Privacy Policy

1. Controller

The controller is Piotr Ciechowicz, Schmohlstr. 2, 13086 Berlin, Germany. Email: hello@findused.xyz. No data protection officer has been appointed because the statutory requirements for an appointment do not currently apply.

2. Website hosting and server logs

The application and PostgreSQL database are hosted with Railway Corporation. We selected Railway EU West in Amsterdam, Netherlands, for the application workload and database. When you request a page, technical data such as IP address, date and time, requested path, response status, referrer, browser, and device information may be processed to deliver and secure the service.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are secure, reliable delivery, abuse prevention, troubleshooting, and service integrity. Operational logs are retained only for as long as needed for these purposes and are routinely overwritten according to the hosting plan; incident records may be kept for up to 90 days where necessary to investigate a security or reliability event.

Railway is based in the United States and may use subprocessors. Although the selected compute region is in the EU, limited account, support, security, or service data may be processed outside the EEA under Railway's Data Processing Addendum and applicable transfer safeguards, including Standard Contractual Clauses where required.

3. DNS and email routing

Cloudflare, Inc. provides authoritative DNS and email routing for findused.xyz. Website traffic is configured as DNS-only and is not intentionally proxied through Cloudflare. DNS resolvers and Cloudflare may nevertheless process DNS query and technical security data. Messages sent to hello@findused.xyz are routed to our business mailbox.

4. Google Analytics

If you consent, we use Google Analytics 4, provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Analytics helps us understand page views, sessions, approximate location, referral sources, and browser or device characteristics. Google Analytics uses first-party identifiers such as the _ga cookie. We do not send names, email addresses, or other deliberately identifying form data to Analytics.

Google Analytics is not loaded before you select Accept analytics cookies. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. You may reject analytics without losing access to Findused and may withdraw consent at any time through Privacy settings in the footer. Withdrawal does not affect processing carried out before withdrawal.

User- and event-level data retention in the Analytics property is configured to 2 months. The first-party analytics cookie is configured to expire after no more than 6 months. Google's aggregated standard reports may remain available for longer because the GA4 retention control does not apply to aggregated reporting. Advertising personalisation and Google Signals are not used for this website.

Google may process data outside the EEA. Depending on the destination and service configuration, transfers are covered by an adequacy decision, the EU-US Data Privacy Framework, and/or Standard Contractual Clauses. More information is available in Google's privacy policy and data-processing terms.

5. Contact by email

If you email us, we process your email address, message, attachments, routing metadata, and any other information you provide in order to respond. The legal basis is Article 6(1)(b) GDPR where the message concerns a potential contract or business relationship, and otherwise Article 6(1)(f) GDPR based on our legitimate interest in handling enquiries and keeping appropriate business records.

Ordinary correspondence is deleted or anonymised no later than 12 months after the matter is closed unless statutory retention duties, the establishment or defence of legal claims, or an ongoing business relationship require longer storage.

6. Cookies and local preferences

Findused stores a strictly necessary privacy-choice cookie for up to 6 months so that the website remembers whether analytics was accepted or rejected. This cookie does not track browsing activity. Google Analytics cookies are set only after consent. You can change the choice at any time through Privacy settings.

7. Google Search Console

We use Google Search Console to monitor how the public website is crawled and displayed in Google Search. Verification is performed through DNS. Search Console does not require a Findused tracking script or set a Findused analytics cookie in your browser; Google may provide us with aggregated search and crawler reports.

8. Recipients and processors

Personal data may be available to Railway as hosting processor, Cloudflare as DNS and email-routing provider, Google after analytics consent, our business email provider when you contact us, and professional advisers or authorities where legally required. We do not sell personal data.

9. Your rights

Subject to the applicable conditions, you have rights of access, rectification, erasure, restriction, data portability, and objection. Where processing is based on consent, you may withdraw it at any time. Where processing is based on legitimate interests, you may object for reasons arising from your particular situation. Send requests to hello@findused.xyz.

10. Right to complain

You may lodge a complaint with a data-protection supervisory authority. Our competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de. You may also contact the authority at your habitual residence or workplace.

11. Security and automated decisions

We use appropriate technical and organisational measures designed to protect personal data. No solely automated decision with legal or similarly significant effects is made about website visitors.

12. Changes to this policy

We will update this policy when data practices, providers, or legal requirements change. The current version and date will remain available on this page.