Language Notice: This content is legally binding exclusively in the German language. Translations into other languages are provided for informational purposes only and are non-binding.
Last updated: October 2026
In this Privacy Policy we inform you about the processing of personal data when you use our website, our platform functions and the related communication.
This Privacy Policy is addressed to visitors of our website, to private users and to commercial users, in particular dealers, brands, service partners and their contact persons.
The platform is intended exclusively for persons who have reached the age of 18. You confirm that you are of age when you register. We do not knowingly collect data from minors. Should we become aware of such a case, the data concerned will be deleted without undue delay.
| Company | apollum highend GmbH Robert-Bosch-Str. 19c 48153 Münster Germany |
| legal@apollum.com | |
| Managing Director | Sebastian Strube |
| Commercial register | HRB 23212 |
| Register court | Local Court Münster |
A data protection officer has not been appointed, as the statutory requirements for this are not currently met. You can reach us for all data protection matters at legal@apollum.com.
We process personal data only to the extent necessary to provide our website, to provide and operate the platform, to communicate with you, to secure our services, to improve them or to comply with legal obligations.
Personal data means any information relating to an identified or identifiable natural person. This includes in particular name, e-mail address, contact details, usage data, technical access data, communication content and information you provide to us when registering for or using the platform.
Processing is carried out in particular on the following legal bases:
Where we process personal data on the basis of legitimate interests, we have carried out a balancing test between our interests and your interests, rights and freedoms in each individual case. We will inform you of the outcome of that assessment on request.
When you visit our website, the browser you use automatically transmits information to the server hosting our website. This information is stored temporarily in what are known as server log files.
The following data may be processed in particular:
This data is processed in order to provide the website technically, to ensure the stability and security of our systems, to detect and prevent misuse and to administer the website.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, stably and reliably.
Server log files are stored for a maximum of 30 days and are then deleted or anonymised. Longer storage takes place only by way of exception, where necessary to investigate a specific security incident or to pursue legal claims.
Our website and platform are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Processing takes place on servers in Germany.
The following data may be processed in the context of hosting:
The platform also includes an AI infrastructure operated by ourselves for the translation of private messages. These systems likewise run on servers in Germany and are under our sole control. Details can be found in Section 20.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable provision of our online services. Where hosting is necessary to provide contractual platform functions, Art. 6(1)(b) GDPR is an additional legal basis.
A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
To protect against data loss we create encrypted backups of our databases and files at regular intervals. Backups are stored exclusively within Germany and are automatically overwritten or deleted after no more than 30 days.
Where data is deleted from our active systems, it remains in the backups for technical reasons until that period expires. Restoration takes place only in the event of data loss; deleted data is then deleted again.
The legal basis is Art. 6(1)(f) GDPR and, in so far as statutory retention and documentation obligations are concerned, Art. 6(1)(c) GDPR.
We use strictly necessary cookies only. Cookies are small text files stored on your device.
We use the following cookies:
| Name | Purpose | Storage period |
|---|---|---|
| Session cookie | Assignment of your session, login status, language setting, intermediate state of two-factor authentication | up to 120 minutes after your last activity |
| XSRF-TOKEN | Protection against cross-site request forgery in forms | duration of the session |
| Remember me | Only if you select the stay signed in option when logging in: renewed login without entering your password | 30 days |
The content of your session is stored on the server side and contains in particular your login identifier, the CSRF token, the language selected and status information relating to the login process. Session data is deleted once the session period has expired.
Beyond this we do not set any cookies for analytics, marketing or profiling purposes. Consent under Section 25(1) of the German Digital Services Data Protection Act (TDDDG) is therefore not required; we rely on Section 25(2) no. 2 TDDDG.
The legal basis for the associated processing of personal data is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website and platform securely and functionally. Where cookies are necessary for the performance of a contract or of pre-contractual measures, Art. 6(1)(b) GDPR is the legal basis.
We do not use any Google services, in particular no Google Analytics, no Google Tag Manager, no Google Ads and no Google Fonts served from Google servers. The fonts we use are delivered from our own servers.
