Login Register for freeSign up
Back to home

Privacy Policy

Note on legal references: references to "Art." refer to the EU General Data Protection Regulation (GDPR), which applies directly throughout the EU. References to "§" refer to German national laws (e.g. BDSG, TDDDG, UStG, AO), as the controller is based in Germany.

The protection of your personal data is important to us. Below we inform you in accordance with Articles 13 and 14 GDPR about which data we process when you use www.finalsticker.com (hereinafter "FINALSTICKER", "platform", "we"), for what purposes and on what legal basis. The General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) apply.

1. Controller

The controller responsible for data processing on this platform within the meaning of Art. 4 No. 7 GDPR is:

FINALSTICKER, Owner: Chris Hamann
Unter den Eichen 6
49809 Lingen
Germany
Email: info@finalsticker.com

Further details can be found in our legal notice.

2. Data Protection Officer

We are not legally required to appoint a data protection officer and have therefore not appointed one. You can send data-protection requests and matters concerning the exercise of your rights to datenschutz@finalsticker.com or info@finalsticker.com.

3. General information and definitions

We process personal data only to the extent necessary to provide a functional platform as well as our content and services, where there is a legal obligation, or where you have given your consent. "Personal data" means any information relating to an identified or identifiable natural person. "Processing" means any operation performed on such data (e.g. collection, storage, use, transfer, deletion).

4. Hosting

We host our platform with a provider in Germany:

myLoc managed IT AG (brand "webtropia"), Am Gatherhof 44, 40472 Düsseldorf, Germany.

The provider processes, on our behalf, the data generated when using the platform (in particular the content data referred to in this policy as well as technical connection data). This is based on a data processing agreement pursuant to Art. 28 GDPR. The legal basis for the use is our legitimate interest in secure and efficient operation (Art. 6(1)(f) GDPR). The servers are located in Germany.

5. Provision of the platform and server log files

When you access the platform, the server automatically collects so-called server log files transmitted by your browser. These are:

  • IP address of the requesting device,
  • date and time of access,
  • the file/URL requested and the status code,
  • amount of data transferred,
  • browser type and version, operating system,
  • referrer URL.

This data is used for technical delivery, stability and security (e.g. to ward off attacks). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and trouble-free operation. The log files are generally deleted or anonymised within 7 days, unless they are required for longer to preserve evidence in connection with a specific security incident.

6. DNS via Cloudflare

We use Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) to resolve our domain (DNS). Cloudflare is integrated solely as a DNS provider; no "proxy" or caching of visitor traffic via Cloudflare takes place. Technical request data is processed as part of DNS resolution. The legal basis is Art. 6(1)(f) GDPR (reliable availability of the platform). The data-protection agreements required for processing the technical DNS data are in place with Cloudflare. Any transfer to the USA is safeguarded by the EU Standard Contractual Clauses (see section 27).

7. SSL/TLS encryption

For security reasons, this platform uses TLS encryption. The certificates are obtained via Let's Encrypt (Internet Security Research Group); no personal user data is transmitted to third parties in this process. You can recognise an encrypted connection by the padlock symbol and "https://" in the address bar.

8. Cookies and local storage

We use exclusively technically necessary cookies, in particular a session cookie required for logging in and for the secure use of your account, as well as a cookie to store your language setting. These cookies are strictly necessary for operation; consent is not required for this (Section 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR).

In addition, we store individual convenience settings locally in your browser (local storage), e.g. the view last selected in the inventory. This data remains on your device and is not transmitted to us.

We do not currently use tracking, analytics or advertising cookies. Should consent-requiring services be added in future, we will obtain your express consent beforehand (Art. 6(1)(a) GDPR, Section 25(1) TDDDG) and adapt this policy.

Affiliate links / advertising: On individual pages — e.g. on collection detail pages and in the Marketplace price research — we link to relevant offers at partner shops such as eBay or Amazon. Such links are marked as "advertisement". These are pure references (outbound links): we do not embed any partner scripts for this and do not set any cookies ourselves via these links; as long as you do not click such a link, no personal data is transmitted to eBay or Amazon.

