Privacy Policy

1.

Controller and contact

Represented 
by the Managing Directors Felix Heberle & Tano Sebastian Khan

(hereinafter referred to as “Timber Base” or “we“)

If you have any questions or suggestions about data protection, please do not hesitate to contact us by email at the following address: privacy@timberbase.com.

2.

Subject of data protection

3.

Automated data transmissions

When you access our website, your end device automatically transmits data for technical reasons. The following data is stored separately from other data that you may transmit to us:

• IP address (shortened by one octet)
• URL of the page accessed
• Date and time
• Browser type, browser language and browser version
• Operating system used
• Referrer

We store this data for the following purposes:

• Load balancing, i.e. to distribute access to our websites across several devices and to be able to offer you the fastest possible loading times;
• Ensuring the security of our IT systems, e.g. to defend against specific attacks on our systems and recognise attack patterns;
• Ensuring the proper operation of our IT systems, e.g. if errors occur that we can only rectify by storing the IP address.
• to enable criminal prosecution, averting of danger or legal prosecution in the case of concrete indications of criminal offences.

Your IP address is only stored for a period of 14 days.

In this case, the processing is carried out based on our overriding legitimate interests mentioned above (Art. 6 para. 1 lit. f DSGVO (GDPR)).

4.

Registration

You have the option to register for a user account on the website. A user account is necessary for you to be able to purchase or offer products on our website or use our software. To do this, you must provide the following mandatory information:

• Salutation
• First and last name
• Country
• Telephone number
• Email address
• Username
• Password
• Company name
• Purpose of the company

Your registration data is required to set up and manage an account for you and to enable you to use our participant area, Art. 6 para. 1 sentence 1 lit. b DSGVO (GDPR). In order to set up this account, you must provide us with this data. However, you are neither contractually nor legally obliged to provide the data. In order to use the marketplace or our software, however, you must set up an account, in which context the provision of the registration data marked as mandatory fields is obligatory; without an account, you will in any case not be able to buy and sell products on our marketplace or use our software.

5.

Administration and contract processing

5.1.

Contract initiation and conclusion

5.1.1.

Marketplace “Direct” model

If you create offers for other participants using the “Direct” model, these offers will initially appear for the other participants on the marketplace without providing any personal data. When the potential buyer makes a request for a purchase, we transmit this request to the seller. In the process, the following data of the buyer is collected and transmitted to the seller:

• Company name
• Company address, delivery address (if different)
• Requested products with quantities, prices and product details

When the seller confirms the request, he makes a binding offer to the buyer. In doing so, the following data of the seller is collected and transmitted to the buyer:

• Company name
• Company address, delivery address (if different)
• Products offered with quantities, prices and product details

If the buyer accepts the offer and a contract of sale is concluded between the seller and buyer, we collect the following data for the purpose of processing the contract and transmit it to the seller or buyer:

• First and last name
• Company name
• Telephone number
• Email address
• Company address
• Invoice address, if different
• Delivery address, if different
• VAT ID No.
• Commercial register number, for export orders the customs number
• Order number
• Products with quantities, prices and product details
• Planned delivery times
• Seller’s bank details for incoming payments: account number, IBAN, BIC, SWIFT

This is necessary for an effective purchase contract to be concluded between the seller and the buyer.

The transmission and storage of this personal data is carried out in accordance with Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR)for the performance of our contractual obligation to broker your business with the contractual partner and to ensure the processing of the contract between you and your contractual partner. In addition, it will give you an overview of your current and past orders on your account. This is due to our obligation to marketplace users to maintain a functional and expedient marketplace, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR). You are under no legal or contractual obligation to provide the data at all; however, if you do not provide this data, you will not be able to enter into a contract with your contractual partner.

5.1.2.

Marketplace “Indirect” model

In the “Indirect” model, the data mentioned in section 5.1.1 are also collected and processed directly by Timber Base.

This processing of the data serves the performance and settlement of a purchase contract between Timber Base and you and is therefore carried out in accordance with Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR).

5.1.3.

Software use (Software-as-a-Service)

For the software usage contracts concluded with you in individual cases, the data mentioned under point 5.1.1 is also collected and processed directly by Timber Base. The data is necessary so that effective purchase contracts can be concluded between seller and buyer.

The transmission and storage of this personal data is carried out in accordance with Art. 6 Para. 1 Sentence 1 lit. b) DSGVO (GDPR) for the fulfilment of our contractual obligation to ensure contract initiation and processing between you and your contractual partners. In addition, you will be given an overview of your current and past contracts and orders on your account. This is due to our obligation towards the software users to maintain a functional and expedient software, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR). You are under no legal or contractual obligation to provide the data at all; however, if you do not provide this data, you will not be able to enter into a contract with your contractual partner.

