Source: https://www.cardmarket.com/en/Policies/PrivacyPolicy
Timestamp: 2019-04-19 12:50:35+00:00

Document:
Sammelkartenmarkt GmbH & Co. KG collects, processes and uses your personal data in compliance with the strict German and European data protection regulations. Apart from certain particulars required to offer you our services, you may determine yourself which information to provide.
On our website we use, as far as possible, secure transmission technologies, e.g. SSL encryption. However, data transfer on the Internet, especially the communication via e-mail, may involve security gaps. A complete data protection against access of third parties is not possible.
By using the website www.cardmarket.com (hereafter: online platform), but at the latest when registering as a user, you grant your consent to the collection, processing and use of the entered personal data by the Sammelkartenmarkt GmbH & Co. KG as responsible entity on their servers. Please note that the data transmitted by you as part of the use of the website are processed and saved by means of an EDP system. It is understood that we treat your personal data strictly confidentially.
Personal data, i.e. specific data about the personal or factual circumstances of a particular or identifiable natural person, are only collected as far as necessary for the performance of the contract and for the provision of contractual services. The collection of data is carried out exclusively to the extent provided by you.
The processing of personal data may consist in saving, changing, transmitting, blocking and deleting of these data. Any personal data are only saved by us as long as this is necessary for the respective specified purpose or we are obligated by law to save this information.
Already when visiting our website, your information may also be saved to the server when having access (e.g. date, time, pages visited). This data is not considered personal data, but they are anonymised, for example name of the Internet provider, type of Internet browser, pages visited on the website. These data are used for statistical purposes only and to improve our services. By accessing the site, data may also be saved on your computer. These data are called “cookies” and they facilitate the use of the website. However, you have the option to deactivate this function in your web browser. This may result in limitations when using our website.
The user’s personal data will not be transmitted to any third party. Exempt from this are only the service partners of the Sammelkartenmarkt GmbH & Co. KG needed for the completion of the contractual relationship, e.g. providers of payment services (such as e.g. PayPal) as well as a transmission of data to authorities within our legal obligations. In these cases, the provisions of the German Federal Data Protection Act (BDSG) will be strictly observed, the data transfer will be restricted in any event to a minimum extent.
You shall be entitled to the right of withdrawal of the consent with effect for the future at all times and without limitations. The contact data for exercising the withdrawal may be found in the About us section of our website.
You have the right to information free of charge on your stored personal data as well as to the correction, deletion or blocking thereof, in as far as personal data are concerned for the purposes of the BDSG. In order to contact us, please use the contact data to be found in the About us section of our website.
In general, the processing of personal data is only done to the extent necessary for the provision of a functional website including contents and services. Regular processing of data is only done upon consent of the data subject. As an exception, the processing of data is done without consent of the data subject if this is not possible for practical reasons and the processing of data is permitted by legal provisions.
Art. 6 (1) point (a) GDPR serves as legal basis for the processing of personal data in so far as the consent of the data subject has been obtained for the processing of personal data.
Art. 6 (1) point (b) GDPR serves as legal basis for the processing of personal data insofar as this is necessary for the performance of a contract to which the data subject is a contractual party. This also applies to processing necessary for the implementation of pre-contractual measures.
Art. 6 (1) point (c) GDPR serves as legal basis for the processing of personal data insofar as the processing of personal data is necessary for the performance of a legal obligation to which the company is subject.
Art. 6 (1) point (f) GDPR serves as legal basis for the processing of personal data insofar as this is necessary for the processing for the protection of a legitimate interest of the company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest.
The personal data of the data subject will be deleted or blocked as soon as the purpose of the data storage is no longer applicable. Storage beyond this purpose can be done if this is required by relevant national or European regulations. Blocking or deleting of the data is also done when a retention period prescribed by the aforementioned regulations expires unless further storage of data is required for the conclusion or performance of a contract.
With each visit to the website, the system automatically records data and information from the computer system of the calling computer.
