Privacy Policy

The controller responsible for processing data on this website is:

Represented by the chairwoman Magdalena De Gasperi. Phone: +49 6173 30-2188, email: info@foerderkreis-braunsammlung.de.

The controller is the body that decides, alone or jointly with others, on the purposes and means of processing personal data. We have not appointed a data protection officer, as we are not required to do so under § 38 BDSG. For any data protection matter, please contact us using the details above.

Personal data is any information relating to an identifiable natural person. We process such data only insofar as it is necessary to operate this website, to answer your enquiries, and to administer club membership.

We do not use any tracking or advertising tools on this website and we do not build user profiles. To learn which pages are visited and how often, we only use cookieless, statistical audience measurement (see section 13). Fonts and image files are served from our own server and are not loaded from third-party networks.

You have the following rights at any time with regard to your personal data:

• —Right of access (Art. 15 GDPR)
• —Right to rectification of inaccurate data (Art. 16 GDPR)
• —Right to erasure (Art. 17 GDPR)
• —Right to restriction of processing (Art. 18 GDPR)
• —Right to data portability in a common, machine-readable format (Art. 20 GDPR)
• —Right to object to processing based on a legitimate interest (Art. 21 GDPR)
• —Right to withdraw consent at any time with future effect (Art. 7(3) GDPR)

An informal message to the contact details under section 1 is sufficient to exercise these rights. Access is free of charge. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Each time this website is accessed, our hosting provider automatically collects information transmitted by your browser and stores it in so-called server log files:

• —browser type and version
• —operating system used
• —referrer URL (the page visited previously)
• —host name of the accessing device
• —time of the server request
• —IP address

This data is technically necessary to deliver the website to you, to ensure its stability and security, and to detect abusive access. The legal basis is our legitimate interest in technically sound and secure operation (Art. 6(1)(f) GDPR). We do not merge this data with other sources and do not use it to identify you.

On the retention period: these log files are generated automatically by our hosting provider; we do not create log files of our own. We have not set up any log export into a system of our own, so entries are only held for the short, plan-defined period set by our provider and are then deleted automatically. We do not store them beyond that.

We use the following service providers as processors to operate this website. Data processing agreements pursuant to Art. 28 GDPR are in place with all of them. These providers process your data solely on our instructions and not for their own purposes.

• —Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA – website hosting, running the application, and storing uploaded image files (Vercel Blob), and audience measurement (Vercel Web Analytics, see section 13). The application runs in a data centre in Frankfurt am Main, Germany.
• —Neon Inc., USA – operation of the PostgreSQL database holding member and listing data. The database is located in the European Union (Frankfurt am Main).
• —Resend (Plus Five Five, Inc.), USA – sending the emails triggered by this website (forwarding contact enquiries and password reset emails).

The application runs and your data is stored within the European Union (Frankfurt am Main). The providers named above are, however, companies based in the USA, so access from the USA — for instance in the course of maintenance and support — cannot be ruled out. Emails sent via Resend are dispatched using infrastructure in the USA.

Insofar as personal data is transferred to the USA in this context, the transfer is made on the basis of the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) or, where the provider concerned is certified under the EU-US Data Privacy Framework, on the basis of the European Commission's adequacy decision (Art. 45 GDPR). Please note that US authorities may under certain conditions gain access to data processed there.

Cookies are small text files that your browser stores on your device. We use strictly necessary cookies only:

• —NEXT_LOCALE – stores the language you selected (German or English) so that you do not have to choose it again on every page.
• —__Secure-authjs.session-token – keeps you signed in to the member area during your visit. It is only set once you sign in and becomes invalid when you sign out or when the session expires.
• —__Host-authjs.csrf-token – protects the sign-in and sign-out forms against cross-site request forgery (CSRF). This cookie is already set when you open the sign-in page, and therefore also if you do not go on to sign in.
• —__Secure-authjs.callback-url – remembers, for the duration of the sign-in, which page you want to return to afterwards.

The last three cookies come from the Auth.js sign-in library. Over an unencrypted connection — during local development, for instance — they carry the same names without the "__Secure-" and "__Host-" prefixes.

In one place we also use your browser's session storage: when you dismiss the notice about a missing email address in the member area, we record there that you have seen it so that it does not reappear on every page change. That entry contains no personal data and is deleted when you close the browser tab at the latest.

These cookies and the session storage entry described above are strictly necessary to provide the functions you have expressly requested and therefore do not require consent under § 25(2) no. 2 TDDDG. The legal basis for the associated processing is Art. 6(1)(f) GDPR.

We do not use analytics, tracking or marketing cookies; the audience measurement described in section 13 also works without cookies and without storing anything on your device. A cookie consent banner is therefore not required on this website. You can delete cookies or prevent them from being stored in your browser settings at any time; signing in to the member area and the language selection will then no longer work.

If you write to us using the contact form, we process the details you provide — your name, your email address and your message — in order to handle your enquiry and any follow-up questions. The details are not stored in our database but forwarded as an email to our club address; we use the provider Resend named in section 5 to send it.

The legal basis is our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). If your enquiry concerns entering into or preparing a membership, the legal basis is Art. 6(1)(b) GDPR.