If you click such a link, you leave our website. The respective provider may then use cookies or similar technologies on its own site in order to attribute any resulting purchase to our partner account; their type and storage period are governed by the terms of the respective provider. In this case we receive a commission; there are no additional costs for you. These cookies are set and read by eBay or Amazon under their own responsibility and in accordance with their own consent and privacy notices: eBay privacy notice and Amazon privacy notice.

This is not personalised advertising; we do not create any user profile and do not analyse your behaviour for this purpose. Which country shop is shown to you depends solely on your country or language setting.

The legal basis for including these affiliate links is our legitimate interest in financing our free service (Art. 6(1)(f) GDPR). The processing is recognisable to you as an "advertisement" and limited to what is necessary (no data transfer before the click, no tracking on our pages). You suffer no disadvantage and can ignore the links without any content being withheld from you.

9. User account and registration

To use the full range of functions, you create a user account. In doing so and in the further course, we process:

  • username, e-mail address and password (stored only as a cryptographic hash),
  • first and last name,
  • language, country and selected currency,
  • times of registration and last activity,
  • the time zone of your device (only the identifier, e.g. "Europe/Berlin"), which we take over automatically when you sign in so that we do not send you notifications during your night-time; you can change it in the settings.

The purpose is the provision and administration of your account as well as the handling of platform use. The legal basis is the performance of the user contract (Art. 6(1)(b) GDPR). To confirm your e-mail address, we send a verification e-mail.

10. Profile information (voluntary)

You can supplement your profile with voluntary information, such as a description ("About me"), gender, date of birth (including the option to display your age) and a profile picture (avatar). This information is voluntary and visible to other members. The legal basis is your consent by voluntarily entering it (Art. 6(1)(a) GDPR); you can change or remove it at any time in the settings (withdrawal with effect for the future).

Uploaded profile pictures are stored on our servers and processed to display your profile. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

Publicly visible information: Your username, your country, your profile picture, your ratings and, where applicable, your verification badge and your designation as a commercial seller are part of your public presence on the platform. They are shown to other members and – if you offer stickers for sale, run Marketplace listings or have proposed collections – also to visitors who are not logged in and to search engines: on your offers on sticker and collection pages, on your public seller page and as the creator note on accepted collections. Your e-mail address, your first and last name and your postal address are never public (for the provider identification of commercial sellers see section 11). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in operating an open trading and selling platform (Art. 6(1)(f) GDPR).

11. Address data and shipping

To ship traded or purchased items, we require your postal address (name, street, postal code, city, state if applicable, country). Your address is shown to the other person only after a trade or purchase has been concluded, so that shipping can take place. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). Without a complete address, trades and purchases cannot be completed.

Commercial sellers: If you classify yourself as a commercial seller, you are legally required to provide a provider identification (legal notice/imprint). The information you provide for this purpose (in particular company name, business address, contact details and – where applicable – VAT ID and register details) is displayed publicly as part of your sale offers so that buyers can view it. This concerns the business address you provide; the display of your private shipping address under paragraph 1 (only after a transaction has been concluded) remains unaffected. The legal basis is the fulfilment of a legal obligation (Art. 6(1)(c) GDPR) and your legitimate interest in promoting your offers (Art. 6(1)(f) GDPR). For private sellers, such information is not published.

12. Handling of trades and purchases

To handle trades and purchases, we process the collectibles involved, the selected items, reservations, price information, shipping details and the status of the transaction. The respective partners see the data of the other party required for the transaction. The legal basis is Art. 6(1)(b) GDPR. Payment and shipping: For trades and purchase requests, payment and shipping take place directly between members; in these cases FINALSTICKER does not process any payments between the parties and does not act as seller or dealer of the items. For instant purchases – fixed-price offers that you can pay online directly – payment is processed via the payment service providers named in section 20; the seller is the provider named in the offer. Details of payment processing can be found in section 20.

