>.<\/p>\n For security reasons and to protect the transmission of confidential content, this site uses SSL\/TLS encryption. You can recognise an encrypted connection by the \u201chttps:\/\/\u201d in your browser\u2019s address bar.<\/p>\n A user account is required for purchases, sales, price offers and messages. When you register, we process the data you provide (including name, email address and password; for sellers also address and seller profile details; for commercial sellers the mandatory legal information such as company name, address and register details, which is published as the legal notice on the seller page). To confirm your email address, we send you a code or, at your request, a confirmation link that is valid for two days. For newly created accounts, listings can only be published once the email address has been confirmed. The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement) and, for the legal notice, Art. 6(1)(c) GDPR. Without this information we cannot set up an account for you. The data is stored for the duration of the user relationship and then deleted, unless statutory retention obligations apply.<\/p>\n You can also access your account via our mobile app. Login uses a token-based procedure with our platform; the app accesses the same data as the website via a programming interface. The same purposes and legal bases apply as for the website.<\/p>\n 99WAVES is an intermediary marketplace; purchase contracts are concluded directly between seller and buyer. To process an order, we process the necessary data (including name, delivery and billing address, email address, telephone number if provided, order and item details, order and shipping status) and pass on the data required to perform the contract to the respective contracting party (seller or buyer) and to the integrated payment and shipping service providers. We keep you informed about the status of your order by email. The legal basis is Art. 6(1)(b) GDPR. Where tax and commercial law retention obligations apply, we store certain data for the statutory periods (Art. 6(1)(c) GDPR).<\/p>\n If a seller offers collection, you can request collection via our messaging function. You then agree purchase, payment and handover directly with the seller; payment is not processed via 99WAVES. In this context we process your request and the messages exchanged (see section 9) as well as the status of the listing (e.g. reserved or sold), and we may remind the seller by email to update it. You decide yourself which contact details you share with the seller for the handover. The legal basis is Art. 6(1)(b) GDPR (provision of the intermediary service).<\/p>\n Logged-in users can send each other messages via the platform and make, accept or decline price offers. For this purpose we store the messages, price offers, the participants, the time and the related listing on our server and notify the recipient by email. The content is visible to the users involved. The legal basis is Art. 6(1)(b) GDPR. Please share in messages only the data that is needed for the respective transaction.<\/p>\n Payments are processed by the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (\u201cStripe\u201d), using Stripe Connect to handle payment and payout to the seller. The data required for payment (including name, email address, billing address, payment details, amount, order reference) is transmitted directly to Stripe and processed there; we do not receive access to complete payment details. Before the first payout to a seller, Stripe carries out a legally required identity and due diligence check.<\/p>\n Depending on your choice, you pay by credit or debit card, Apple Pay, Google Pay, Link (a payment service by Stripe), Klarna or Amazon Pay. With Apple Pay, Google Pay, Klarna and Amazon Pay, the respective provider also receives the data required for the payment and processes it under its own responsibility: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Klarna Bank AB (publ), Sveav\u00e4gen 46, 111 34 Stockholm, Sweden (Klarna may also carry out a credit and identity check); Amazon Payments Europe S.C.A., 38 avenue John F. Kennedy, L-1855 Luxembourg.<\/p>\n For the payment buttons and payment fields to work, your browser loads program code and input fields directly from Stripe servers at checkout and, if you are logged in, also on product pages (including the fonts used there). In the process, Stripe receives your IP address and device information and sets cookies for fraud prevention (e.g. __stripe_mid, __stripe_sid). Stripe is independently responsible for fraud prevention and the legally required checks.