Privacy Policy

Please note: Flohmarkt-Karte.de is operated by a sole proprietorship based in Germany. This service is subject to German law and the EU General Data Protection Regulation (GDPR).

1. Overview of data processing

The following notes provide a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally.

Data collection on our website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. Their contact details can be found in the legal notice ("Impressum") of this website.

How do we collect your data?

Your data is collected in part when you provide it to us. This may, for example, be data you enter into a contact form or provide during registration.

Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (e.g. internet browser, operating system, or time of the page request).

2. Nature of our service - technical platform

Data processing as part of our platform

We only process data that is required to provide our technical platform:

• User data: For account creation and management
• Map data: For creating and displaying flea market maps
• Technical data: For the platform's functionality

We do NOT process any data about:

• Sales transactions between users
• Payment processing at flea markets
• Personal data of flea market visitors
• Specific product information or prices

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally.

Note on the responsible body

The body responsible for data processing on this website is named in the contact box above. The responsible body is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your explicit consent. You may withdraw any consent already given at any time. An informal email to us is sufficient for this. The lawfulness of any data processing carried out before the withdrawal remains unaffected.

4. Data collection on our website

Hosting

This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Personal data collected in the course of using this website (including server log files, account data) is processed on the host's servers. This is done on the basis of Art. 6(1)(f) GDPR, as we have a legitimate interest in a reliable and secure provision of our online offering through a professional provider. A data processing agreement (Art. 28 GDPR) exists with STRATO.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not combined with other data sources. This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of their website.

Contact form / support requests

If you send us enquiries via the contact form, the support area in the dashboard, or by email, your details from the enquiry, including the contact details you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions.

This data is processed on the basis of Art. 6(1)(b) GDPR (processing an enquiry in the context of an existing or pre-contractual relationship) or, where no contractual relationship exists, on the basis of Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

Registration on this website

You can register on our website to use additional features of the site (e.g. creating your own flea market maps). We only use the data entered for this purpose for the use of the respective offer or service for which you registered.

The mandatory information requested during registration must be provided in full. Otherwise we will refuse the registration. The data entered during registration is processed on the basis of Art. 6(1)(b) GDPR, as the processing is necessary to fulfil the usage relationship with you (provision of the user account).

Self-registration as a stall (email verification)

If you register yourself as a stall for a flea market via an organizer's registration form, we technically check whether the email domain you provided can generally receive emails (query of the responsible mail server, so-called MX/A record). We also send a confirmation email with a confirmation link to the address provided; only after this link is clicked is your registration submitted to the organizer for approval. This ensures that no registrations with incorrect or unreachable email addresses enter the organizer's stall management.

The legal basis is Art. 6(1)(b) GDPR (fulfilment of the usage relationship initiated by the registration) as well as Art. 6(1)(f) GDPR (legitimate interest in correct, abuse-free stall registrations).

Session cookies

To provide login functionality and navigation between pages, we use technically necessary session cookies as well as a cookie that stores whether you have already acknowledged our cookie notice. These cookies are strictly necessary for the operation of the website and are set without separate consent, § 25(2) no. 2 TDDDG (German Telecommunications and Digital Services Data Protection Act). No analytics, marketing, or tracking cookies are used. Further information is available via the cookie info button on the website or the "Cookie information" link in the footer.

5. Special features of our website

OpenStreetMap

We use the map service provided by OpenStreetMap (OSM). The provider is the OpenStreetMap Foundation (OSMF), 132 Maney Hill Road, Sutton Coldfield, West Midlands, B72 1JU, United Kingdom.

When you visit a website on which OpenStreetMap is embedded, your IP address and other information about your behaviour on this website are transmitted to the OSMF. The legal basis for this is Art. 6(1)(f) GDPR.

QR code generation

Our website offers the option of generating QR codes for flea market maps. This function is carried out locally in your browser, and no personal data is transmitted to external servers.

"Like" function for stalls

Visitors can mark individual stalls on a flea market map with "Like". To prevent multiple likes from the same person, we store a hash value formed from your IP address and browser identifier (user agent), as well as a further hash value formed from your IP address alone. Your IP address itself is not stored in plain text.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring a reliable and abuse-free evaluation of "Like" entries.

Communication function for organizers

Organizers can send an email to all or selected stalls of their event via the "Communication" section of their map in the dashboard. The email address provided by the respective stall during registration is stored as the recipient, along with the subject, message text, and time sent, so that the organizer can view the communication history for their map. The sender is a fixed sender address of Flohmarkt-Karte.de; replies are forwarded directly to the organizer's email address (reply-to).

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest of the organizer (and of us as platform operator) lies in being able to transmit organisational information about an event to the stalls registered there.

API access to your own stall data

Registered organizers can generate a personal API key in their profile to programmatically retrieve the stall data of their own maps (including the contact details provided by the stalls) as JSON, e.g. for their own vendor management. Every request made using this key is logged with time, IP address, and browser identifier, so that organizers and we as operator can trace the use of the key and detect abusive access. The key itself is only stored encrypted (as a hash).