Marketplace listings: If, as a Premium member, you list your own items on the marketplace, we process and publish the item data you provide (title, description, condition, price, shipping details) as well as the item photos you upload. This content is publicly visible – including to visitors who are not logged in and via your public seller page. Interested parties can contact you via an enquiry; in doing so we process the resulting message history to facilitate the contact. We store a watchlist ("watched items") assigned to your account. The legal bases are the performance of pre-contractual measures or of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in operating the marketplace (Art. 6(1)(f) GDPR).

Tax disclosure obligations (platform tax transparency): Insofar as we are legally required to do so as a platform operator (in particular under the German Platform Tax Transparency Act – PStTG, which implements the EU "DAC7" directive – above certain thresholds), we may be obliged to transmit certain data of selling members (including name, address, tax identification number and information on the sales achieved) to the competent tax authorities and to request the information required for this. The legal basis is the fulfilment of a legal obligation (Art. 6(1)(c) GDPR). This obligation may exist regardless of whether you classify yourself as a private or commercial seller.

Purchase intent before registration: If you click "Buy" as a visitor and then register, we note the desired item on your new account so that you can continue the purchase directly (Art. 6(1)(b) GDPR). The note is deleted as soon as you have submitted or discarded the purchase request.

13. Messages in the trade/purchase chat

Within a trade or purchase, you can exchange messages. These are stored and accessible to the respective parties in order to enable the transaction and make it traceable (e.g. in the event of disputes). The legal basis is Art. 6(1)(b) and (f) GDPR.

14. Ratings

After completed transactions, the parties involved can rate each other (star rating and optional comment). Ratings are linked to the respective profile and visible to other members; they serve to build trust within the community. The legal basis is our legitimate interest in a functioning, trustworthy trading system (Art. 6(1)(f) GDPR).

15. Activities and notifications

We keep an activity history for your account (e.g. offers received, messages, shipping and receipt confirmations, completed transactions, ratings and announcements from us) in order to inform you about relevant events. In addition, we send you notifications by e-mail. These can be deselected individually by topic (trades and purchases, ratings, Marketplace, reminders, announcements) in the settings; system-relevant messages (e.g. regarding sign-in, the security of your account or invoices) are sent regardless. To avoid flooding you with individual e-mails, we bundle notifications over time, do not send them during your night-time (see time zone, section 9) and skip an e-mail if you have already seen the event online; for this purpose we record the time of the last notification. On request, we remind you once as soon as a suitable trading partner has been found ("Let me know"), as well as of unread messages and, after a longer period of inactivity, of your account. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in functioning communication on the platform (Art. 6(1)(f) GDPR). Notifications via Telegram are described in section 16.

16. Notifications via Telegram (voluntary)

On request, you can receive notifications in addition to e-mail – or instead of it – via the messenger Telegram. To do so, you connect your account yourself to our Telegram bot (via a link, a QR code or a start command in the bot); you do not provide a phone number to us. We then store the chat ID of your Telegram account assigned by Telegram and the time of the connection. Via this ID we send you short messages with the same content as our notification e-mails, e.g. "New trade offer" with the username of the other party and a link to the transaction, and, on request, the one-time reminder as soon as a trading partner has been found. You control which topics you receive via the same settings as for e-mail notifications; whether you want to keep the e-mails as well is your choice in the Telegram card of the settings.

The provider of Telegram is Telegram Messenger Inc., Commerce House, Wickhams Cay 1, Road Town, Tortola, British Virgin Islands; its representative in the EU is the European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium. Telegram processes the messages sent to you and your chat ID under its own responsibility in accordance with its privacy policy (telegram.org/privacy); according to Telegram, the data of users from the EEA is stored in data centres in the Netherlands. As the provider is based outside the EU, the transfer takes place exclusively on the basis of your explicit, informed consent, which applies only to this delivery channel chosen by you (Art. 49(1)(a) GDPR; details and risk notice in section 27). Please note that messages to bots are not end-to-end encrypted on Telegram.