<\/p>\n The legal basis is Art. 6(1)(b) GDPR (performance of the contract), Art. 6(1)(c) GDPR (legal obligations) and Art. 6(1)(f) GDPR (legitimate interest in secure, fraud-free payment); for the cookies, Section 25(2) no. 2 TDDDG. Data may be transferred to the USA in the process (see section 22). Further information: https:\/\/stripe.com\/privacy<\/a>.<\/p>\n To protect buyers, sellers and ourselves against payment fraud (for example purchases with stolen cards or sham sales between two accounts of the same person), we check orders for irregularities before paying out to the seller.<\/p>\n Data we process for this purpose: information that Stripe (see section 10) determines during payment anyway and provides to us for the order, namely the Stripe Radar risk assessment, whether the payment was confirmed with 3-D Secure or made via Apple Pay or Google Pay, the card\u2019s country of issue, a Stripe identifier of the card (a so-called fingerprint, not the card number) and notices from the bank about suspected fraud or a chargeback; order data (amount, shipping and billing country, shipping address, phone number, IP address at the time of ordering) and the registration date of the buyer account; for sellers, the IP address used when logging in, listing items and handling orders, exclusively as a non-reversible check value (HMAC hash). We store at most 20 such values per account for no longer than 90 days.<\/p>\n How the check works: we compare this information automatically, for example whether the risk is elevated, whether a card payment of \u20ac300 or more was made without 3-D Secure, whether card country and shipping country differ, or whether buyer and seller accounts use the same card, address, phone number or internet connection. If there is an indication, only the payout to the seller is put on hold temporarily and our team is informed. A human always makes the decision; there is no decision based solely on automated processing within the meaning of Art. 22 GDPR. Orders and accounts are not blocked automatically by this check.<\/p>\n The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is preventing fraud and protecting our users and our company against financial loss (cf. Recital 47 GDPR). Where the check serves the performance of the contract (payout only after proper payment and delivery), Art. 6(1)(b) GDPR applies additionally. We store the payment check data together with the order and delete or anonymise it together with the order data; we delete sellers\u2019 IP check values after 90 days at the latest. The data is not passed on to third parties; for the check we only retrieve information about the respective payment from Stripe.<\/p>\n You can object to this processing on grounds relating to your particular situation under Art. 21 GDPR (contact details in section 1). Without this check, however, we cannot process payouts properly.<\/p>\n To prevent buyers from being lured into unsafe payments outside 99WAVES, we automatically check texts you send via our chat, with a price offer, as a product question or in a listing for contact details (phone numbers, email addresses, links, bank details) and for references to payments outside the platform when they are sent; we do not otherwise evaluate the content. Depending on the setting, contact details in messages may be replaced with a notice, listings containing contact details may only be published once these details have been removed, and the recipient may be shown a safety notice; for pickup, the phone number remains visible in the chat. We store hits in a hit list for 30 days (time, account, channel, type of hit and an excerpt of the text found of at most 80 characters, e.g. the detected phone number) to detect false alarms and review repeated misuse; only administrators have access. If an account repeatedly produces hits within 7 days, our team is informed by email. Accounts or listings are not blocked automatically; a human makes the decision.<\/p>\n To prevent automated mass registrations, we reject known disposable email addresses at registration and limit the number of confirmation codes per internet connection and per email address as well as the number of new accounts per internet connection; for registrations via our app, an additional hourly limit per internet connection applies. For this we store non-reversible check values (HMAC hashes) of your IP address and your email address for no longer than 24 hours.<\/p>\n In addition, we use \u201cCloudflare Turnstile\u201d in the registration form, already when the confirmation code is requested (Cloudflare, see section 4). Your IP address and technical characteristics of your browser and device are transmitted to Cloudflare to check whether the registration comes from a human. According to Cloudflare, Turnstile does not set cookies for advertising or analytics. Access to this information on your device is strictly necessary for the security of the registration you requested (Section 25(2) no. 2 TDDDG). Cloudflare processes the data for this purpose on our behalf under the data processing agreement; Cloudflare also uses the signals collected during the check under its own responsibility to improve bot detection. For transfers to the USA, see section 22. Further information: https:\/\/www.cloudflare.com\/turnstile-privacy-policy\/<\/a>.