Privacy Policy
The protection of your personal data is important to us. With this data protection policy, we would like to explain to you in more detail which personal data we collect in the course of your use of our website at https://timberbase.com and for what purpose the data is used. This privacy policy has been drafted in both a German and an English version. The English version is solely for information purposes. In the event of questions regarding interpretation or disputes, the German version of the contract shall apply exclusively.
1. |
Controller and contact |
Timber Base GmbH
Rheinsberger Str. 76/77 10115 Berlin Germany Represented by the Managing Directors Felix Heberle & Tano Sebastian Khan (hereinafter referred to as “Timber Base” or “we“) If you have any questions or suggestions about data protection, please do not hesitate to contact us by email at the following address: privacy@timberbase.com. |
|
2. |
Subject of data protection |
The subject of data protection is personal data. According to Art. 4 No. 1 DSVGO (GDPR), personal data is any information relating to an identified or identifiable natural person; this includes, for example, the name or identification numbers. | |
3. |
Automated data transmissions |
When you access our website, your end device automatically transmits data for technical reasons. The following data is stored separately from other data that you may transmit to us:
We store this data for the following purposes:
Your IP address is only stored for a period of 14 days. In this case, the processing is carried out based on our overriding legitimate interests mentioned above (Art. 6 para. 1 lit. f DSGVO (GDPR)). |
|
4. |
Registration |
You have the option to register for a user account on the website. A user account is necessary for you to be able to purchase or offer products on our website or use our software. To do this, you must provide the following mandatory information:
Your registration data is required to set up and manage an account for you and to enable you to use our participant area, Art. 6 para. 1 sentence 1 lit. b DSGVO (GDPR). In order to set up this account, you must provide us with this data. However, you are neither contractually nor legally obliged to provide the data. In order to use the marketplace or our software, however, you must set up an account, in which context the provision of the registration data marked as mandatory fields is obligatory; without an account, you will in any case not be able to buy and sell products on our marketplace or use our software. |
|
5. |
Administration and contract processing |
5.1. |
Contract initiation and conclusion |
5.1.1. |
Marketplace “Direct” model |
If you create offers for other participants using the “Direct” model, these offers will initially appear for the other participants on the marketplace without providing any personal data. When the potential buyer makes a request for a purchase, we transmit this request to the seller. In the process, the following data of the buyer is collected and transmitted to the seller:
When the seller confirms the request, he makes a binding offer to the buyer. In doing so, the following data of the seller is collected and transmitted to the buyer:
If the buyer accepts the offer and a contract of sale is concluded between the seller and buyer, we collect the following data for the purpose of processing the contract and transmit it to the seller or buyer:
This is necessary for an effective purchase contract to be concluded between the seller and the buyer. The transmission and storage of this personal data is carried out in accordance with Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR)for the performance of our contractual obligation to broker your business with the contractual partner and to ensure the processing of the contract between you and your contractual partner. In addition, it will give you an overview of your current and past orders on your account. This is due to our obligation to marketplace users to maintain a functional and expedient marketplace, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR). You are under no legal or contractual obligation to provide the data at all; however, if you do not provide this data, you will not be able to enter into a contract with your contractual partner. |
|
5.1.2. |
Marketplace “Indirect” model |
In the “Indirect” model, the data mentioned in section 5.1.1 are also collected and processed directly by Timber Base. This processing of the data serves the performance and settlement of a purchase contract between Timber Base and you and is therefore carried out in accordance with Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR). |
|
5.1.3. |
Software use (Software-as-a-Service) |
For the software usage contracts concluded with you in individual cases, the data mentioned under point 5.1.1 is also collected and processed directly by Timber Base. The data is necessary so that effective purchase contracts can be concluded between seller and buyer. The transmission and storage of this personal data is carried out in accordance with Art. 6 Para. 1 Sentence 1 lit. b) DSGVO (GDPR) for the fulfilment of our contractual obligation to ensure contract initiation and processing between you and your contractual partners. In addition, you will be given an overview of your current and past contracts and orders on your account. This is due to our obligation towards the software users to maintain a functional and expedient software, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR). You are under no legal or contractual obligation to provide the data at all; however, if you do not provide this data, you will not be able to enter into a contract with your contractual partner. |