We use Plausible Analytics, a privacy-friendly web analytics service provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. A data processing agreement pursuant to Art. 28 GDPR is in place with Plausible. According to the provider, the analytics data is processed on servers within the European Union.
Plausible is used on the public areas of our website. No audience measurement takes place within the signed-in account area.
The following information may be processed in particular:
According to the provider, Plausible uses no cookies, no persistent identifiers, no cross-site tracking and no cross-device tracking. No individual user profiles are created. The IP address is not stored but used only temporarily to generate a daily identifier that cannot be reversed.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the privacy-friendly analysis and improvement of our website. As Plausible operates without cookies and without persistent tracking of individual users, the impact on your rights and freedoms is low.
To protect our forms against automated misuse we use Friendly Captcha, a service provided by Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany.
Friendly Captcha is used in particular during registration and when requesting a password reset link. Your browser solves a computational task in the background; no input or interaction on your part is required.
The following data is processed:
The solution is transmitted by our server to Friendly Captcha for verification. According to the provider, Friendly Captcha does not create user profiles, does not set cookies and processes the data on servers within the European Union.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our systems against automated attacks, spam and fraudulent registrations. A data processing agreement pursuant to Art. 28 GDPR is in place with Friendly Captcha.
A user account is required in order to use the platform. When you register we collect:
The password is stored exclusively as a cryptographic hash; we are unable to recover the plain text.
After registration you are automatically assigned a username and a display name, which you can subsequently change (see Section 12).
Depending on the account type chosen, we additionally collect during the setup process:
We also process technical and organisational information relating to your account, in particular the account status, the progress of account setup, the time of registration, the time of e-mail confirmation, the time of the last password change and your account settings.
This data is processed in order to provide you with a user account, to enable the platform functions, to administer your identity within the user account, to ensure security and protection against misuse and to operate the platform properly.
The legal basis is Art. 6(1)(b) GDPR in so far as processing is necessary to provide the user account and the platform functions. In so far as data is processed for security, stability, detection of misuse or fraud prevention, Art. 6(1)(f) GDPR is the legal basis.
After registration we send you an e-mail containing a time-limited, signed confirmation link. The confirmation serves as evidence that the address provided belongs to you and protects against fraudulent registrations using third-party addresses. The link is valid for 60 minutes. A new link can be requested no earlier than one minute after the previous one.
The legal basis is Art. 6(1)(b) GDPR in conjunction with Art. 6(1)(f) GDPR.
When registering you confirm the Terms of Service and your acknowledgement of this Privacy Policy, as well as that you are of age. For this purpose we store the time of your confirmation and the version of the respective document displayed to you at that time.
This storage serves to comply with our accountability obligation under Art. 5(2) GDPR and to document the conclusion of the contract.
The legal basis is Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. The records are retained for the duration of the user relationship and thereafter until the expiry of the statutory limitation periods.
When you log in we process your e-mail address and your password in order to verify your access rights.
In order to make attacks by automated credential guessing more difficult, we limit the number of failed login attempts. For this purpose we temporarily process a counter value formed from your e-mail address and your IP address. This value is automatically deleted after 60 minutes at the latest and serves exclusively to prevent misuse.
Two-factor authentication is mandatory for commercial accounts; private users may activate it voluntarily. In this context we process:
The one-time code is sent to the e-mail address stored for your account and is valid for five minutes. After five failed attempts, entry is temporarily blocked.
Where you change your password, we store the time of the change. If you reset your password using the forgotten password process, we process a time-limited token that is valid for 60 minutes and is invalidated after use.
The legal basis is Art. 6(1)(b) GDPR in so far as processing is necessary to provide the account, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting your account and our systems.
Commercial accounts are verified by us before certain functions are enabled. Where an account claims a brand, we verify the entitlement on the basis of suitable evidence, such as an extract from the commercial register, a trade mark certificate, confirmation via a company e-mail domain or a telephone enquiry.
In this context we process the evidence you submit, the name and contact details of the person acting, and our verification result together with the time of verification.
This processing is carried out in order to perform the contract and to safeguard the integrity of the platform. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting brand and dealer profiles against unauthorised takeover.
We delete evidence submitted for entitlement checks as soon as the verification has been completed and retention is no longer required for the defence of legal claims, and after three years at the latest.