<\/p>\n The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our users against fraud and the security of the platform (cf. Recitals 47 and 49 GDPR). You can object to this processing under Art. 21 GDPR (contact details in section 1).<\/p>\n We use Sendcloud for shipping labels and shipment tracking (Sendcloud B.V., Stationsplein 32, 5611 AC Eindhoven, Netherlands). For this purpose, the necessary data (including name, delivery and sender address, parcel details and, where applicable, email address or telephone number for delivery notifications) is transmitted to Sendcloud and to the carrier commissioned in each case (e.g. DHL). Sendcloud reports the shipment status back to us; we use the delivery notification to inform buyer and seller and to calculate the periods for buyer protection and payout. For bulky goods we may commission a freight forwarder, which receives the data required for collection and delivery. The legal basis is Art. 6(1)(b) GDPR. Further information: https:\/\/www.sendcloud.de\/datenschutz\/<\/a>.<\/p>\n Shipping request. If you request shipping to a country for which we do not yet have a fixed rate (on the product page or at checkout), we process your postcode, destination country, email address, optional message and the item concerned. We use this data solely to obtain a shipping quote and to reply to you. For this purpose we only pass the country, postcode and parcel dimensions to the commissioned shipping provider, not your email address. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request). Your request is deleted automatically after 12 months.<\/p>\n Shipping service (shipping without purchase). If you use our shipping calculator to request a shipment without a purchase on the platform, we process your name, email address, telephone number (optional), country of origin and destination, the postcodes and towns for collection and delivery, the contents, dimensions and weight of the package, the value of the goods if you request a declared value, and your optional message. If you are logged in, we assign the request to your user account. We use this information to prepare an offer and to reply to you. If we obtain a quote from a carrier for this purpose, we only pass on countries, postcodes, towns, contents, dimensions and weight, not your name or contact details. To calculate the price in the shipping calculator, we transmit the countries, postcodes and towns of collection and delivery as well as dimensions and weight to DHL Express and the freight forwarder Cargoboard, but not your name or contact details (Art. 6(1)(b) GDPR). A user account is required to place an order (for registration, see section 6). It is used to provide you with the order, shipment status, invoice and any additional charge in one place and to prevent misuse. If you accept our offer, we additionally process the names and addresses of the sender and recipient, contact details for delivery and your payment details, and transmit the data required for collection, carriage and delivery to the carrier we commission (e.g. FedEx, DHL Express or a freight forwarder); for shipments to or from countries outside the EU, also the information required for customs clearance. We process payment via Stripe (see section 10); before booking, we check it for fraud risks. We book the shipment directly via the carrier's interface (DHL Express or the freight forwarder Cargoboard) or via Sendcloud (see section 11); for this purpose they receive names, addresses, telephone number and email address for collection and delivery notifications. If you provide the recipient\u2019s email address, we send the recipient a one-off email after booking with your name, the carrier, the collection date and the tracking number so that they can expect the delivery (Art. 6(1)(f) GDPR; legitimate interest in successful delivery). We query the status of the shipment with the carrier until delivery and inform you of the delivery. We store the shipping label as a PDF on our server so that you can download and print it. We automatically delete the label PDF and the recipient's telephone number and email address 30 days after delivery or cancellation, and no later than 90 days after creation; if damage or loss has been reported, only once the claim has been settled. The tracking number, carrier, collection and delivery dates, dimensions and weight remain