5.1.4.

Order management

Contracts concluded via the marketplace and/or via our software are saved in your account under My Orders or My Tenders. All invoices, delivery notes and all receipts for these orders are assigned to the corresponding order under your account. For this purpose, Timber Base saves the purchase contract as well as receipts including transaction and invoice data. In addition to the data mentioned under 5.1.1, this includes the following information, which may contain personal data:

• Purchase contract
• Bills
• Delivery notes
• Loading documents
• Products with quantities, prices and product details
• Name, email and telephone number of the participants as acting person as indicated on delivery notes and invoices
• Certificates, in each case if required for the product, e.g. heat protocols and verifications, FSC/PEFC certifications, sorting guidelines, etc.
• Pictures of the loading
• Values and dates of payment transactions with
• Logistics details: truck registration number, weights, pick-up and delivery data
• In addition, depending on the order, usually in the export: shipowner, container numbers, seal numbers, bill of lading, dispatch of documents, certificate of origin, phytosanitary certificates, dispatch type of documents, tracking number of documents.

Storage of order-specific activities with date of execution in the course of the order e.g: Contract completed, Advance payment received, Order confirmed, Logistics booked, Logistics confirmed, Provision, Draft documents created for approval, Export documents confirmed, Export documents submitted, Original documents finalised, Vessel departed, All original documents available online, Final payment received, Original documents sent by courier, Original documents delivered, Destination reached. Timber Base will store this data until you delete your account (plus a backup period (see section 20)) or if you yourself decide to delete individual documents or complete contracts within your account. Please note that in such a case these documents may continue to be held in the account of your contractual partner.

6.

Delivery management

You can view the delivery status and the delivery note in your user account at any time. The following data is stored by Timber Base:

• Delivery address
• Company name
• Products with quantities, prices and product details
• Logistics details: truck registration number, weights, pick-up and delivery data
• In addition, depending on the order, usually for export: shipping line, container numbers, seal numbers, bill of lading, dispatch of documents, certificate of origin, phytosanitary certificates, dispatch type of documents, tracking number of documents.
• Processing protocols and certificates e.g. heat chamber protocols etc.
• Name, email and telephone number of the participants as contact person and acting person as indicated on delivery notes and invoices

In order to ensure proper delivery management and transport, certain data must be passed on to external third parties (e.g. customs or logistics service providers).

We store this data to enable you to keep track of your deliveries, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR), in some cases the data must also be passed on due to legal obligations pursuant to Art. 6 para. 1 lit. c) DSGVO (GDPR).

7.

Credit check

If you wish to use the option of purchase with payment terms on account, which is made available to you by Timber Base and some of the participating sellers in addition to other payment methods, Timber Base may check the creditworthiness of your company to assess the risk of non-payment or insolvency. The credit check is carried out by Creditsafe Deutschland GmbH (Schreiberhauer Straße 30 in 10317 Berlin) (“service provider”) of Timber Base. This service provider only uses information that has been made available to it via other sources that are not the responsibility of Timber Base. Timber Base cannot check the accuracy of this data. The data required for the credit assessment and transferred by Timber Base to the service provider is exclusively the company name and company address of the client.

Insofar as this involves personal data, the data processing is necessary for the assessment of the financial default risk if the participant wishes to purchase on account. The transfer of the data to the service provider is thus justified based on Art. 6 para. 1 sentence 1 lit. f) DSGVO (GDPR). The legitimate interest of Timber Base lies in minimising the risk of default.

8.

Commission and Fees

If you are a registered participant, Timber Base receives a commission for each transaction you make on the marketplace in accordance with the Terms and Conditions and Price List and/or an applicable software licence fee linked to turnover (or purchase volume) from the software usage agreement concluded with you.. In order to settle these, we process the following personal data:

• Products with quantities, prices and turnover from contracts, invoices and delivery notes to determine commissionable turnover and/or applicable software licence fee
• Name, email and telephone number of the participants as contact person and acting person as indicated on contracts, delivery notes and invoices
• Order designations, contract delivery and invoice addresses, dates, numbers and contact persons for clear identification of the brokerage service provided for the commission and/or software licence fee

This is necessary for the fulfilment of your obligation to pay commission and/or software licence fee to Timber Base, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR). You are neither legally
nor contractually obliged to provide the data at all; however, if you do not provide this data, Timber Base cannot process the commission payment and/or software licence fee, which is why you cannot use the marketplace and/or software as a participant (seller or buyer) in such a case.

9.

