PRIVACY POLICY.

PURPOSES AND LEGAL BASES

• Account, service and member-requested features — Article 6(1)(b) GDPR: registration, authentication, profiles, listings, messages, builds, forum and Storefront features, account support and the steps requested before entering the user agreement.
• Optional approximate location — Article 6(1)(a) GDPR: permission and location sharing are voluntary and can be withdrawn by clearing the location in Account & Safety or disabling device permission. Withdrawal does not affect processing already carried out lawfully.
• Safety, security and service integrity — Article 6(1)(f) GDPR: rate limiting, fraud and abuse prevention, moderation, reports, audit records, debugging and the establishment, exercise or defence of legal claims. The legitimate interests are keeping members safe, enforcing the rules and maintaining a reliable service; Partwerk limits access and retention to balance those interests against member rights.
• Legal duties — Article 6(1)(c) GDPR: disclosures, preservation or other processing required by applicable law or a binding authority request.

The registration confirmation records that the member meets the minimum age and accepts the governing documents. It is not treated as blanket GDPR consent; a separate choice is used whenever consent is the applicable legal basis.

RETENTION

• Accounts and deleted accounts: Account data is retained while the account exists. When an account is deleted, identifying profile data, owned content and managed uploads are removed without undue delay. A de-identified structural record is retained only while referenced by shared conversations, safety records or legal evidence. Unreferenced tombstones are deleted after the end of the third calendar year following deletion unless a documented legal hold applies.
• Security and server logs: STRATO retains visitor IP addresses used for security for no more than 7 days. Anonymised access-log archives may remain available for up to 6 weeks. Partwerk rate-limit records become eligible for scheduled deletion after their protection window expires and a 24-hour security grace period. Bounded cleanup runs continue at short intervals while an eligible backlog remains. Records connected to a confirmed security incident may be retained until the end of the third calendar year following closure where needed for legal claims.
• Reports and staff audit records: Routine closed safety reports are retained for 12 months after closure. Staff audit logs and restricted reports concerning scams, counterfeits, unsafe items, harassment or legal claims are retained through the end of the third calendar year following the relevant action or closure. A documented legal hold may extend either period while an active matter requires the record.
• Email delivery records: Successful email delivery records are retained for 30 days and failed delivery records for 90 days. Email-verification links expire after 24 hours and password-reset links after 1 hour. Used or expired token records are deleted within 30 days.
• Backups: Rolling database and webspace backups are retained for no more than 30 days and then overwritten or deleted. Deleted data may remain in a backup until that backup expires. Backups are used only for disaster recovery, and account deletions are re-applied after any restore.

COOKIES, DEVICE STORAGE AND NOTIFICATIONS

The website and app use a strictly necessary, secure session cookie to keep members signed in, protect forms and maintain security. The protected server-side session also remembers recently viewed listing IDs for up to 24 hours solely to stop refreshes from inflating the public aggregate view total; no viewer identity, IP address or device fingerprint is stored with that total. An authenticated session remains available for up to 30 days without activity and requires a fresh sign-in after 90 days in total. Signing out removes the persistent authenticated session. No advertising, cross-company tracking or optional analytics cookie is configured in this release.

App notifications are optional. When enabled, Partwerk stores the Apple device token needed to deliver new-listing and community alerts through Apple Push Notification service. The token is removed when notifications are disabled or the member signs out, and invalid or expired tokens are deleted automatically. The app may also schedule a local reminder on the device after 72 hours away; it does not require browsing-history tracking and can be disabled in Garage or iOS Settings.

YOUR CHOICES AND GDPR RIGHTS

Members can edit profile information, remove their own content where the feature permits, clear optional location, block other members and permanently delete an account inside the app. Account deletion disables sign-in, removes identifying profile data and owned content, removes managed uploads, and replaces shared text with a removal notice where another participant's content must remain.

You may request access, rectification, erasure, restriction, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time for the future. Send a request to privacy@partwerk.shop. Partwerk may need enough information to verify the requester and may retain limited data where an exception or legal obligation applies.

RIGHT TO COMPLAIN

You have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, workplace or the alleged infringement. Partwerk's competent authority is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW) (poststelle@lfdi.bwl.de). You may contact Partwerk first, but you do not have to.

AUTOMATION, SECURITY, CHILDREN AND CHANGES

Keyword filters and rate limits may automatically reject a post or request, but Partwerk does not use solely automated decisions that produce legal or similarly significant effects under Article 22 GDPR. Significant moderation and account actions can be reviewed by a person through support.

Partwerk uses access controls, one-way password hashing, rate limits, metadata-stripping image processing and restricted moderation records to protect the service. No online service is risk-free. Accounts are intended only for people aged 18 or older. Material policy changes will be published here with a new effective date and, where required, presented for renewed acceptance.