with the order as part of the accounting records. If you have booked higher liability (declared value), we also provide the value of goods to the carrier; in the event of damage, we transmit the information needed to settle the claim (shipment data, description of the damage, photos, proof of value) to the carrier, its insurer and our insurer (Art. 6(1)(b) and (f) GDPR). The carriers process this data under their own responsibility. For shipments to third countries, the transfer is necessary for the performance of the contract (Art. 49(1)(b) GDPR); for transfers to the USA, see section 22. The legal basis is Art. 6(1)(b) GDPR (offer and contract); we process the data of a recipient you name on the basis of Art. 6(1)(f) GDPR (legitimate interest in delivering the shipment commissioned). To prevent misuse, we limit the number of price queries and requests per IP address and email address; for this purpose we store a check value (hash) of this information for one hour (Art. 6(1)(f) GDPR). In addition, we use the Cloudflare Turnstile service in the request and booking form (Cloudflare, Inc., USA; see section 10): your IP address and technical characteristics of your browser are transmitted to Cloudflare to check whether the request comes from a human (Section 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act, TDDDG; Art. 6(1)(f) GDPR). Your request is deleted automatically after 180 days. A booking that you started but did not pay for is deleted automatically, together with the addresses entered, after 30 days. If an order is placed, we retain invoices and accounting records in accordance with the statutory retention periods under commercial and tax law (Art. 6(1)(c) GDPR).<\/p>\n We use cookies and similar technologies (e.g. your browser\u2019s storage). To manage your consent we use the software Borlabs Cookie, which runs on our own server; no data is transmitted to the manufacturer. The banner assigns our services to four groups: \u201cEssential\u201d, \u201cStatistics\u201d, \u201cMarketing\u201d and \u201cExternal Media\u201d. Services in the Statistics, Marketing and External Media groups are only loaded after you have given your consent; until then their scripts or content are blocked. Your choice is stored together with a random identifier in the \u201cborlabs-cookie\u201d cookie for 60 days and logged on our server as proof of your consent.<\/p>\n You can change or withdraw your choice at any time via the \u201cCookie settings\u201d link in the footer or here: Cookie settings<\/a> . If you withdraw consent, the cookies and browser entries of the service concerned are deleted on your next page view. This does not affect the lawfulness of processing carried out before the withdrawal.<\/p>\n Without consent we only set cookies and browser entries that are strictly necessary for the service you have requested, in particular for login and session, checkout, your consent decision, security (see section 4) and payment (see section 10). We only store an identifier for your wish list once you use the wish list; the shop only remembers recently viewed items for logged-in users. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR. For services that require consent, the legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. An overview of the individual cookies with provider and storage period is available in the cookie settings.<\/p>\n We only use the following services if you have given your consent in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). They help us to analyse the use of our services and to measure the effect of our advertising. With Google, Meta and TikTok, data may be transferred to third countries (see section 22).<\/p>\n Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). Google Analytics 4 statistically analyses the use of our platform (e.g. pages visited, items viewed, orders). Cookies (e.g. _ga, _ga_*) are set and pseudonymous usage profiles are created. Without your consent, Google Analytics is not loaded and no data is transferred to Google. Google processes the data on our behalf. Further information: https:\/\/policies.google.com\/privacy<\/a>.<\/p>\n If you have given your consent, our shop system remembers for the duration of your visit how you reached us: the referring website or search engine, campaign details from the link you followed (so-called UTM parameters), the first page visited, the time, the number of page views and your browser identifier. For this purpose, cookies starting with sbjs_ are stored, which are only valid for the current browser session. If you place an order, we store this origin information together with the order in order to understand which channels lead to purchases. The data remains on our systems and is not passed on to third parties. Without consent, these cookies are not set and no origin information is stored.