Privacy notice

1. Controller

ZieTec UG (haftungsbeschränkt)
Münchehagenstraße 65
13125 Berlin
Managing director: Carlos Ricardo De Oliveira Ziegler
Email: info@zietec.io
Register court: Amtsgericht Charlottenburg (Berlin), HRB 260919 B
VAT ID: DE366513418

A telephone number is not kept.

2. Data protection officer

No data protection officer is appointed. Requests under Art. 15 to 21 GDPR go to info@zietec.io.

3. Purposes and legal bases

Public board. Display of the paid ranking, bid preview, and public listing data. Legal basis Art. 6(1)(b) GDPR if you buy a place, otherwise Art. 6(1)(f) GDPR (operating a public advertising board).

Bid and payment. Stripe runs checkout for ZieTec UG. Rank changes only after confirmed payment via the Stripe webhook. Stripe collects the data needed for payment, including email, billing address, and an optional VAT ID. Legal basis Art. 6(1)(b) GDPR; tax retention Art. 6(1)(c) GDPR.

Listing clicks. Clicking a row opens the destination directly (`utm_source=ganzoben`). The page also sends a first-party beacon so the Klicks column can rise. That count stays on the board row. It is not sent to DataFast. Legal basis Art. 6(1)(f) GDPR (traceability of the paid placement).

Reach. DataFast cookieless (first-party `/js/script.cookieless.js`, events `/df/events`, website-id dfid_XUkoVkq1UE1GlSTGK90Ji) measures page views without ad targeting. The browser does not talk to datafa.st; the Worker forwards the script and events. The Worker then reads the “online” and “visitors since launch” display from the DataFast Website API. Zero is a real zero only when DataFast returns zero. Legal basis Art. 6(1)(f) GDPR (reach of the public board).

Google Analytics 4. We load a GA4 script (Google LLC, USA) for page views. Google sets cookies. We invent no AVV title and no visitor counts. Legal basis Art. 6(1)(f) GDPR (reach measurement). DataFast stays cookieless beside it.

Email after payment. After a credited bid a transactional message may be sent from hello@ganzoben.lol. Legal basis Art. 6(1)(b) GDPR.

4. Recipients

Recipients of personal data are only the following actually used parties:

• Stripe — payment of the bid for ZieTec UG.
• DataFast — cookieless reach measurement and the overview values the Worker fetches. Listing clicks are not included.
• Google LLC (USA) — Google Analytics 4. No invented AVV name.

Further processors, AVV titles, or advertising networks are not named here because they are not used for this offer.

5. Third country

Where Stripe, DataFast, or Google process data outside the EEA — Google Analytics 4 especially in the USA — the statements of the respective provider apply. We invent no adequacy decision, no SCC numbers, and no AVV titles.

6. Retention

• Public listing and confirmed bid: as long as the place stays on the board.
• Payment and invoice data: statutory retention, in particular § 147 AO.
• First-party click counts: as a running total on the listing.
• DataFast measurements: according to DataFast’s periods.
• Google Analytics 4: according to Google’s periods.

7. Required data for a bid

For a paid-placement contract we need a destination URL or handle and the payment data Stripe collects. Without those data no confirmed rank is created.

8. Cookies and TDDDG

The live script is first-party /js/script.cookieless.js (cookieless). Events go to /df/events on the same origin. We checked the cookieless script: it writes sessionStorage, not a cookie. Google Analytics 4 (Google LLC, USA) is loaded and sets cookies. There is no ad targeting and no invented cookie banner. DataFast stays cookieless. Terminal-device access that sets no cookies does not replace consent under § 25 TDDDG where the law requires it.

9. Your rights

You have the rights of access, rectification, erasure, restriction, data portability, and objection to processing based on Art. 6(1)(f) GDPR, and the right to withdraw a given consent. You may also lodge a complaint with a supervisory authority, for us in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

No automated decision-making within the meaning of Art. 22 GDPR takes place.