Privacy Policy
Last updated: March 2026
1. Controller
The controller responsible for data processing on this website is:
Ivana Perbi-Ohlheiser SĂĽdwestkorso 72, 12161 Berlin, Germany Email: info@wardrobeaffaire.com Website: www.wardrobeaffaire.com
2. What Data We Collect and Why
a) When You Create an Account
We collect your name, email address, and a password (encrypted). This data is necessary to provide you with a user account and to manage your listings. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
b) When You Post a Listing
We collect information about your sale or event, including the location or address of the sale. This data is displayed publicly on the platform as part of your listing. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
c) When You Feature a Listing (Paid Promotion)
To process payment for a featured listing, we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland). Payment details such as your card number are entered directly into Stripe's secure form and are never stored on our servers. We receive only confirmation of a successful or failed payment. Stripe processes your payment data under its own privacy policy, available at stripe.com/privacy. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
d) Server Log Files
When you visit our website, our hosting provider automatically collects standard server log data, including your IP address, browser type, pages visited, and timestamps. This data is used solely for technical operation and security purposes and is deleted after 7 days. The legal basis is our legitimate interest in secure and stable website operation (Art. 6(1)(f) GDPR).
e) Contact via Email
If you contact us by email, we store your email address and the content of your message to handle your inquiry. The legal basis is our legitimate interest in responding to communications (Art. 6(1)(f) GDPR).
3. Cookies and Analytics
We use strictly necessary cookies for platform operation, as well as analytics cookies set by our hosting provider Base44 via Google Analytics. Analytics cookies are only placed with your prior consent, which you can give or withdraw via our cookie consent banner. Please see our Cookie Policy for full details.
4. Data Sharing and Processors
We do not sell your data. We share data only with the following third-party processors where necessary:
- Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing for featured listings
- Base44, Inc. (USA) — hosting, platform infrastructure, and built-in analytics via Google Analytics
All processors are bound by data processing agreements in accordance with Art. 28 GDPR.
International Data Transfers:
Base44's servers are located in the United States. Data transferred to Base44 is safeguarded by Standard Contractual Clauses (SCCs) as approved by the European Commission (Art. 46(2)(c) GDPR), and Base44 participates in the EU–US Data Privacy Framework. You can review Base44's Data Processing Addendum at base44.com/dpa.
Google Analytics (via Base44):
Our hosting provider Base44 uses Google Analytics to collect anonymised usage data such as pages visited, session duration, and approximate geographic location based on IP address. This data is processed by Google LLC (USA) and is used solely to improve platform performance. Google Analytics is only activated with your explicit consent. You may withdraw consent at any time via the cookie settings on our website. For more information, see Google's privacy policy at policies.google.com/privacy.
5. Data Retention
We retain your account data for as long as your account is active. If you delete your account, your personal data is erased within 30 days, except where we are legally required to retain certain records (e.g. payment records, which are retained for 10 years under German commercial law — §257 HGB, §147 AO).
6. Your Rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you (Art. 15 GDPR)
- Rectify inaccurate data (Art. 16 GDPR)
- Erase your data ("right to be forgotten") (Art. 17 GDPR)
- Restrict processing of your data (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing based on legitimate interest (Art. 21 GDPR)
To exercise any of these rights, contact us at: info@wardrobeaffaire.com
You also have the right to lodge a complaint with a supervisory authority. The competent authority in Berlin is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61, 10555 Berlin www.datenschutz-berlin.de
7. Data Security
We use SSL/TLS encryption for all data transmitted through this website. Access to user data is restricted and protected by appropriate technical and organisational measures in accordance with Art. 32 GDPR.
8. Changes to This Policy
We may update this Privacy Policy from time to time. The current version is always available at www.wardrobeaffaire.com/privacy-policy. Where changes are significant, we will notify registered users by email.