Your public identity on the platform consists of a username and a display name. You can change both; after a change, the next change is possible only after 30 days. This waiting period serves traceability and protects other users against concealment of identity.
Username and display name are shown to other users: for commercial users on their listings and profiles in addition to their company information, and for private users in communication with providers. Do not choose information here that you do not wish to disclose; in particular, you do not have to use your legal name.
Before being stored, username and display name are checked automatically for inadmissible content. Details can be found in Section 22.
We do not collect a personal profile picture. A neutral placeholder symbol is displayed. We do not use any external services to determine or embed profile pictures; in particular, we do not transmit your e-mail address or check values derived from it to third parties for this purpose.
Apollum is addressed among others to brands, dealers, service partners and other commercial users in the high-end audio sector.
If you operate a commercial account, we process in particular:
Where legally required or necessary for the functioning of the platform, this information is displayed publicly on your company profile and with your listings. This applies in particular to the provider identification and the legal notices.
As the provider of an online marketplace within the meaning of Regulation (EU) 2022/2065 (Digital Services Act) we are obliged under Art. 30 DSA to obtain certain information before admitting commercial users, to check its reliability and in part to make it publicly available.
The legal basis is Art. 6(1)(c) GDPR in so far as we are legally obliged to collect and publish the information, and otherwise Art. 6(1)(b) GDPR. In so far as personal data of contact persons who are not themselves party to the contract is processed, this is done on the basis of Art. 6(1)(f) GDPR. Our legitimate interest lies in providing complete and up-to-date company profiles. It is the responsibility of the respective company as account holder to inform those contact persons.
Where you publish listings, product information, images, descriptions or other content on the platform, we process the associated data.
This includes in particular:
Listings can be published by commercial users only. Private users can view listings, add them to a watchlist and contact providers, but cannot themselves publish offers.
Publicly visible in a published listing are in particular the title, description, images, price, condition, manufacturer, the date of purchase and the country and postcode of the location. The provider is also visible with their display name, their company name and their provider identification.
The date of purchase is displayed because it makes the age of the device and the remaining manufacturer warranty transparent. Providing it is optional.
The postcode denotes the location of the device at the commercial provider. It enables interested parties to assess distance, shipping route and collection options. As listings are published by companies only, this is a business address which regularly already appears in the provider identification.
Serial numbers are not displayed publicly. They serve internal assignment, verification of authenticity and condition, and the investigation of cases of misuse.
Please do not publish personal data of third parties in listings, images or descriptions unless there is a legal basis for doing so.
The legal basis is Art. 6(1)(b) GDPR. In so far as processing serves quality assurance, prevention of misuse, fraud prevention or the enforcement of legal claims, Art. 6(1)(f) GDPR is the legal basis.
Every change to a listing is logged by us. We store the full content of the listing at the time of the change, the time of the change and the user account acting.
The history serves the traceability of price and condition information, the investigation of disputes between users, the prevention of misuse and fraud, and compliance with our obligations as a marketplace operator. It cannot be viewed by other users.
The legal basis is Art. 6(1)(f) GDPR. The history is deleted together with the associated listing (see Section 33).
Uploaded images are stored on our servers in Germany. During processing the images are recalculated and brought to a uniform size. In doing so we remove embedded metadata, in particular camera and location information (EXIF data). The image versions delivered contain no such metadata.
Images belonging to a published listing are publicly accessible. Images belonging to drafts and unpublished listings can be accessed only by the respective account.
Commercial users can import their listings automatically from their own product data source. For this purpose you store the address of a file you provide in your account.
We store this address in your account settings and retrieve it from our servers for the purpose of the import. In doing so, the server you designate becomes aware of the IP address of our system. If the address contains access credentials, such as a token, these are stored with it; where possible, therefore, use an address without such credentials.
As part of the import we also download the product images specified in that file from the servers designated there.
We keep a log of every import run. It contains the address used, the time, the number of records created, changed, unchanged and skipped, and, for skipped records, the line number, the article identifier and the reason. The log can be viewed only by your account and by us.