The data are saved in the log files of the system. Storage of this data together with other personal user data does not take place.
The legal basis for this is art. 6 (1) point f GDPR.
The collection and temporary storage of the IP address is necessary to enable the presentation of the website on your device. For this, your IP address has to be saved for the duration of your visit of the website. An analysis of these data for marketing purposes does not take place.
The data are deleted when the respective session is ended. If these data are saved in log files, this is done at the latest after seven days. Storage beyond this is possible. In this case, the users’ IP addresses are deleted or alienated so that they can no longer be assigned to the calling client.
The collection of data for the availability of the website and the storage of data in log files for availability of the website are absolutely necessary. Therefore, there is no possibility of appeal.
Commercial users are also required to enter the company name, the VAT ID and the phone number. Where applicable, a tax statement is required pursuant to section 22f (1) sentence 2 VAT Act. Users who use our platform as non-commercial sellers are required to enter their birth date in addition to the above mentioned data.
The legal basis for this, upon consent of the user, is art. 6 (1) point (a) GDPR. If the registration serves the performance of a contract to which the user is a contractual party or serves the implementation of pre-contractual measures, art. 6 (1) point (b) GDPR is an additional legal basis for the processing of data. As far as we are obliged to process data of commercial users and private sellers, the legal basis is art. 6 (1) point (c).
The registration of the user is required to set up a customer account. It serves to identify the user and to perform the user contract via the service. The data entered by commercial users or private sellers are collected for the fulfillment of our legal obligations to the financial authorities.
The data will be deleted as soon as it is no longer required for the fulfilment of the purpose for which they were collected. This is the case during the registration process for the performance of a contract or the implementation of pre-contractual measures if the data is no longer required for the implementation of the contract. Even after conclusion of the contract, it may be required to save personal data of the contractual partner to meet contractual or legal obligations.
Data subjects may modify at any time the user data in their user profile under www.cardmarket.com/Magic/MainPage/showMyAccount. Where the data is required for the performance of a contract or the implementation of pre-contractual measures, an advance deleting of data is only possible in so far as the deletion is not barred by contractual or legal obligations.
To use the online marketplace, inventory data (e.g. names and addresses as well as contact data of users, user names of authorised users) and contract data (e.g. services used, names of contact persons, payment information) are processed as well as the IP address and the time of the respective user intervention, the user ID and the accessed URLs. This data is stored in the log files of our system. Apart from that, data of third parties entered by the user are processed.
The legal basis for the processing of data upon consent of the user is art. 6 (1) point (a) GDPR. The consent is obtained upon conclusion of the contract.
Additional legal basis for the processing of data is art. 6 (1) point (b) GDPR, as the processing of the specified data serves to perform a contract to which the user is a contractual party or to implement pre-contractual measures.
Furthermore, processing is done to improve our services for the benefit of the analysis, optimisation and the economic operation of our website for the purposes of art. 6 (1) point (f) GDPR.
of the inventory data (e.g. names and addresses as well as user contact data) and contract data (e.g. services used, names of contact persons, payment information) is the implementation of the contract as well as billing purposes.
of user names and the entries of the respective users is to ensure the access authorisation of the service.
of the IP address, time of the respective user intervention as well as the accessed URLs is done to optimise our services and to continually improve the user experience.
of third party data entered by the user is the implementation of the contract and the provision of the contracted services.
The data will be deleted as soon as they are no longer required for the fulfilment of the purpose for which they were collected. This is the case for the data collected during the registration process for the performance of a contract or the implementation of pre-contractual measures if the data is no longer required for the implementation of the contract. Even after conclusion of the contract, it may be required to save personal data of the contractual partner to meet contractual or legal obligations (especially fiscal retention periods).
Data subjects may modify or delete the saved data at any time. Where the data is required for the performance of a contract or the implementation of pre-contractual measures, an advance deleting of data is only possible in so far as the deletion is not barred by contractual or legal obligations. In particular, the notice periods of current contracts shall remain unaffected.