The legal basis is Art. 6(1)(b) GDPR (provision of this additional feature within the usage relationship) as well as Art. 6(1)(f) GDPR (legitimate interest in detecting abuse through access logging).

For internal support purposes, a separately protected, non-publicly accessible access is also available, through which we as operator can retrieve map and stall data in individual cases, for example to investigate specific support requests ("location is not shown"). These accesses are also logged. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in efficient troubleshooting in support cases).

Public API for third parties

We provide (or are currently preparing) an API through which authorised third parties (e.g. other event portals) can access publicly visible flea market dates and locations in read-only mode. Access is exclusively via a personal API key, which we manually activate for a registered account following an individual request. Access via this key is also logged with time, IP address, and browser identifier for abuse detection.

The data provided via this API (dates, location) is already publicly visible on the respective flea market map and contains no personal data of stall operators or visitors. The legal basis for logging API access is Art. 6(1)(f) GDPR (legitimate interest in abuse detection).

6. Analytics and advertising

Website statistics

We use a self-developed, server-side visitor count to determine the number of views for individual flea market maps. For each view, the page URL accessed, the IP address, the browser identifier (user agent), and the time of the visit are stored to avoid counting the same visitor multiple times within a day. No third-party tools such as Google Analytics or Matomo are used, no cookies are set for this purpose, and no persistent user profiles are created.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in determining the reach of the flea market maps created on the platform, among other things to provide organizers with statistics about their map in the dashboard. The collected data is automatically deleted after 30 days (see section 10, retention period).

7. Plugins and tools

Font Awesome

This site uses the Font Awesome icon library for a consistent display of symbols. The files required for this are delivered exclusively from our own server (self-hosting). There is no connection to servers of Fonticons Inc. or any other external provider, and no personal data is transmitted to third parties.

Leaflet (map display)

We use the open-source JavaScript library Leaflet to display interactive maps. Leaflet is developed by Vladimir Agafonkin and is available under the BSD 2-Clause licence.

When using Leaflet, map data is loaded from OpenStreetMap servers. In doing so, your IP address may be transmitted to the respective servers.

8. Your rights

You have the following rights with regard to personal data concerning you:

• Right of access: You may request information about your personal data processed by us.
• Right to rectification: You have the right to have inaccurate or incomplete personal data concerning you corrected and/or completed.
• Right to erasure: You may request the deletion of your personal data.
• Right to restriction of processing: You have the right to request the restriction of the processing of your personal data.
• Right to data portability: You have the right to receive your data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to the processing of your personal data.

Right to lodge a complaint with the competent supervisory authority

In the event of a breach of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the state data protection officer of the German federal state in which our company is based.

9. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL/TLS encryption.

You can recognise an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the lock icon in your browser bar.

10. Retention period

We store personal data only for as long as is necessary to fulfil the purposes pursued, or as long as statutory retention periods require.

• Contact enquiries: Deleted after complete processing, at the latest after 2 years.
• User accounts: Deleted upon request or after prolonged inactivity (> 2 years).
• Server logs: Automatically deleted after 30 days.
• Stall vendor data (name, contact details, location assignment): Deleted 1 year after the end of the event. The map itself (event name, date, view count) contains no personal data and remains as an archive page.
• API access logs (organizers' own API key, public API for third parties, and internal support access): Retained for abuse detection and cleaned up regularly, at the latest upon deletion of the associated user account or revocation of API access.
• "Like" hash values (stall likes): Retained for deduplication checks and deleted at the latest 1 year after the end of the associated event.
• Communication history (communication feature of a map): Deleted together with the associated map, or at the latest 1 year after the end of the event.

11. Free use and donations

Flohmarkt-Karte.de is free to use and is financed exclusively through voluntary donations. This does not change our data protection provisions. All provisions stated above apply without restriction.

Payment processing via PayPal

If you decide to donate via the donation feature provided in the dashboard, payment processing is carried out via the "PayPal Donate" service of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. For the donation process, you will be redirected to the PayPal website, where you complete the payment using your PayPal account or other payment methods stored with PayPal. In doing so, the data required for payment processing (e.g. name, payment amount) is transmitted to PayPal.

The transmission of data is carried out on the basis of Art. 6(1)(b) GDPR (execution of the payment process) as well as Art. 6(1)(f) GDPR (legitimate interest in secure and convenient payment processing). Data processing by PayPal is carried out on their own responsibility and is governed by PayPal's privacy policy: https://www.paypal.com/en/webapps/mpp/ua/privacy-full. We ourselves do not store any payment data (e.g. bank details) in connection with donations on our own servers.

12. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements, or to implement changes to our services in the privacy policy.

The new privacy policy will then apply to your renewed visit. We will inform you of any significant changes.

13. Contact for data protection questions

If you have questions about data protection, your rights, or this privacy policy, please contact:

We will respond to your enquiry as quickly as possible, but no later than within 30 days.