Privacy policy

The controller responsible for data processing on this platform is Company name and legal form, Street and number, Postcode and city, Country, email: Support email.

For data protection questions, you can reach us at Data protection contact.

If the operator has no establishment in the EU: name the representative in the Union under Art. 27 GDPR.

We process personal data on the following legal bases of the General Data Protection Regulation (GDPR):

• Art. 6(1)(b) GDPR: to perform the user agreement and to process orders
• Art. 6(1)(c) GDPR: to comply with legal obligations, for example tax retention and reporting duties or duties under the Digital Services Act
• Art. 6(1)(f) GDPR: to pursue legitimate interests, for example platform security, fraud prevention and error analysis
• Art. 6(1)(a) GDPR: based on your consent, for example for optional product analytics with PostHog

No automated decision-making within the meaning of Art. 22 GDPR takes place.

The platform is hosted by Vercel Inc. (USA). When pages are accessed, Vercel processes technically necessary data such as IP address, date and time, page accessed, browser and operating system. We need this data to deliver the site and defend against attacks (Art. 6(1)(f) GDPR).

Our database runs on Neon (Neon Postgres) with servers in Frankfurt am Main (planned). We store images on Cloudflare R2 (Cloudflare Inc., USA) in a storage bucket in the EU (planned).

We conclude data processing agreements under Art. 28 GDPR with all service providers.

For your account, we process your email address, username, password (stored only in encrypted form), language setting and, once you buy or sell, your name and address.

For commercial sellers and verified stores, we also process trader information under Art. 30 DSA and documents for identity and business verification.

The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for trader information.

To process an order, we process the items ordered, prices, delivery address, tracking number and order status.

The seller receives the buyer's name and delivery address so that they can ship. The buyer sees the seller's name or store name and, for commercial sellers, their trader information.

Payments are processed by Payment service provider, planned: Stripe Payments Europe, Ltd., Dublin, Ireland. For this, we pass on the order amount, order number and the details needed for payment, such as name and email address; you enter payment data such as card numbers directly with the payment service provider, and we do not store it ourselves. For cancellations and refunds, we pass on the details needed for the refund.

Sellers sign up for payouts directly with the payment service provider. It carries out the legally required identity check (KYC) and processes, for example, name, address, date of birth, ID document data and bank details. The payment service provider is a separate controller for this check; its privacy policy applies. We only receive the verification status and the details needed for payouts.

The legal basis is Art. 6(1)(b) GDPR and, for the checks by the payment service provider, Art. 6(1)(c) GDPR.

Listings, photos and your public profile information (e.g. username, country, reviews) are visible to other users. Make sure your photos do not show any personal data, such as address labels.

For raw (ungraded) single cards worth €20 or more, you must upload your own photos. We store them on Cloudflare R2 in a storage bucket in the EU (planned) and show them publicly with your listing for as long as it is online (Art. 6(1)(b) GDPR).

For graded cards, you enter the certificate number. We automatically check it with the grading company concerned (e.g. via PSA's certificate lookup) to verify that the certificate is genuine and still valid. We only send the certificate number; no personal data is transmitted (Art. 6(1)(f) GDPR, fraud prevention).

If you import stock via CSV, we only process the item data from the file.

We store messages between buyer and seller for each order, as well as reviews and case information including uploaded photos.

Messages are automatically scanned for payment and contact details such as IBANs, PayPal addresses, phone numbers and email addresses so that we can warn against payments outside the platform. This check serves to protect against fraud (Art. 6(1)(f) GDPR) and only results in a warning, not an automatic block.

In a dispute, our support team may view the messages, photos and shipping data of the order concerned in order to decide (Art. 6(1)(b) and (f) GDPR).

If you report a problem (open a case), the case details, photos and messages are visible to the other party to the order and to Binder support. We keep them until 2 years after the case is closed, longer only if needed to establish, exercise or defend legal claims.