As soon as the question is published on the website, this is only done in an anonymised form. Otherwise, no data is passed on to a third party. The data are used exclusively for the processing of the conversation.
The legal basis for the processing of data upon consent of the user is art. 6 (1) point (a) GDPR. Otherwise, the legal basis for the processing of data is art. 6 (1) point (f) GDPR.
The processing of personal data from the input mask only serves to answer the commentaries on the respective product. Our legitimate interest in the processing lies in the provision of useful product information for other users. Any other personal data processed during sending serve to prevent misuse of the question form and to ensure the security of the information technology systems.
The data will be deleted as soon as they are no longer required for the fulfilment of the purpose for which they were collected. This is the case for the personal data from the question form when the question has been answered completely. The additional personal data collected during sending will be deleted at the latest after seven days.
The data subject may at any time withdraw consent to the processing of personal data. You can object to the storage of personal data at any time. However, in such a case the asked questions cannot be answered. Any personal data saved during the question will be deleted in this case. Insofar as there is no personal traceability by posting a question or an answer, these will remain available with the respective product.
The use of the API using a permanent Access Token enables you to access your own inventory data as well as publicly available data such as trading card prices etc. Neither you nor other users have access to each other’s’ inventory data.
Commercial developers of apps and similar application programmes are provided with an App Key. Here too, no personal data or granting of access rights to such data will be passed on at first.
However, if you log in with your data (user name and password) via a third-party app, you grant this app a temporary access (read and write), limited to 24 hours, to your own inventory data.
A transfer to a third party does not take place in this context. The data will be used exclusively for processing the conversation.
The legal basis for the processing of data upon consent of the user is art. 6 (1) point (a) GDPR.
The legal basis for the processing of data transmitted when sending an e-mail is art. 6 (1) point (f) GDPR.
If the e-mail contact is aimed at concluding or performing a contract, the additional legal basis for the processing is art. 6 (1) point (b) GDPR.
The processing of personal data from the input mask only serves to process the contact. In case of a contact via e-mail, this shall also constitute the required legitimate interest in the processing of data. Any other personal data processed during sending serves to prevent misuse of the contact form and to ensure the security of the information technology systems.
The data will be deleted as soon as they are no longer required for the fulfilment of the purpose for which they were collected. This is the case for the personal data from the input mask of the contact form and the data transmitted via e-mail when the respective conversation with the data subject has ended. The conversation is ended if the circumstances indicate that the respective issue has been resolved conclusively. The additional personal data collected during sending will be deleted at the latest after seven days.
The data subject may at any time withdraw consent to the processing of personal data. In case of a contact via e-mail, you can object to the storage of personal data at any time. However, in such a case the conversation cannot be continued. In this case, any personal data saved during contact will be deleted.
Cookies help to make the website more user-friendly. Some elements of the website require the identification of the calling browser even after the page was changed.
Transient cookies are deleted automatically when the session is closed. These include e.g. session cookies which save the so-called session ID and by means of which the different web inquiries can be allocated to the joint session. This allows for the device to be recognised in a new session.
Persistent cookies are deleted automatically after a prescribed retention period, which may be different for each cookie. The corresponding settings may be deleted at any time in the settings of the web browser.
The legal basis for this is art. 6 (1) point (f) GDPR.
Cookies are saved on the user’s computer and are transmitted from there to our website. Hence, you as user also have full control over how cookies are used. By changing the settings in your web browser, you can deactivate or limit the transmission of cookies. Already saved cookies can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it is possible that not all functions of the website can be used to their full extent.
The website uses Google Analytics only with the activated IP anonymisation as described above. This means that Google will process your IP address only in the shortened form. Therefore, a personal traceability can be excluded.
The legal basis for the processing is the legitimate interest in the analysis, optimisation and the economic operation of the website for the purposes of art. 6 (1) point (f) GDPR.