|
5.1.4. |
Order management |
Contracts concluded via the marketplace and/or via our software are saved in your account under My Orders or My Tenders. All invoices, delivery notes and all receipts for these orders are assigned to the corresponding order under your account. For this purpose, Timber Base saves the purchase contract as well as receipts including transaction and invoice data. In addition to the data mentioned under 5.1.1, this includes the following information, which may contain personal data:
Storage of order-specific activities with date of execution in the course of the order e.g: Contract completed, Advance payment received, Order confirmed, Logistics booked, Logistics confirmed, Provision, Draft documents created for approval, Export documents confirmed, Export documents submitted, Original documents finalised, Vessel departed, All original documents available online, Final payment received, Original documents sent by courier, Original documents delivered, Destination reached. Timber Base will store this data until you delete your account (plus a backup period (see section 20)) or if you yourself decide to delete individual documents or complete contracts within your account. Please note that in such a case these documents may continue to be held in the account of your contractual partner. |
|
6. |
Delivery management |
You can view the delivery status and the delivery note in your user account at any time. The following data is stored by Timber Base:
In order to ensure proper delivery management and transport, certain data must be passed on to external third parties (e.g. customs or logistics service providers). We store this data to enable you to keep track of your deliveries, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR), in some cases the data must also be passed on due to legal obligations pursuant to Art. 6 para. 1 lit. c) DSGVO (GDPR). |
|
7. |
Credit check |
If you wish to use the option of purchase with payment terms on account, which is made available to you by Timber Base and some of the participating sellers in addition to other payment methods, Timber Base may check the creditworthiness of your company to assess the risk of non-payment or insolvency. The credit check is carried out by Creditsafe Deutschland GmbH (Schreiberhauer Straße 30 in 10317 Berlin) (“service provider”) of Timber Base. This service provider only uses information that has been made available to it via other sources that are not the responsibility of Timber Base. Timber Base cannot check the accuracy of this data. The data required for the credit assessment and transferred by Timber Base to the service provider is exclusively the company name and company address of the client. Insofar as this involves personal data, the data processing is necessary for the assessment of the financial default risk if the participant wishes to purchase on account. The transfer of the data to the service provider is thus justified based on Art. 6 para. 1 sentence 1 lit. f) DSGVO (GDPR). The legitimate interest of Timber Base lies in minimising the risk of default. |
|
8. |
Commission and Fees |
If you are a registered participant, Timber Base receives a commission for each transaction you make on the marketplace in accordance with the Terms and Conditions and Price List and/or an applicable software licence fee linked to turnover (or purchase volume) from the software usage agreement concluded with you.. In order to settle these, we process the following personal data:
This is necessary for the fulfilment of your obligation to pay commission and/or software licence fee to Timber Base, Art. 6 para. 1 sentence 1 lit. b) DSGVO (GDPR). You are neither legally |
|
9. |
Enquiries |
You have the option of sending us enquiries via the contact form or by email at info@timberbase.com. In order to be able to process your enquiries via the contact form, we need some mandatory information (name, company, email address, content of the enquiry). If you send us enquiries, we will store and use your details to process the enquiry. We store enquiries about contracts or of potential legal relevance for the general limitation period, i.e. three years from the end of the year in which we received your enquiries. We store all other enquiries for a period of 24 months. After that, your enquiries will be deleted unless we are obliged to keep them for a longer period for legal reasons. The storage is based on our legitimate interest, the proper documentation of our business operations and the protection of our legal positions (Art. 6 para. 1 sentence 1 lit. f DSGVO (GDPR)). In the case of enquiries about contracts, the storage takes place for the initiation and implementation of the respective contractual relationship (Art. 6 para. 1 sentence 1 lit. b DSGVO (GDPR)) and, if applicable, for the compliance with legal obligations (Art. 6 para. 1 sentence 1 lit. c DSGVO (GDPR)). For the contact form, we use the service HubSpot Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141 based in the USA as a data processor within the meaning of Art. 28 DSGVO (GDPR). There is no |
|
10. |
Newsletter |
On our website you have the possibility to register for our newsletter. With our newsletter, we would like to send you information about our services that To verify your email address, you will first receive a registration email, which you must confirm via a link (double opt-in). When you register for the newsletter, we store the IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis results from our legal obligation to prove your consent (Art. 6 para. 1 sentence 1 lit. c in conjunction with Art. 7 para. 1 DSGVO (GDPR). For the dispatch of our newsletter and the individualisation of content, we use the service of the provider HubSpot Inc, 25 First Street, 2nd Floor, Cambridge, MA 02141 based in the USA as a processor within the meaning of Art. 28 DSGVO (GDPR). There is no |