Please ensure that your product data does not contain personal data of third parties, for instance names of previous owners in description texts.
The legal basis is Art. 6(1)(b) GDPR. Import logs are deleted after 90 days.
Commercial users can generate printable sale signs with a QR code for their listings. The QR code refers to a short link containing only the public identifier of the listing.
When a short link is accessed, no data is collected beyond the general server log files. Individual accesses are neither counted nor evaluated.
Signed-in users can save listings to a watchlist. For this purpose we process the assignment between your account and the listing, together with the time.
Your watchlist can be viewed by you only. Providers are shown merely the total number of times their listing has been saved, without any conclusions being drawn about individual persons.
The legal basis is Art. 6(1)(b) GDPR.
We make available to commercial users an evaluation of the visibility of their listings, in particular the number of views, watchlist entries and contact enquiries, as well as the composition and age of their inventory.
These evaluations are presented exclusively in aggregated form. Conclusions about individual visitors are neither intended nor possible. We do not create visitor-related behavioural profiles and do not store IP addresses in relation to page views.
The legal basis is Art. 6(1)(b) GDPR in so far as the evaluation forms part of the contractually agreed service, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in providing meaningful information to providers.
Apollum provides a messaging function allowing interested parties and providers to communicate with one another about a listing.
In this context we process in particular:
Message content and its translations are stored in encrypted form in our database. This is not end-to-end encryption: decryption takes place on the server side, so that access by us is technically possible.
Within a conversation your display name is shown to the other party. Your legal name is not displayed unless you disclose it yourself or it forms part of your provider identification.
To protect against spam we limit the number of messages per conversation and per account and detect repeatedly identical messages. For this purpose we temporarily process counter values which are deleted after one hour at the latest.
The legal basis is Art. 6(1)(b) GDPR. In so far as we process communication data for security, detection of misuse, fraud prevention or the enforcement of legal claims, this is done on the basis of Art. 6(1)(f) GDPR.
Private messages are not reviewed by staff without cause and are not analysed automatically as to their content. We may, however, take note of their content where this is necessary in order to handle a complaint, to combat misuse or fraud, to enforce our Terms of Service or to comply with legal obligations. Access is restricted to a narrowly defined group of persons and is documented.
If a message addressed to you remains unread, we notify you by e-mail. The notification contains the sender and the listing concerned together with a link to the conversation, but not the text of the message.
You can deactivate these notifications in your account settings.
The legal basis is Art. 6(1)(b) GDPR.
At your request we translate messages from the other party into your language. The function is deactivated by default and becomes active only once you enable it for a conversation.
Translation is carried out exclusively by a language model operated by ourselves on our own infrastructure in Germany. Message content is not transmitted to third parties for this purpose, and in particular not to providers outside the European Union. The content is not used to train models.
We process the message text and the source and target languages. The translation produced is stored in encrypted form so that it does not have to be generated anew each time the conversation is opened.
Where you use the translation function, the text written by the other party is also processed. We indicate within the conversation that messages may be translated.
The legal basis is Art. 6(1)(b) GDPR, as communication across languages forms part of the platform service.
For public content or content intended for publication we use services provided by OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland.
This concerns in particular:
Only the content concerned and the target language are transmitted. No identifier of your account, your name or your e-mail address is transmitted. Depending on the content, the texts transmitted may contain personal data, for instance where you publish personal information in a public profile or listing.
Private messages and other non-public communication content are not transmitted to OpenAI.
A data processing agreement pursuant to Art. 28 GDPR is in place with OpenAI. According to OpenAI, data processed via the programming interface is not used to train the models.
Processing in the USA by OpenAI OpCo, LLC as a sub-processor cannot be excluded. The transfer is based on the adequacy decision of the European Commission of 10 July 2023 on the EU-U.S. Data Privacy Framework, under which OpenAI is certified. In addition we base the transfer on standard contractual clauses pursuant to Art. 46(2)(c) GDPR, which are available on request.
The legal basis is Art. 6(1)(b) GDPR in so far as processing is necessary to provide the multilingual platform functions, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a multilingual, secure and high-quality platform.
Please do not enter any confidential information or personal data of third parties in public content or content intended for publication unless there is a legal basis for doing so.