Enquiries

You have the option of sending us enquiries via the contact form or by email at info@timberbase.com. In order to be able to process your enquiries via the contact form, we need some mandatory information (name, company, email address, content of the enquiry). If you send us enquiries, we will store and use your details to process the enquiry.

We store enquiries about contracts or of potential legal relevance for the general limitation period, i.e. three years from the end of the year in which we received your enquiries. We store all other enquiries for a period of 24 months. After that, your enquiries will be deleted unless we are obliged to keep them for a longer period for legal reasons.

The storage is based on our legitimate interest, the proper documentation of our business operations and the protection of our legal positions (Art. 6 para. 1 sentence 1 lit. f DSGVO (GDPR)). In the case of enquiries about contracts, the storage takes place for the initiation and implementation of the respective contractual relationship (Art. 6 para. 1 sentence 1 lit. b DSGVO (GDPR)) and, if applicable, for the compliance with legal obligations (Art. 6 para. 1 sentence 1 lit. c DSGVO (GDPR)).

For the contact form, we use the service HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 based in the USA as a data processor within the meaning of Art. 28 DSGVO (GDPR). There is no
adequacy decision of the EU Commission for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission pursuant to Art. 46 (2) lit. c DSGVO (GDPR) with HubSpot.

10.

Newsletter

On our website you have the possibility to register for our newsletter. With our newsletter, we would like to send you information about our services that
is as individual as possible. By registering for our newsletter, you therefore consent to us processing your email address for sending the newsletter and the data stored by us for your
email address for individualising the newsletter and for these purposes analysing your reading and usage behaviour in the context of using the newsletter and our website and using cookies for this purpose. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. a DSGVO (GDPR).
You can revoke your consent at any time by unsubscribing from our newsletter. To do this, you can use the unsubscribe link contained in every email.

To verify your email address, you will first receive a registration email, which you must confirm via a link (double opt-in). When you register for the newsletter, we store the IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis results from our legal obligation to prove your consent (Art. 6 para. 1 sentence 1 lit. c in conjunction with Art. 7 para. 1 DSGVO (GDPR).

For the dispatch of our newsletter and the individualisation of content, we use the service of the provider HubSpot Inc, 25 First Street, 2nd Floor, Cambridge, MA 02141 based in the USA as a processor within the meaning of Art. 28 DSGVO (GDPR). There is no
adequacy decision of the EU Commission for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission pursuant to Art. 46 (2) lit. c DSGVO (GDPR) with HubSpot.

11.

Cookies

We store so-called cookies in order to be able to offer certain functions of our website and to optimise the use of our website. Cookies are small files that are stored on your end device with the help of your internet browser.

Specifically, we use the following cookies (unless other cookies are specified elsewhere in this privacy policy):

• Session cookies: These cookies are needed to store certain technical data during your visit to our website, e.g. to determine whether you have logged in.
• Login cookies: These cookies are needed to save your login beyond a session if you wish.
• Consent cookie: This cookie saves your cookie settings for one year.

The legal basis for the use of these cookies is Section 15 (1) of the German Telemedia Act (TMG) and Article 6 para. 1 sentence 1 lit. b of the General Data Protection Regulation (DSGVO), insofar as they are necessary for the use of our website and the functions you have accessed. Otherwise, we use cookies on the basis of your consent, Art. 6 para. 1 sentence 1 lit. a DSGVO (GDPR).

12.

Other tracking technologies

Emails and mobile apps may contain small, transparent image files or lines of code to record how you interact with them. This information is used to help website and app publishers better analyse and improve their services.

Specifically, we use (unless other tracking technologies are specified elsewhere in this Privacy Policy) the following technologies:

• Web Beacons / Gifs, Pixels, Page Tags, Script.

The legal basis for their use is Section 15 (1) of the German Telemedia Act (TMG) or Article 6 (1) sentence 1 lit. b of the German Data Protection Act (DSGVO), insofar as they are necessary for the use of our website and the functions accessed by you. Otherwise, we use these technologies on the basis of your consent, Art. 6 para. 1 sentence 1 lit. a DSGVO (GDPR).

13.

Analysis services

If you consent, we use the following analysis tools to understand the behaviour of the users of our website and to continuously improve it. The data processing in this regard is based on your consent (Art. 6 para. 1 sentence 1 lit. a DSGVO (German Data Protection Act)).

To do this, we use the following tools, among others:

• Google Analytics der Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043, USA (“Google”)
• Amplitude of Amplitude Inc, 501 2nd Street, Suite 100 San Francisco, CA 94107, USA
• HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA
• Usercentrics GmbH, Sendlinger Str. 7, 80331 Munich, Germany

There is no
adequacy decision of the EU Commission for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission with Google, Hubspot and Amplitude in accordance with Art. 46 para. 2 lit. c DSGVO (GDPR).