We notify you in the app and by email about events relating to your orders and your account, such as payment, shipping, delivery, payout, new messages, review requests and case updates (Art. 6(1)(b) GDPR).

We use Resend (Resend Inc., USA; planned) to send emails. We only send marketing newsletters with your consent.

As a platform operator, we are required under the EU Directive DAC7 (in Germany: Platform Tax Transparency Act) to collect and verify seller data, such as name, address, date of birth, tax identification number, VAT ID, bank details and the number and amount of sales.

If a seller reaches at least 30 sales or at least €2,000 in revenue in a calendar year, we report this data to the competent tax authority (in Germany the Federal Central Tax Office), which may exchange it with other EU member states. The legal basis is Art. 6(1)(c) GDPR.

If you report content to us or file a complaint against a measure, we process your information to handle the report and inform you of the outcome (Art. 6(1)(c) GDPR in conjunction with Art. 16, 17 and 20 DSA).

Our own cookieless measurement: to improve Binder, we record a few events on our own server, namely page views, searches, “add to cart”, checkout opened, payment made, order confirmed, listing created, loading times (Web Vitals) and browser errors. We do not set any cookies and store nothing on your device. We do not store your IP address or browser string; to count visitors, we derive a hash from them that changes every day, so you cannot be recognised across days. Bot traffic is filtered out. We delete the raw data after 13 months. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the service. The operator can switch this measurement off at any time. confirm: no consent required under § 25 TDDDG

Vercel Web Analytics and Vercel Speed Insights (Vercel Inc., USA; certified under the EU-US Data Privacy Framework): we use these to measure page views and loading times. Only anonymous data such as page path, loading time and device type is collected; no cookies are set and no user profiles are created (Art. 6(1)(f) GDPR).

Sentry (Functional Software Inc., USA; EU data region): if an error occurs in the browser or on the server, we receive an error report with technical details such as the error message, page path, browser and operating system. We do not use session replay, and IP addresses are not stored. Sentry is only active once the operator has configured it. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is stable, error-free operation.

PostHog (PostHog Inc., USA; EU cloud with servers in Frankfurt): for more detailed product analytics we use PostHog, but only if you agree in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). We only record specifically selected events, with no automatic capture of all clicks (no autocapture) and no session recordings. PostHog stores cookies or localStorage entries (starting with “ph_”) on your device for this. You can withdraw your consent at any time via “Cookie settings” in the footer. The banner only appears once PostHog is switched on.

We do not use advertising cookies or tracking across other websites.

We store some technically necessary information in your browser, such as your language setting, your cart, the read status of notifications and your choice in the cookie banner. No consent is required for this because this storage is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG).

PostHog entries are only stored if you have given your consent (§ 25(1) TDDDG).

You can find the exact entries in our cookie policy.

Some of our service providers are based in the USA (e.g. Vercel, Cloudflare, Resend, Sentry and PostHog) or may access data from there. For Sentry and PostHog we use the EU data region; Stripe processes payments through its Irish company. Data is only transferred if the recipient is certified under the EU-US Data Privacy Framework or we have agreed EU Standard Contractual Clauses with them (Art. 46(2)(c) GDPR).

Where possible, we choose server locations in the EU.

We only store data for as long as necessary for the respective purpose or required by law:

• Account data: until your account is deleted
• Order and billing data: 6 or 10 years under commercial and tax retention obligations (§ 257 HGB, § 147 AO)
• DAC7 records: 10 years
• Messages: until 2 years after the respective order, longer only if a dispute requires it
• Problem reports (case details, photos, messages): until 2 years after the case is closed, longer only if needed for legal claims
• Listing photos: as long as the listing is online, then until the order data retention periods expire if the photo belongs to a sale
• Raw data of our own audience measurement: 13 months
• Server logs: Server log retention period

After these periods expire, we delete or anonymise the data.

You have the right to:

• access your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

Please contact Data protection contact. You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live.

We update this privacy policy when our platform or the legal situation changes. You can always find the current version on this page.