The legal basis for the processing is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future – via "Disconnect" in the settings or the /stop command in the bot. We then delete the chat ID immediately, as we do when your account is deleted. For the administration of the platform, the operator himself also receives notices of new transactions via Telegram (e.g. a request addressed to him or a Premium purchase); these contain only usernames and transaction data, no real names, e-mail addresses or postal addresses.

17. Online status

To improve the trade/purchase experience, we show other members whether you were recently online (based on your last page view). The legal basis is Art. 6(1)(f) GDPR. You can disable the display of your online status at any time in your settings (Account → Privacy); independently of this, you have the right to object under section 31.

18. Abuse prevention and disputes

To protect against abuse, we process internal notes, warnings, blocks (including a temporary block on trading and buying in the event of suspicious behaviour) and data on reported disputes (e.g. shipments not received) where necessary. This data is only visible internally or to the administration. The legal basis is our legitimate interest in the security of the platform and the prevention of abuse (Art. 6(1)(f) GDPR).

Prevention of circumvention of blocks: If an account is blocked, we store normalised components of the stored address for this purpose (e.g. surname, street, house number, postal code, city and country in a standardised form) in order to detect whether the same person is circumventing the block via a new account or a change of address. This information is only kept for the duration of the block and is automatically removed after it ends. The legal basis is our legitimate interest in enforcing blocks and preventing abuse (Art. 6(1)(f) GDPR).

Reports of unlawful content: If you report content or behaviour to us (e.g. via the report function or the contact form), we process the details of your report, your contact data (where provided) and technical data such as your IP address in order to review and handle the report and to prevent misuse of the report function. The legal bases are the fulfilment of legal obligations (Art. 6(1)(c) GDPR, in particular under the German Digital Services Act or the EU Digital Services Act) and our legitimate interest in a secure platform (Art. 6(1)(f) GDPR).

19. Verification ("GetVerified")

You can have your account verified voluntarily in order to receive a trust badge. Only your name and/or address are checked; we do not require identity documents and do not process official ID data. For postal verification, we send a confirmation code to the address you have provided; for this purpose, we process an unchangeable snapshot of this address as well as the code. The purpose is to prove the accuracy of your information and to strengthen trust. The legal basis for processing your verification data and displaying the trust badge is your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time with effect for the future. If you book the paid (postal) verification, we process the data required for its handling and billing in order to perform that contract (Art. 6(1)(b) GDPR). We store the snapshot of your address and the confirmation code for as long as the verification exists; if the verification status lapses (e.g. due to a change of your name or address or to a withdrawal) or you delete your account, this data is deleted.

20. Payments, invoices and Premium membership

If you purchase a paid service from us (Premium membership, ad-free use, paid verification or a gift code), we process the data required for processing (selected product, term, amount, currency) as well as an invoice record with a consecutive invoice number, invoice/service date and an unchangeable snapshot of your billing address. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and compliance with retention obligations under tax and commercial law (Art. 6(1)(c) GDPR in conjunction with Section 14 UStG, Section 147 AO, GoBD). We retain invoices and other tax-relevant records in accordance with the statutory retention periods applicable at the time.

Payments are processed by the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland ("Stripe"). When you purchase a paid service, the data required for payment (in particular name, email address, billing address, payment-method data as well as amount and currency) is transmitted to and processed by Stripe. Payment details are entered directly with Stripe; in particular, we do not receive any full credit-card or debit-card numbers. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Where Stripe returns the payer’s name to us in connection with a payment, we use it solely for the voluntary identity check for our verification badge ("name verified"), provided you have requested verification. Stripe is part of a US group (Stripe, Inc.); details on the third-country transfer can be found in section 27. Further information: https://stripe.com/privacy.

Alternatively, you can pay with PayPal. The provider is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg ("PayPal"). If you choose PayPal, you are redirected to PayPal to approve the payment; the data required for the payment (name, e-mail address, amount and currency as well as the payment details stored with PayPal) is processed there. We receive from PayPal a payment and transaction ID, the payment status and the name of the PayPal account, which – as with Stripe – we use exclusively for the voluntary identity check ("name verified"). The legal basis is Art. 6(1)(b) GDPR. PayPal belongs to a US group (PayPal, Inc.); details on transfers to third countries can be found in section 27. Further information: paypal.com/us/legalhub/privacy-full.