In order to safeguard the quality and integrity of the platform we check public content partly by automated means. Usernames, display names, listing titles and listing descriptions are checked in particular.
The check is carried out in two stages:
If content is objected to, the entry is rejected and you can amend it. No further measures are taken automatically; in particular, your account is not blocked automatically.
For every objection we store your user account, the check mode, the categories triggered and the time. The objected text itself is not stored. These records serve exclusively to detect repeated infringements and to prevent misuse and are deleted after twelve months.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure, trustworthy and high-quality platform environment. In so far as moderation serves to comply with our obligations under Regulation (EU) 2022/2065, Art. 6(1)(c) GDPR is the legal basis.
This does not involve any decision based solely on automated processing which produces legal effects or similarly significantly affects you within the meaning of Art. 22 GDPR. You can correct a rejected entry immediately; on request we will have the decision reviewed by a natural person. Please contact legal@apollum.com for this purpose.
You can report content to us that is unlawful or infringes our Terms of Service. A reporting function is available on every listing, as is the address legal@apollum.com.
Where a notice is submitted, we process:
Contact details are not required for notices concerning certain criminal offences. We forward your notice, including your contact details, to the user concerned in so far as this is necessary in order to handle it and you have not objected.
Where we remove content, restrict its visibility or block an account, we inform the person concerned, stating the reasons, and refer them to the possibility of lodging a complaint. Complaints are reviewed by a natural person.
The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 16, 17 and 20 of Regulation (EU) 2022/2065, and Art. 6(1)(f) GDPR.
We retain notices and complaints and the associated decisions for a period of three years in order to detect repeated infringements, to comply with our transparency obligations and to be able to defend legal claims.
Brands can invite dealers to participate in the platform by means of voucher codes. Where a dealer redeems such a code, a documented relationship arises between the two accounts.
The following information about the redeeming dealer is shown to the inviting brand and is also available there as an export file:
The brand can store an internal note for each voucher. This note cannot be viewed by the dealer. It may relate exclusively to the invitation and the business relationship; storing assessments of individual persons is not permitted under our Terms of Service.
Before a code is redeemed we inform you which information will thereby be disclosed to the inviting brand.
Where a brand designates a dealer as an authorised dealer, this relationship is displayed publicly on the brand and dealer presentation.
The legal basis is Art. 6(1)(b) GDPR. For billing between us and the inviting brand, Art. 6(1)(b) GDPR is an additional legal basis; the number of vouchers redeemed forms part of the remuneration.
Disclosure to the brand constitutes a transfer to a separate controller. The brand is itself responsible for any further processing.
We offer paid plans for commercial use of the platform. For this purpose we process:
This data is processed in order to perform the contract, to issue invoices and to comply with tax and commercial law obligations.
The legal basis is Art. 6(1)(b) GDPR. For statutory retention and documentation obligations, Art. 6(1)(c) GDPR is the legal basis.
Invoices are issued by us; payment is made by bank transfer. No external payment service provider is involved; we do not collect payment data such as card numbers or bank details.
In order to comply with our tax and commercial law obligations we transmit invoice and contract data to our tax adviser.
Documents relevant for tax purposes are subject to a retention obligation of ten years (Section 147 of the German Fiscal Code, AO); documents relevant under commercial law are subject to a retention obligation of six years (Section 257 of the German Commercial Code, HGB).
If you contact us, for example via the support form, by e-mail or by telephone, we process the data you transmit in order to handle your enquiry.
To handle support enquiries we use the Chatwoot software, which we operate on our own servers in Germany. No transmission to the manufacturer of the software takes place.
Where you use the support form as a signed-in user, the following information is passed to our support system:
This information enables us to classify your request without having to ask further questions. Your enquiry is assigned in our support system to a contact under your e-mail address, so that earlier enquiries can be associated with it.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to an existing or prospective contractual relationship. In all other cases Art. 6(1)(f) GDPR is the legal basis. Our legitimate interest lies in handling enquiries appropriately. In so far as statutory retention obligations exist, Art. 6(1)(c) GDPR is the legal basis.