You can revoke your consent via our Cookie Consent Manager on our homepage www.timberbase.com. This does not affect the lawfulness of the processing carried out until your revocation.

14.

Usercentrics

15.

Sentry

16.

Remarketing

If you have consented, we will use the remarketing services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) described below. Please note that this may also involve processing by Google LLC, which is based in the USA. There is no adequacy decision by the EU Commission for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission with Google in accordance with Art. 46 para. 2 lit. c DSGVO (GDPR).

Google uses cookies to record your usage behaviour on our website in order to display interest-based advertising for our products on other pages within the Google advertising network across devices. This includes Google search and other sites operated by Google and its subsidiaries, as well as sites operated by Google’s advertising partners. The information is transmitted accordingly to Google and Google’s partners. Additional data processing will only take place if you have consented to Google linking your browsing history to your Google Account and using information from your Google Account to personalise the ads you see on the web. In this case, if you are logged into Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, your personal data will be temporarily linked by Google with Google Analytics data in order to form target groups.

The use of these services is based on your consent (Art. 6 para. 1 sentence 1 lit. a DSGVO (GDPR)). You can revoke your consent via our Cookie Consent Manager. This does not affect the lawfulness of the processing carried out until your revocation. Otherwise, the remarketing cookie is automatically deleted after 14 days.

Basic information on the processing of your personal data by Google can be found here:
https://policies.google.com/privacy
.

You also have the following setting options with Google:

• You can disable personalised advertising from Google:
  http://www.google.com/ads/preferences
  
• You can disable personalised advertising on a device-by-device basis:
  https://support.google.com/ads/answer/1660762#mob
  
• You can deactivate personalised advertising browser-based:
  http://optout.networkadvertising.org/?c=1
  

17.

Google Maps

We use Google Maps to verify your address, postcode or delivery location in order to match prices and display them correctly. This is done on the basis of our contractual obligation to you pursuant to Art. 6 para. 1 Sentence 1 llit. b DSGVO (GDPR).

For verification purposes, a Google maps service is used, which is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for users in the EU and by Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043, USA (“Google”) for other users. Google processes personal data for us on our behalf.

There is no EU Commission adequacy decision for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission pursuant to Art. 46 para.2 lit. c DSGVO (GDPR)with Google.

18.

Hosting

We operate our website on servers hosted by our web host GoDaddy.com LLC, Corporate Headquarters 14455 N. Hayden Rd. Hayden Rd, Ste. 226, Scottsdale, AZ 85260 USA], which processes personal data on our behalf.

There is no EU Commission adequacy decision for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission pursuant to Art. 46 para.2 lit. c DSGVO (GDPR) with GoDaddy.

We operate our marketplace on servers of our web hoster Amazon Web Service EMEA Sarl , 38 avenue John F. Kennedy, L-1855, Luxembourg, which processes personal data on our behalf. The processing only takes place within the European Union. In addition, we use the services of Amazon CloudFront of the provider Amazon Web Service EMEA Sarl, 38 avenue John F. Kennedy, L-1855, Luxembourg, which processes personal data on our behalf.

There is no
adequacy decision of the EU Commission for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission pursuant to Art. 46 para.2 lit. c DSGVO (GDPR) with Amazon CloudFront.

19.

Job Applications

If you apply to us, we will process your application documents and the information contained therein for the purpose of processing your application or deciding on the establishment of an employment relationship. Your application documents will only be made available to the persons responsible for the application within our company. The data processing is carried out on the legal basis of § 26 para. 1, 3 BDSG.

If we are unfortunately unable to offer you a position, your application documents will generally be stored for up to 4 months after the conclusion of the respective application process in order to be able to answer queries in connection with your application. Further storage may take place if this is necessary for the provision of evidence, in particular for the defence, assertion or enforcement of claims (Art. 6 para. 1 lit. f DSGVO).

Otherwise, we only store your applicant data if you have expressly consented to this (Art. 6 para. 1 lit. a DSGVO (GDPR)). You can revoke your consent at any time with effect for the future. You can do this, for example, by contacting us using the above contact details. A revocation does not affect the processing that took place until your revocation.

20.