Instant purchase of stickers and Marketplace items: For fixed-price offers that you pay online directly, we process the payment via Stripe or PayPal. For this purpose, we store a payment record (provider, payment and transaction ID, amount, currency, status and timestamps) with the respective transaction, and the seller receives your shipping address (section 11). The seller is in each case the provider named in the offer; the payment service provider accepts the payment on the seller's behalf. You receive an order confirmation by e-mail. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); the retention periods mentioned above apply to payment records.

Shipping data to PayPal: If you have paid for an instant purchase via PayPal, after dispatch we automatically transmit the carrier and the tracking number to PayPal so that the shipment can be tracked in your PayPal account and PayPal's buyer and seller protection applies. The legal basis is Art. 6(1)(b) and (f) GDPR.

Voucher and gift codes: If you redeem a code, we store the code and the time of redemption with your account in order to rule out multiple redemptions. When you buy a gift code, we do not collect any data about the recipient; the code is delivered exclusively to you.

Withdrawal via the withdrawal function. If you have purchased a paid service from us or bought goods from the operator in an instant purchase, you can withdraw from the contract within the withdrawal period via the withdrawal function in your account (Settings → Account → “Withdraw from contract”). In doing so, we process the contract concerned, the name and e-mail address you have entered, your optional message and the date and time of receipt of your declaration. We send an acknowledgement of receipt to the e-mail address provided without delay, stating the content of your declaration and the date and time of its receipt. We also record the processing status (e.g. received, in progress, refunded or completed).

The purpose of the processing is to handle your withdrawal and to document its content and its receipt within the deadline. The legal bases are the fulfilment of our legal obligations (Art. 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code, BGB), the performance of the contract (Art. 6(1)(b) GDPR) and – insofar as further storage is necessary as evidence or to defend against or assert legal claims – our legitimate interest in the legal documentation of the transaction (Art. 6(1)(f) GDPR).

We store the personal data of the withdrawal transaction only for as long as is necessary to handle the withdrawal, to fulfil statutory retention obligations or to establish, exercise or defend legal claims. Insofar as data form part of business or payment records subject to retention obligations, the retention periods described in section 28 apply. The personal data are then deleted or anonymised.

21. Collection proposals

You can propose missing sticker albums to us and upload a title, description, sticker numbers and images (album cover, sample stickers). We store the proposal with your account and review it editorially. If it is accepted, we publish the collection – where applicable with the images you uploaded – in the catalogue and name your username there as the creator. Accepted proposals count towards a reward in the form of Premium months; for this purpose we store the number of months credited. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in a complete catalogue (Art. 6(1)(f) GDPR). Open and rejected proposals, including the images, are removed when your account is deleted; accepted collections remain in the catalogue without reference to your personal details.

22. Player pages (public figures)

For athletes depicted on collectible stickers and trading cards, we publish editorial overview pages with name, date of birth, nationality, club and tournament history, a short biography and, where applicable, an image, as well as the albums in which the person appears. This information comes from publicly accessible sources, in particular Wikidata and Wikipedia (content under free licences), and relates exclusively to public figures in their public role. The legal basis is our legitimate interest in providing information about the persons depicted on the collectibles and in a searchable catalogue (Art. 6(1)(f) GDPR). Affected persons can contact datenschutz@finalsticker.com at any time to have information corrected or removed; visitors can report incorrect attributions via the report function of the respective page. Members who offer the respective sticker for sale are shown on these pages with their username, country and price (see section 10).

23. Contact form and contacting us

If you write to us via the contact form or by e-mail, we process the information you provide (e.g. name, e-mail address, message) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR (for contract-related enquiries) or (f) GDPR (for other matters). The data is deleted as soon as the request has been conclusively processed and no statutory retention obligations prevent this.