|
11. |
Cookies |
We store so-called cookies in order to be able to offer certain functions of our website and to optimise the use of our website. Cookies are small files that are stored on your end device with the help of your internet browser. Specifically, we use the following cookies (unless other cookies are specified elsewhere in this privacy policy):
The legal basis for the use of these cookies is Section 15 (1) of the German Telemedia Act (TMG) and Article 6 para. 1 sentence 1 lit. b of the General Data Protection Regulation (DSGVO), insofar as they are necessary for the use of our website and the functions you have accessed. Otherwise, we use cookies on the basis of your consent, Art. 6 para. 1 sentence 1 lit. a DSGVO (GDPR). |
|
12. |
Other tracking technologies |
Emails and mobile apps may contain small, transparent image files or lines of code to record how you interact with them. This information is used to help website and app publishers better analyse and improve their services. Specifically, we use (unless other tracking technologies are specified elsewhere in this Privacy Policy) the following technologies:
The legal basis for their use is Section 15 (1) of the German Telemedia Act (TMG) or Article 6 (1) sentence 1 lit. b of the German Data Protection Act (DSGVO), insofar as they are necessary for the use of our website and the functions accessed by you. Otherwise, we use these technologies on the basis of your consent, Art. 6 para. 1 sentence 1 lit. a DSGVO (GDPR). |
|
13. |
Analysis services |
If you consent, we use the following analysis tools to understand the behaviour of the users of our website and to continuously improve it. The data processing in this regard is based on your consent (Art. 6 para. 1 sentence 1 lit. a DSGVO (German Data Protection Act)). To do this, we use the following tools, among others:
There is no You can revoke your consent via our Cookie Consent Manager on our homepage www.timberbase.com. This does not affect the lawfulness of the processing carried out until your revocation. |
|
14. |
Usercentrics |
We use the service of Usercentrics GmbH, based at Sendlinger Str. 7, 80331 Munich, Germany. It is a consent management platform and is used on our website as an order processor for the purpose of consent management. For more information, please see the Usercentrics privacy policy: https://usercentrics.com/privacy-policy/. The legal basis for the use of Usercentrics is a legitimate interest according to Art. 6 para. 1 p. 1 lit. c DSGVO (GDPR), being compliant with legal obligations and consent storage. | |
15. |
Sentry |
We use the Sentry service of Functional Software Inc., 132 Hawthorne Street, San Francisco, California 94107, to improve the technical stability of our service by monitoring system stability and identifying code errors. Sentry serves these purposes alone and does not evaluate data for advertising purposes. User data, such as details of the device or the time of the error, are collected anonymously and are not used in a personalised manner and are subsequently deleted. Further information on this can be found in Sentry’s privacy policy: https://sentry.io/privacy/. The legal basis for the use of Sentry is a legitimate interest according to Art. 6 para. 1 lit. f DSGVO (GDPR). Our legitimate interest is the user-friendly design of our offers. | |
16. |
Remarketing |
If you have consented, we will use the remarketing services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) described below. Please note that this may also involve processing by Google LLC, which is based in the USA. There is no adequacy decision by the EU Commission for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission with Google in accordance with Art. 46 para. 2 lit. c DSGVO (GDPR). Google uses cookies to record your usage behaviour on our website in order to display interest-based advertising for our products on other pages within the Google advertising network across devices. This includes Google search and other sites operated by Google and its subsidiaries, as well as sites operated by Google’s advertising partners. The information is transmitted accordingly to Google and Google’s partners. Additional data processing will only take place if you have consented to Google linking your browsing history to your Google Account and using information from your Google Account to personalise the ads you see on the web. In this case, if you are logged into Google while visiting our website, Google will use your data together with Google Analytics data to create and define target group lists for cross-device remarketing. For this purpose, your personal data will be temporarily linked by Google with Google Analytics data in order to form target groups. The use of these services is based on your consent (Art. 6 para. 1 sentence 1 lit. a DSGVO (GDPR)). You can revoke your consent via our Cookie Consent Manager. This does not affect the lawfulness of the processing carried out until your revocation. Otherwise, the remarketing cookie is automatically deleted after 14 days. Basic information on the processing of your personal data by Google can be found here: You also have the following setting options with Google:
|
|
17. |
Google Maps |