We delete your enquiry once it has been dealt with conclusively and no statutory retention obligations apply. The form contains a field invisible to you which serves to block automated spam submissions; no additional personal data is collected in the process.

Admission to the club takes place via the written application form. Self-registration through this website is not possible; we create your member area credentials on the basis of your application.

In the member area we process the following data: name or username, email address, your password (as a hash value only, see section 9), display name, the role and status of your membership, and the date since which you have been a member. You may optionally add further profile details: a short description, your location, your collecting interests and a profile picture.

The legal basis for the data required to administer membership is Art. 6(1)(b) GDPR (performance of the membership relationship). We process the optional profile details on the basis of your consent (Art. 6(1)(a) GDPR); you can change or remove them in your profile at any time.

Member profiles are never publicly accessible. They are visible only to signed-in members. In your profile settings you can specify that your profile is visible only to the club's administrators.

After your membership ends, we delete your user account and the associated profile data. Statutory retention periods, in particular under tax and commercial law, remain unaffected.

We store your password exclusively as a cryptographic hash (bcrypt). We do not know your password in plain text and cannot recover it.

If you use the “forgot password” function, we send a link containing a single-use token to the email address stored in your account. This token expires after one hour and is deleted once used. The legal basis is Art. 6(1)(b) GDPR and our legitimate interest in account security (Art. 6(1)(f) GDPR).

As a member you can post classified listings on the bulletin board. In doing so we process the details you enter: title, description, listing type, category, condition, price, location, images, and the contact email address and/or phone number you provide.

Please note: the contact details given in a listing are visible to all signed-in members so that they can get in touch about your listing. Therefore only provide contact details that you are happy to share with other members. Listings are not publicly accessible and cannot be viewed by visitors who are not signed in.

The legal basis is the consent you give by posting the listing (Art. 6(1)(a) GDPR). You can edit your listing, mark it as sold, or delete it entirely at any time. Deleting it also removes the contact details it contained.

Images that you upload as a profile picture or in a listing are resized on the server and converted to the WebP format. In the process, the metadata contained in the image file — such as EXIF details about the time of capture, the device used, or GPS coordinates — is removed and not stored.

We store the processed image files with Vercel Blob (see section 5) under a randomly generated address that cannot be guessed. This address is technically retrievable without signing in; however, we do not link to it outside the member area. Please therefore do not upload images that you would not want shown outside the club under any circumstances.

When you replace or remove an image, delete your listing, or your membership account is closed, we also delete the image file from the storage service. It can no longer be retrieved via its previous address afterwards.

On the “Visit” and “Contact” pages we embed a map from the Google Maps service to help you find your way to us. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is not loaded automatically. As long as you do not activate it by clicking, no data is transmitted to Google. Only once you activate it are your IP address and technical details about your browser transmitted to Google; a transfer to the USA cannot be ruled out. Google may be able to associate this data with a Google account if you are signed in to one.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time by reloading the page and not activating the map again. Our address is also given in text form on the same pages, so you do not need to activate the map.

To understand which content people are interested in and to improve the website accordingly, we use Vercel Web Analytics, a service of our hosting provider Vercel Inc. (see section 5). When you open a page, a small script loaded from our own domain sends the following details to Vercel:

• —the page you opened (the path only, without any appended parameters)
• —the page you came from (referrer)
• —the time of the visit
• —browser and browser version, operating system and device type (desktop, tablet or mobile)
• —the approximate location derived from your IP address (country, region, city)

No cookies are set and nothing is stored on your device. Your IP address is not stored. To group repeated page views by the same person within a day, Vercel derives a hash value from the incoming request, which is discarded automatically after 24 hours. Tracking you across websites or recognising you beyond that period is therefore not possible. We only receive aggregated statistics and cannot draw conclusions about individual visitors from them.

The legal basis is our legitimate interest in designing and improving our website according to visitors' needs (Art. 6(1)(f) GDPR). Vercel processes the data as a processor on our behalf; the information in section 5 on possible transfers to the USA applies. The statistics are held for the period set by our provider's plan and are then deleted automatically.

You can object to audience measurement at any time (Art. 21 GDPR). The easiest way is to enable the "Global Privacy Control" or "Do Not Track" signal in your browser: if either is set, your visit is not recorded. Alternatively, an informal message to the contact details under section 1 is sufficient.

This website is served exclusively over a TLS-encrypted connection (HTTPS), and encryption is permanently enforced via HTTP Strict Transport Security. You can recognise the encrypted connection by the padlock symbol in your browser's address bar. We store passwords as hash values only. Access to member data is limited to signed-in members and, where necessary for administration, to the club's administrators.

Please note that data transmission over the internet — for example when communicating by email — may have security gaps. Complete protection of data against access by third parties is not possible.

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place. We do not evaluate your behaviour automatically and take no decisions based solely on automated processing.

We hereby object to the use of contact details published in fulfilment of our imprint obligation for sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of unsolicited advertising being sent, for example by spam email.

We update this privacy policy when the processing of your data or the legal situation changes — for example because we offer new features. The version published on this page applies in each case.