Enquiry data without a contractual connection is deleted once the matter has been concluded and the regular limitation period of three years has expired, unless statutory retention obligations preclude deletion.
As part of the user relationship we send you the e-mails necessary to perform it, in particular:
The legal basis is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. Our legitimate interest lies in reliably informing our users about security-relevant and contractual matters.
For dispatch we use the service Mailgun. The provider is Mailgun Technologies, Inc., 112 E. Pecan Street #1135, San Antonio, Texas 78205, USA, a company of the Sinch group. For this purpose the provider receives your e-mail address, the content of the respective message and technical dispatch metadata. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. We use the EU region of the service: according to the provider, the e-mails and the associated dispatch logs are processed and stored on servers within the European Union. As the provider is established in the USA, access from the USA cannot be excluded (see Section 32).
Our e-mails contain no tracking pixels and no tracking of opening or click events. Images included are loaded from our own servers; in doing so our server becomes aware of the IP address of your e-mail program. Such accesses are treated like any other server access (see Section 3) and are not evaluated on a personal basis.
We send promotional e-mails only where you have expressly consented to this or where there is a statutory permission. You can withdraw your consent at any time with effect for the future.
We process personal data in so far as this is necessary to protect our website, platform, user accounts, communication and content against misuse, unauthorised access, fraud, spam, technical attacks or other unlawful acts.
In this context we may process technical data, login data, IP addresses, times, account activities, communication metadata, notices from other users and security-relevant events. The measures used include in particular limiting login, message and enquiry attempts and protecting forms against automated access.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the security and integrity of our platform, the protection of our users and the enforcement of our rights.
To ensure proper operation, our systems log technical events and errors. These logs may contain personal data to a limited extent, in particular account identifiers and technical information about failed operations.
The logs serve exclusively for troubleshooting, restoration of operation and security analysis. They are not evaluated for any other purpose. Access is restricted to a narrowly defined group of persons.
Application logs are deleted automatically after 14 days at the latest.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and error-free operation of our systems.
We do not use any external service for error or performance monitoring.
We process personal data in so far as this is necessary to comply with legal obligations. These include in particular retention, information and cooperation obligations under commercial law, tax law and platform regulation, namely under Regulation (EU) 2022/2065.
The legal basis is Art. 6(1)(c) GDPR.
We also process personal data in so far as this is necessary for the establishment, exercise or defence of legal claims. The legal basis is Art. 6(1)(f) GDPR.
Personal data is disclosed only in so far as this is necessary to fulfil the purposes stated, where a legal obligation exists, where you have consented or where another legal basis applies.
Recipients are in particular:
| Recipient | Purpose | Place of processing |
|---|---|---|
| Hetzner Online GmbH | hosting and infrastructure | Germany |
| Plausible Insights OÜ | audience measurement | European Union |
| Friendly Captcha GmbH | protection against automated access | European Union |
| Mailgun Technologies, Inc. | e-mail dispatch | European Union, access from the USA cannot be excluded |
| OpenAI Ireland Ltd. | translation and moderation of public content | Ireland, sub-processing in the USA |
| Tax advisers and auditors | accounting and tax obligations | Germany |
| Legal advisers | enforcement and defence of legal claims | Germany |
| Authorities and courts | legal obligations | Germany |
| Other users | platform functions, in particular profiles, listings, communication, dealer network | – |
We operate our support system and our AI infrastructure for private translations on our own servers; no transmission to the manufacturers of the software used takes place.
Where service providers act as processors, processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.
We process personal data primarily within the European Union or the European Economic Area. Hosting, backups, the support system and the AI infrastructure for private translations are located in Germany.
A transfer to a third country takes place exclusively in the following cases:
OpenAI: Our contractual partner is OpenAI Ireland Ltd., established in Ireland. Processing by sub-processors in the USA cannot be excluded. We base the transfer on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which OpenAI is certified, and in addition on standard contractual clauses pursuant to Art. 46(2)(c) GDPR. Only public content or content intended for publication is transmitted; account identifiers, names or e-mail addresses are not transmitted.