Passing on data

In addition to the transfer of your personal data to the respective contractual partner and other external third party partners for the performance of our contract as described above in sections 5 and 6, your personal data will only be transferred without your express prior consent in the following cases:

• If it is necessary to clarify unlawful use of our services or for legal prosecution, personal data will be forwarded to the law enforcement authorities and, if necessary, to injured third parties. However, this only happens if there are concrete indications of unlawful or abusive behaviour. A transfer may also take place if this serves to enforce terms of use or other agreements. We are also legally obliged to provide information to certain public authorities upon request. These are law enforcement agencies, authorities that prosecute administrative offences subject to fines and the tax authorities. The disclosure of this data is based on our legitimate interest in combating abuse, prosecuting criminal offences and securing, asserting and enforcing claims and that your rights and interests in the protection of your personal data are not overridden, Art. 6 para. 1 sentence 1 lit. f DSGVO (GDPR) or based on a legal obligation according to Art. 6 para. 1 sentence 1 lit. c DSGVO (GDPR).
• We disclose personal data to auditors, accounting service providers, lawyers, banks, tax advisors and similar bodies insofar as this is necessary for the provision of our services (Art. 6 para. 1 sentence 1 lit. b DSGVO (GDPR)) or the proper operation of our business (Art. 6 para. 1 sentence 1 lit. f DSGVO (GDPR)) or we are obliged to do so (Art. 6 para. 1 sentence 1 lit. c DSGVO (GDPR)).
• We rely on contracted third-party companies and external service providers (“processors”) to provide our services. In such cases, personal data will be disclosed to these processors to enable them to continue processing. These Processors are carefully selected and regularly reviewed by us to ensure that your rights and freedoms are protected. The processors may only use the data for the purposes specified by us and are also contractually obliged by us to treat your data exclusively in accordance with this data protection declaration and the German data protection laws.

  We provide data to processors on the basis of Art. 28 para.1 DSGVO (GDPR). In the event that personal data is transferred to a data processor outside the EU and no adequacy decision is in place, we ensure the proper processing of the data through measures as described in Art. 46 et seq. DSGVO (GDPR). For further information, please contact us at the email address provided above.

• As part of the further development of our business, the structure of Timber Base GmbH may change as a result of a change in legal form, the establishment, acquisition or sale of subsidiaries, parts of companies or components. In such transactions, customer information is shared with the part of the company being transferred. Whenever personal data is shared with third parties to the extent described above, we will ensure that this is done in accordance with this privacy policy and the relevant data protection laws.

  The disclosure of personal data is justified by the fact that we have a legitimate interest in adapting our corporate form to the economic and legal circumstances and that your rights and interests in the protection of your personal data do not prevail, Art. 6 para. 1 sentence 1 lit. f DSGVO (GDPR).

21.

Automated individual decisions or profiling measures

22.

Deletion of your data

Unless otherwise stated, we will delete or anonymise your personal data as soon as it is no longer required for the purposes for which we collected or used it in accordance with the above paragraphs. As a rule, we store your personal data for the duration of the usage or contractual relationship via the website, as well as for a period of 4 weeks during which we store backup copies after the end of the contract. We also retain your data if we are obliged to do so for legal reasons or if the data is required for a longer period for criminal prosecution or for securing, asserting or enforcing legal claims.

If you delete your account, your account will be completely and permanently deleted. However, we will keep backup copies of your data for a period of 4 weeks days before it is permanently deleted, unless required for legal or law enforcement reasons or to secure,
enforce or enforce legal claims.

If data must be retained for legal reasons, processing is restricted. The data is then no longer available for further use.

The storage beyond the contractual relationship is based on our aforementioned legitimate interests according to Art. 6 para. 1 sentence 1 lit. f DSGVO (GDPR).

23.

Your rights as a data subject

As a person affected by the processing of personal data, you have a right of access to the data processed, a right to rectification of your personal data, a right to erasure of your personal data, a right to restriction of the processing of your personal data and a right to communication of your personal data.

In addition, you have the right to object to the processing of your personal data at any time for reasons relating to your particular situation if the data processing is based on Art. 6 para.1 sentence 1 lit. e or lit. f DSGVO (GDPR) (including profiling) or if data is processed for direct marketing purposes.

In the event of consent, you have the right to revoke your consent at any time, Art. 7 para. 3 sentence 1 DSGVO (GDPR). You can do this by sending a message to privacy@timberbase.com. This does not affect the lawfulness of the processing carried out until your revocation.

You also have the right to lodge complaints with a supervisory authority.

Finally, we would like to point out that we process the personal data provided by you when exercising your rights pursuant to Articles 15 to 22 of the GDPR for the purpose of implementing these rights and to be able to provide evidence thereof. These processing operations are based on the legal basis of Art. 6 para. 1 sentence 1 lit. c DSGVO (GDPR).

24.

Changes to this privacy policy