The website uses Google Analytics in order to analyse the website use and to continually improve different functions and offers as well as the user experience. Using statistical analysis of the user behaviour, the offer can be improved and designed to be more interesting for the user. Herein also lies the legitimate interest in the processing of the above data by Google.
The storage of cookies generated by Google Analytics may be blocked by adjusting the corresponding settings of the web browser. Please note that in this case you may not be able to make full use of all features of the website. If you wish to block the collection of data generated by the cookie and related to the user behaviour (including your IP address), you may download and install the web browser plugin available under the following link: http://tools.google.com/dlpage/gaoptout.
In order to oblige Google to process the transmitted data only as instructed and to comply with the data protection regulations, the controller has concluded a processing contract with Google.
For an alternative to the browser add-on or for browsers on mobile devices, please click this link opt out, in order to block the future collecting by Google Analytics on this website. This will file an opt-out cookie on your device. If you delete your cookies, you have to click the link again.
For users who visit our website from the People’s Republic of China (PRC), it is possible to use the services of Site Monitor of the provider Miaozhen Ltd, Beijing, PRC with servers in the PRC instead of Google Analytics for the same purpose and subject to the same restrictions. In order to deactivate Site Monitor, visit http://i.miaozhen.com.cookie_opt.html.
The website uses “Bings Ads”, an advertising service of “Microsoft” of Microsoft Corp., One Microsoft Way, Redmond, WA 98052-6399, USA (“Microsoft”). In the process, Microsoft files a cookie on your device, provided that you have entered our website via a Microsoft Bing ad. Both Microsoft and controller are able to know that someone clicked on the ad, was redirected to our website and has reached a predetermined target page (conversion site). During this process, only the total number is recorded of users who have clicked on a Bing ad and were then redirected to the conversion site. Microsoft collects, processes and uses information via the cookie to create user profiles using pseudonyms.
In this case, art. 6 (1) point (f) GDPR serves as legal basis.
The use of Bing Ads serves to analyse user behaviour and to show advertisements. No personal information on the identity of the user is processed.
If this is not desired, the required filing of cookies may be refused – e.g. by setting your browser to generally deactivate the automatic filing of cookies. Additionally, you may prevent the recording of data generated by the cookie and related to the use of the website as well as the processing of this data by Microsoft by objecting to the data use under the following link: http://choice.microsoft.com/opt-out. Find further information on data protection and on the used cookies at Microsoft and Bing Ads on the Microsoft website: https://privacy.microsoft.com/privacystatement.
Consent may be withdrawn here: opt out. Please note that if you delete your cookies, this cookie will also be deleted automatically.
The website uses “Facebook Pixel” (hereafter referred to as: “Pixel”), an analysis programme of the social network “Facebook.com” of the Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (hereafter referred to as: “Facebook”) in order to track users’ behaviour after they have clicked on a Facebook ad. The recorded data is collected anonymously and serves analysis for market research purposes. Facebook can connect this data to an existing Facebook account and use it for their own advertising purposes according to the Facebook data use policy.
The user can enable Facebook as well as their partners to place ads on and off Facebook. Furthermore, cookies may be saved to your computer for these purposes.
The legal basis for the processing is the legitimate interest in the analysis, optimisation and economic operation of the website for the purposes of art. 6 (1) point (f) GDPR.
The website uses Pixel for marketing and optimisation purposes, particularly to place relevant and interesting ads, to improve reports on campaign performance or to avoid that the same ads are viewed several times. This is also the legitimate interest in the processing of the above data.
The installation of cookies may be blocked by deleting existing cookies and deactivating the storage of cookies in the settings of the web browser. Please note that in this case you may not be able to make full use of all features of the website.
The website uses „Facebook Connect“ (hereafter referred to as „Connect“), an analysis programme of the social network „Facebook.com“ of Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (hereafter referred to as: „Facebook“) to enable a registration or login via Facebook rather than a direct registration on the website.