Mailgun: Our contractual partner is Mailgun Technologies, Inc., established in the USA. E-mails and dispatch logs are processed in the EU region of the service. Access from the USA, for instance for maintenance and support purposes, cannot be excluded. We base the transfer on the adequacy decision of the European Commission on the EU-U.S. Data Privacy Framework, under which Mailgun Technologies, Inc. is certified, and in addition on standard contractual clauses pursuant to Art. 46(2)(c) GDPR. This concerns your e-mail address, the content of the e-mails addressed to you and technical dispatch metadata.
Private messages and private communication content are not transferred to third countries.
We point out that the USA does not have a level of data protection equivalent to European law. In particular, public authorities may access data under certain conditions without your having effective legal remedies against this.
We store personal data only for as long as this is necessary for the respective purposes or as statutory retention obligations exist.
| Data | Retention period |
|---|---|
| Server log files | maximum 30 days |
| Application logs | maximum 14 days |
| Dispatch logs at the e-mail service (Mailgun) | 1 day |
| Backups | maximum 30 days |
| Session data | up to 120 minutes after the last activity |
| Counter values for misuse prevention | maximum 60 minutes |
| Account data | for the duration of the user account, thereafter 30 days at the latest |
| Evidence of declarations of consent | duration of the user relationship plus three years |
| Public content (listings, descriptions, images) | until removal, thereafter 30 days at the latest |
| Change history of listings | as for the associated listing |
| Import logs | 90 days |
| Private communication data | 24 months after the last message in a conversation, at the latest until 30 days after account closure |
| Records of moderation objections | 12 months |
| Notices, complaints and associated decisions | 3 years |
| Evidence for the verification of commercial accounts | until completion of the check, 3 years at the latest |
| Contact enquiries without contractual connection | 3 years from the end of the year of the enquiry |
| Contract and billing data | 6 years (Section 257 HGB), documents relevant for tax purposes 10 years (Section 147 AO) |
| Audience measurement data (Plausible) | aggregated and not personally identifiable |
Where data is no longer required, it is deleted or anonymised.
Where a user account is deleted while conversations are still ongoing, your messages are anonymised vis-à-vis the other party in so far as that party has a legitimate interest in the traceability of the communication.
Decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR do not take place.
The automated content check described in Section 22 leads merely to the rejection of an entry which you can correct immediately; on request a natural person will review it. We do not take decisions on the removal of content or the blocking of accounts solely by automated means.
We sort search results and lists according to objective criteria such as relevance to the search query, recency and completeness of the information provided. Sorting based on the individual usage behaviour of specific persons and personalised advertising do not take place.
Subject to the statutory requirements, you have the following rights:
You can delete your user account yourself at any time in your account settings. You can also request a copy of your data there.
Otherwise, a message to legal@apollum.com is sufficient to exercise your rights. We answer enquiries without undue delay and within one month at the latest.
Where you have given us consent, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal remains unaffected.
You can declare your withdrawal in your account settings, by e-mail to legal@apollum.com or, where available, via an unsubscribe link in the respective communication.
Notice pursuant to Art. 21 GDPR:
Where we process personal data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time, on grounds relating to your particular situation, to that processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where personal data is processed for direct marketing purposes, you have the right to object at any time to processing for the purposes of such marketing; this also applies to profiling in so far as it is related to such direct marketing.
You can declare your objection without any particular form, by e-mail to legal@apollum.com.
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection law.
The authority competent for us is in particular:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2-4 40213 Düsseldorf Germany
Telephone: +49 (0)211 / 38424 - 0 E-mail: poststelle@ldi.nrw.de Website: https://www.ldi.nrw.de
You may also contact any other competent data protection supervisory authority, in particular the authority in the EU Member State of your habitual residence, your place of work or the place of the alleged infringement.
We take appropriate technical and organisational measures pursuant to Art. 32 GDPR in order to protect personal data against loss, misuse, unauthorised access, alteration or destruction.
These include in particular:
Our security measures are continuously reviewed and adapted in line with technical developments.
We may amend this Privacy Policy where this becomes necessary due to technical, legal or organisational changes. The current version is available on our website at all times.
In the event of material changes we will inform registered users separately by e-mail and, where necessary, obtain renewed confirmation.