24. E-mail communication

We send transactional e-mails (e.g. registration confirmation, password reset, notices regarding trades/purchases, invoices) via our own mail server operated in Germany. For reliable delivery, we route outgoing e-mails through an ISO 27001-certified delivery service provider based in Germany (VegaSystems) as a processor. We only send notifications to confirmed e-mail addresses; we note delivery failures (e.g. an address that can no longer be reached) on your account and stop sending to that address until you have confirmed a valid address. We process incoming e-mails to our addresses in order to deal with your request. We do not currently send an advertising newsletter; this would only be done with your express consent.

25. Minors

Our service is aimed at persons aged 16 and over; under our terms of use, persons under 16 may only use the platform with the consent of their legal guardians. Where the processing of personal data of persons under 16 is based on consent, the consent of the legal guardians is required (Art. 8 GDPR). We do not knowingly process data of children under 16 without such consent. Legal guardians can contact us at any time if they become aware that data of a child has been transmitted to us without their consent; we will then delete it immediately.

26. Recipients and processors

Your data is only passed on to third parties to the extent necessary for the performance of the contract, where we are legally obliged to do so (e.g. towards authorities) or where you have consented. We currently use the following processors or service providers:

  • myLoc managed IT AG / webtropia (Germany) – hosting/server operation,
  • Cloudflare, Inc. (USA/EU) – DNS resolution,
  • Let's Encrypt / ISRG – issuance of TLS certificates (without user data),
  • Stripe Payments Europe, Ltd. (Ireland) – payment processing.
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) – processing of payments if you choose PayPal (independent controller),
  • Telegram Messenger Inc. (British Virgin Islands; according to the provider, data of EEA users is stored in the Netherlands) – delivery of notifications, only if you have connected your account to Telegram (independent controller),
  • VegaSystems GmbH & Co. KG (Paderborn, Germany) – Sending of e-mails (mail relay).

In the course of trades and purchases, the data required for the transaction (in particular name and address) is disclosed to the respective trading/purchase partners; for instant purchases, the seller receives your shipping address. This is part of the purpose of the contract (Art. 6(1)(b) GDPR).

27. Transfer to third countries

Where data is transferred to providers based outside the EU/EEA (in particular Cloudflare, USA), this is done on the basis of appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or an adequacy decision of the European Commission, where applicable. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission); in addition, EU Standard Contractual Clauses are in place. On request, we will provide you with information on the safeguards taken.

When payments are processed via Stripe, data may be transferred to the US parent company Stripe, Inc. (USA). Stripe, Inc. is certified under the EU-US Data Privacy Framework; in addition, EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) are in place.

When payments are made via PayPal, data may be transferred to the US parent company PayPal, Inc. (USA). PayPal bases intra-group transfers on binding corporate rules (Binding Corporate Rules, Art. 47 GDPR) and other transfers on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); details are set out in PayPal's privacy statement (section 20).

If you use Telegram notifications (section 16), we transmit your chat ID and the notification texts to Telegram Messenger Inc., based in the British Virgin Islands, for which no adequacy decision of the European Commission exists. The transfer is inseparably linked to the delivery channel you have chosen: it takes place only because and for as long as you wish to receive notifications via your own Telegram messenger, and is limited to the data required for this (chat ID and a short text with username and link – no real names, e-mail addresses or postal addresses). It is based exclusively on your explicit consent (Art. 49(1)(a) GDPR), which you give by connecting your account after being informed of the risks and which you can withdraw at any time with effect for the future (disconnect or /stop). Please note that a level of data protection comparable to that in the EU is not guaranteed there – in particular, authorities there could access the data and your data subject rights may be more difficult to enforce – and that by connecting you accept this risk. According to Telegram, the data of users from the EEA is stored in data centres in the Netherlands.