The website uses Connect to set up, provide and personalise the user account. Personal data on the utilisation of the website (user data) are only collected, processed and used insofar as this is necessary for the facilitation or billing of the user’s utilisation of the service.
The collected data will be deleted upon conclusion or termination of the contract. Legal retention periods shall remain unaffected.
The website uses Twitter Analytics in order to analyse the website use and to continually improve different functions and offers as well as the user experience. Using statistical analysis of the user behaviour, the offer can be improved and designed to be more interesting for the user. Herein also lies the legitimate interest in the processing of the above data by Twitter.
The storage of cookies generated by Twitter Analytics may be blocked by adjusting the corresponding settings of the web browser. Please note that in this case you may not be able to make full use of all features of the website.
In order to oblige Twitter to process the transmitted data only as instructed and to comply with the data protection regulations, the controller has concluded a processing contract with Twitter.
The website uses “Twitter Ads”, an advertising service of Twitter Inc., 795 Folsom St., Suite 600, San Francisco, CA 94107, USA (in the following short: “Twitter”) in order to track users’ behaviour after they have viewed or clicked on a Twitter ad. The recorded data is collected anonymously and serves analysis for market research purposes. Twitter can connect this data to an existing Twitter account and use it for their own advertising purposes according to the Twitter data use policy.
The user can enable Twitter as well as their partners to place ads on and off Twitter. Furthermore, cookies may be saved to your computer for these purposes.
The website uses Twitter Ads for marketing and optimisation purposes, particularly to place relevant and interesting ads, to improve reports on campaign performance or to avoid that the same ads are viewed several times. This is also the legitimate interest in the processing of the above data.
If users do not wish Twitter to allocate the data collected via the website directly to the Twitter account, users need to log out of Twitter before visiting our website. You can completely block loading the Twitter plugin using Add-ons, e.g. with the script blocker „NoScript“ (https://noscript.net/).
On our website, the “Reddit Conversion Pixel” is used, an analysis service of the Reddit Inc., 520 Third Street, Suite 305, San Francisco, CA 94107, United States. This tool files a cookie on your PC if you get to our website via a Reddit ad. This cookie does not serve any personal traceability. If you visit our website, it will be identifiable to us as well as to Reddit that you clicked on the corresponding ad and were redirected to our website.
If you visit our website containing such a plugin, your browser will establish a direct connection to the Instagram servers. The contents of the Instagram plugin will be transmitted directly to your browser and will be integrated into the website. Thereby, Instagram receives the information that your browser has accessed the corresponding page of our website, even if you do not have an Instagram profile or are currently not logged in to Instagram. This information (including your IP address) will be transmitted directly from your browser to an Instagram server in the USA and saved there.
If you are logged in to Instagram, Instagram can allocate your visit to our website directly to your Instagram account. If you interact with the plugins, e.g. by pushing the “Instagram” button, this information will also be transmitted directly to the Instagram server and saved there. This information will also be published to your Instagram account and shown to your contacts.
If you do not wish Instagram to allocate the data collected via our website directly to your Instagram account, you need to log out of Instagram before visiting our website. You can completely block loading the Instagram plugin using add-ons, e.g. with the script blocker „NoScript“ (https://noscript.net/).
The website uses “Google reCAPTCHA”, a Turing test by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereafter referred to as: “Google”). Google checks whether the data entries on the website are made by a person or an automated programme. For this, user behaviour is analysed using different attributes. The analysis starts automatically upon entering the website. For the analysis, reCAPTCHA analyses various information (e.g. IP address, time spent on the website or mouse movements by the user). The data collected in the analysis are transmitted to Google.
The reCAPTCHA analyses are running completely in the background. Website visitors are not notified that an analysis takes place.
The controller has the legitimate interest that the website be protected against improper automated spying and SPAM.