We use Google Maps to verify your address, postcode or delivery location in order to match prices and display them correctly. This is done on the basis of our contractual obligation to you pursuant to Art. 6 para. 1 Sentence 1 llit. b DSGVO (GDPR). For verification purposes, a Google maps service is used, which is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland for users in the EU and by Google LLC, 1600 Amphitheatre Pkwy Mountain View, California 94043, USA (“Google”) for other users. Google processes personal data for us on our behalf. There is no EU Commission adequacy decision for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission pursuant to Art. 46 para.2 lit. c DSGVO (GDPR)with Google. |
|
18. |
Hosting |
We operate our website on servers hosted by our web host GoDaddy.com LLC, Corporate Headquarters 14455 N. Hayden Rd. Hayden Rd, Ste. 226, Scottsdale, AZ 85260 USA], which processes personal data on our behalf. There is no EU Commission adequacy decision for the USA. Therefore, we have concluded the standard data protection clauses approved by the EU Commission pursuant to Art. 46 para.2 lit. c DSGVO (GDPR) with GoDaddy. We operate our marketplace on servers of our web hoster Amazon Web Service EMEA Sarl , 38 avenue John F. Kennedy, L-1855, Luxembourg, which processes personal data on our behalf. The processing only takes place within the European Union. In addition, we use the services of Amazon CloudFront of the provider Amazon Web Service EMEA Sarl, 38 avenue John F. Kennedy, L-1855, Luxembourg, which processes personal data on our behalf. There is no |
|
19. |
Job Applications |
If you apply to us, we will process your application documents and the information contained therein for the purpose of processing your application or deciding on the establishment of an employment relationship. Your application documents will only be made available to the persons responsible for the application within our company. The data processing is carried out on the legal basis of § 26 para. 1, 3 BDSG. If we are unfortunately unable to offer you a position, your application documents will generally be stored for up to 4 months after the conclusion of the respective application process in order to be able to answer queries in connection with your application. Further storage may take place if this is necessary for the provision of evidence, in particular for the defence, assertion or enforcement of claims (Art. 6 para. 1 lit. f DSGVO). Otherwise, we only store your applicant data if you have expressly consented to this (Art. 6 para. 1 lit. a DSGVO (GDPR)). You can revoke your consent at any time with effect for the future. You can do this, for example, by contacting us using the above contact details. A revocation does not affect the processing that took place until your revocation. |
|
20. |
Passing on data |
In addition to the transfer of your personal data to the respective contractual partner and other external third party partners for the performance of our contract as described above in sections 5 and 6, your personal data will only be transferred without your express prior consent in the following cases:
|
|
21. |
Automated individual decisions or profiling measures |
We do not use automated processing to make a decision about you or for profiling. | |
22. |
Deletion of your data |
Unless otherwise stated, we will delete or anonymise your personal data as soon as it is no longer required for the purposes for which we collected or used it in accordance with the above paragraphs. As a rule, we store your personal data for the duration of the usage or contractual relationship via the website, as well as for a period of 4 weeks during which we store backup copies after the end of the contract. We also retain your data if we are obliged to do so for legal reasons or if the data is required for a longer period for criminal prosecution or for securing, asserting or enforcing legal claims. If you delete your account, your account will be completely and permanently deleted. However, we will keep backup copies of your data for a period of 4 weeks days before it is permanently deleted, unless required for legal or law enforcement reasons or to secure, If data must be retained for legal reasons, processing is restricted. The data is then no longer available for further use. The storage beyond the contractual relationship is based on our aforementioned legitimate interests according to Art. 6 para. 1 sentence 1 lit. f DSGVO (GDPR). |
|
23. |
Your rights as a data subject |
As a person affected by the processing of personal data, you have a right of access to the data processed, a right to rectification of your personal data, a right to erasure of your personal data, a right to restriction of the processing of your personal data and a right to communication of your personal data. In addition, you have the right to object to the processing of your personal data at any time for reasons relating to your particular situation if the data processing is based on Art. 6 para.1 sentence 1 lit. e or lit. f DSGVO (GDPR) (including profiling) or if data is processed for direct marketing purposes. In the event of consent, you have the right to revoke your consent at any time, Art. 7 para. 3 sentence 1 DSGVO (GDPR). You can do this by sending a message to privacy@timberbase.com. This does not affect the lawfulness of the processing carried out until your revocation. You also have the right to lodge complaints with a supervisory authority. Finally, we would like to point out that we process the personal data provided by you when exercising your rights pursuant to Articles 15 to 22 of the GDPR for the purpose of implementing these rights and to be able to provide evidence thereof. These processing operations are based on the legal basis of Art. 6 para. 1 sentence 1 lit. c DSGVO (GDPR). |
|
24. |
Changes to this privacy policy |
The current version of this privacy policy is always available at https://timberbase.com/data- protection. |
Version: 26. May 2021