<\/p>\n Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (parent company: Meta Platforms, Inc., USA). We use the Meta Pixel to measure the effectiveness of our advertising on Facebook and Instagram and to target advertising more precisely. Events such as page views, items viewed, searches and completed orders are transmitted to Meta, and cookies (e.g. _fbp, _fbc) are set. If you are logged in and have given your consent, we additionally report the same events directly from our server to Meta (Conversions API); in this case, details such as your email address or name may be transmitted in encrypted (hashed) form so that Meta can match the events. Browser and server events are combined via a shared identifier to avoid double counting. Without your consent, no data is transmitted.<\/p>\n We are jointly responsible with Meta for the collection and transmission of this data to Meta (Art. 26 GDPR); the details are set out in Meta\u2019s controller addendum: https:\/\/www.facebook.com\/legal\/controller_addendum<\/a>. Meta is solely responsible for any subsequent processing. You can also exercise your rights directly against Meta. Further information: https:\/\/www.facebook.com\/privacy\/policy<\/a>.<\/p>\n Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. We use the TikTok Pixel and the server-side Events API to measure the effectiveness of our advertising on TikTok and to target advertising more precisely. Events such as page views, items viewed and completed orders are transmitted to TikTok, and cookies (e.g. _ttp, _tt_enable_cookie, ttcsid) and browser storage entries are set; for server-side events, contact details may be transmitted in encrypted (hashed) form. Without your consent, no data is transmitted. We are jointly responsible with TikTok for the collection and transmission to TikTok (Art. 26 GDPR); TikTok is solely responsible for any further processing. According to TikTok, data is also transferred to third countries; access from countries without an adequate level of data protection (e.g. China) cannot be ruled out. Further information: https:\/\/www.tiktok.com\/legal\/page\/eea\/privacy-policy\/de<\/a>.<\/p>\n The fonts and program libraries used on this website (e.g. for page display and maps) are loaded locally from our own server. No connection is established to servers of Google, to public delivery networks such as jsDelivr or unpkg, or to other external providers. For fonts within the payment fields, see section 10.<\/p>\n In our directories (surf spots, surf shops and surf schools) we show interactive maps with map tiles from OpenStreetMap (OpenStreetMap Foundation, St John\u2019s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom; \u00a9 OpenStreetMap contributors). When a map is loaded, your browser retrieves the tiles from servers of the OpenStreetMap Foundation and transmits your IP address, browser information and the map position requested. The tiles are delivered via the global delivery network of the service provider Fastly, Inc. (USA); which server responds depends on your location. An adequacy decision of the EU Commission exists for the United Kingdom; for transfers to the USA, see section 22. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in showing locations in our directories). Further information: https:\/\/osmfoundation.org\/wiki\/Privacy_Policy<\/a>.<\/p>\n
Hausener Str. 8, 87665 Mauerstetten, Germany
Represented by the managing directors: Sonnya Endhart, Manuel Endhart
Commercial register: Local Court (Amtsgericht) Munich, HRB 259935
VAT ID: DE297856758
Email: hey@99waves.com<\/a><\/p>\n2. General information and legal bases<\/h2>\n
3. Hosting and server logs<\/h2>\n
Sending emails<\/h3>\n
4. Content delivery and website protection (Cloudflare)<\/h2>\n
5. SSL\/TLS encryption<\/h2>\n
6. Registration and user account<\/h2>\n
7. Processing of purchases (marketplace)<\/h2>\n
8. Collection as a direct transaction<\/h2>\n
9. Messages and price offers between users<\/h2>\n
10. Payment processing (Stripe)<\/h2>\n
Fraud prevention for payments and payouts<\/h3>\n
Protection against misuse in messages, listings and registration<\/h3>\n
11. Shipping (Sendcloud and carriers)<\/h2>\n
12. Cookies and consent management (Borlabs Cookie)<\/h2>\n
13. Statistics and marketing with your consent<\/h2>\n
Google Analytics 4 (\u201cStatistics\u201d group)<\/h3>\n
Order origin \u2013 WooCommerce order attribution (\u201cStatistics\u201d group)<\/h3>\n
Meta Pixel and Conversions API (\u201cMarketing\u201d group)<\/h3>\n
TikTok Pixel and Events API (\u201cMarketing\u201d group)<\/h3>\n
14. Fonts and program libraries<\/h2>\n
15. Maps in our directories<\/h2>\n
16. Offers from eBay (eBay Partner Network)<\/h2>\n