When logging in (“Login”) or establishing a contact all data is transmitted via an encrypted connection using SSL/TLS technology. The SSL certificate required for this, which has been installed on the server, has been issued by an independent organisation. An encrypted connection may be recognised by the change in the address bar of the browser from http:// to https://.
As soon as the encrypted SSL/TLS connection has been established, your entries transmitted to the shop can no longer be read by a third party.
As a rule, your data will be automatically deleted three months after the application procedure. In addition, you may request the deletion of your data at any time via e-mail to jobs@cardmarket.com. Please note, in this case, that you are withdrawing from all ongoing application procedures.
The data subject may demand a confirmation from the controller on whether personal data is processed.
the existence of automated decision-making, including profiling, referred to in art. 22 (1; 4) GDPR and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such data processing for the data subject.
The data subject shall have the right to information about whether personal data are transmitted to a third country or an international organisation. In this context, the data subject may request information on the appropriate safeguards pursuant to art. 46 GDPR relating to the transmission.
The data subject shall have the right to rectification and/or completion of data against the controller if the processed personal data are inaccurate or incomplete. The controller has to correct these data immediately.
the processing has been objected pursuant to art. 21 (1) GDPR pending the verification whether the legitimate grounds of the controller override those of the data subject.
Where the processing of personal data has been restricted, such data shall – with the exception of storage – only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Where the restriction of the processing has been restricted under the above conditions, the data subject shall be informed by the controller before restriction is lifted.
the consent is withdrawn on which the processing is based pursuant to point (a) art. 6 (1) or point (a) art. 9 (2) GDPR and where there is no other legal basis for the processing.
the processing is objected to pursuant to art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the processing is objected to pursuant to art. 21 (2) GDPR.
the personal data have to be deleted to comply with a legal obligation according to Union or Member State law to which the controller is subject.
the personal data have been collected in relation to the offer of information society services referred to in art. 8 (1) GDPR.
Where the controller has made the personal data public and is obliged pursuant to art. 17 (1) GDPR to delete these data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the deletion of any links to, or copies or replications of, those personal data.
for the establishment, the exercise or defence of legal claims.
Where a right to rectification, deletion or restriction of the processing is claimed against the controller, the controller shall be obliged to communicate this rectification or deletion of data or the restriction of the processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
The data subject shall have the right against the controller to be informed about those recipients.
In exercising this right, the data subject shall also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. Freedoms and rights of other persons shall remain unaffected by this.
The right to data portability shall not apply for a processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data based on point (e) or (f) art. 6 (1) GDPR; including profiling based on those provisions.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data for such marketing; this includes profiling to the extent that it is related to such direct marketing.
Where processing for direct marketing purposes was objected to, the personal data shall no longer be processed for such purposes.
The data subject shall have the possibility, in the context of the use of information society services – notwithstanding Directive 2002/58/EG – to exercise your right to object by automated means using technical specifications.
The data subject shall have the right to withdraw the declaration of consent to the data protection law at any time. The withdrawal of consent shall not affect the lawfulness of the processing which has taken place based on the consent before its withdrawal.
However, these decisions shall not be based on special categories of personal data referred to in art. 9 (1) GDPR, unless point (a) or (g) of art. 9 (2) apply and suitable measures to safeguard the rights and freedoms and legitimate interests are in place.
In the cases referred to in points (1) and (3) the controller shall implement suitable measures to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.
Without prejudice to any other administrative or judicial remedy all data subjects shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement if it is considered that the processing of data infringes the GDPR.
The supervisory authority to which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to art. 78 GDPR.
If you do not have a PDF reader installed to show or print the private policy, you can download the file for free e.g. under www. adobe.com.

References: Art. 6

Art. 6

Art. 6

Art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 6
 art. 22
 art. 46
 art. 21
 art. 6
 art. 9
 art. 21
 art. 21
 art. 8
 art. 17
 art. 6
 art. 9
 art. 9
 art. 78