28. Storage period and deletion

We store personal data only for as long as is necessary for the stated purposes or as provided for by statutory retention periods. As long as your account exists, we process your account data for the duration of your membership; we do not delete your account automatically merely because of prolonged inactivity – however, we may remind you of your account after a longer period of inactivity. You can mark your account for deletion at any time in the settings; after a period of 7 days (within which you can revoke the deletion), your account is anonymised: we remove or overwrite your personal data (in particular name, e-mail address, address, profile information and profile picture), delete your private content (e.g. inventory and collections) and close any transactions still open. Contributions relating to other members – in particular ratings you have given as well as information on already completed trade/purchase transactions including the associated message history – are retained in anonymised form in order to preserve the meaningfulness of the rating system and the traceability of transactions (without any link to your clear data; your name then appears as "Deleted user"). This does not affect data that we are required to retain for legal reasons, in particular invoice documents; we retain such data in accordance with the statutory retention periods (up to ten years – see section 20) and block it from further processing.

We keep message histories and activity entries relating to trade and purchase transactions only for a limited time: for cancelled or expired transactions we delete the messages six months after the transaction ended, for completed transactions between private members 24 months after completion. If a business member is involved or a payment record or withdrawal exists, we retain those messages and documents that are subject to statutory retention obligations as commercial or business correspondence or as tax-relevant records, for the duration of the respective statutory retention obligation (Section 257 HGB, Section 147 AO). The key data required to evidence the transaction (participants, stickers, agreed price, shipping status) and automatic system notices are stored only for as long as necessary for processing, statutory retention obligations or the establishment, exercise or defence of legal claims; activity entries in the dashboard are deleted after twelve months. Invoices and payment records are subject to the applicable statutory retention periods, in particular the ten-year retention period for invoices and certain accounting records.

We retain proof of your acceptance of our terms of use and of your acknowledgement of the applicable privacy policy (version number and time) for documentation purposes and to fulfil our accountability obligations (Art. 5(2) GDPR), even after your account has been anonymised, without reference to your personal details; the same applies to the redemption of voucher codes. We delete your Telegram chat ID immediately when you disconnect or when your account is deleted.

29. Data security

We take technical and organisational measures to protect your data against loss, misuse and unauthorised access. These include, among others, continuous TLS encryption of the connection, storage of passwords exclusively as hashes, restrictive access rights, a firewall, protection against automated login attempts and server operation in a German data centre. Our measures are continuously adapted in line with technological developments.

30. Your rights as a data subject

Under the GDPR, you have the following rights:

  • access to the data stored about you (Art. 15),
  • rectification of inaccurate or incomplete data (Art. 16),
  • erasure (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • objection to certain processing operations (Art. 21, see section 31),
  • withdrawal of consent given, with effect for the future (Art. 7(3)).

To exercise your rights, an informal message to datenschutz@finalsticker.com is sufficient. Exercising them is generally free of charge for you.

31. Right to object (Art. 21 GDPR)

Insofar as we process personal data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to this processing. We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert, exercise or defend legal claims. You can send your objection informally to datenschutz@finalsticker.com.

32. Right to lodge a complaint with a supervisory authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your residence, place of work or place of the alleged infringement. The authority responsible for us is:

The State Commissioner for Data Protection of Lower Saxony (LfD)
Prinzenstraße 5, 30159 Hannover, Germany
Telephone: +49 511 120-4500
E-mail: poststelle@lfd.niedersachsen.de
Website: www.lfd.niedersachsen.de

33. Necessity of provision

Certain data is necessary for use: without account and contact data, no user account can be maintained; without a complete address, trades and purchases cannot be handled. To that extent, provision is necessary for the performance of the contract; without it, the respective functions cannot be used. Voluntary profile information, on the other hand, is optional.

34. No automated decision-making

Automated decision-making or profiling with legal effect within the meaning of Art. 22 GDPR does not take place. Our trade/purchase suggestions are based solely on a comparison of the collections and wishes you have specified and serve exclusively to improve matching.

35. Changes to this Privacy Policy

We adapt this privacy policy when the legal situation or our processing changes (e.g. when new functions are introduced). The current version is always available on this page. In the event of material changes, we will ask you to acknowledge them after your next sign-in: we show you a summary of the changes with a link to the full text and store the version number and the time of your acknowledgement (section 28).

Last updated: 06.09.2026