Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

We collect and process the following personal data:

• Account data: email address, username, profile picture (optional), password (hashed)
• Usage data: pages visited, search queries, product comparisons, clicks on affiliate links, time and duration of visit
• Community data: reviews, comments, posts, points
• Technical data: IP address, browser type and version, operating system, device type, screen resolution, referrer URL
• Cookie data: authentication tokens, theme preferences, cookie consent preferences

We process your personal data for the following purposes and on the following legal bases:

Our website uses cookies. Cookies are small text files stored on your device.

We only share your personal data with third parties in the following cases:

• Hosting provider: Railway Corporation (USA) operates our server infrastructure. Railway processes data as a processor on our behalf.
• Affiliate networks: When clicking affiliate links, data (click ID, timestamp) is transmitted to the respective affiliate networks (e.g. Amazon, Awin, Impact) -- only with your consent.
• Web analytics: We use Umami (self-hosted) for anonymized web analytics. No personal data is shared with external analytics services.
• Legal obligation: Where we are legally obligated to do so (Art. 6(1)(c) GDPR).

Our server infrastructure is operated by Railway Corporation (San Francisco, USA). The transfer of personal data to the USA is based on the EU-US Data Privacy Framework (DPF), Art. 45 GDPR (adequacy decision of the European Commission of July 10, 2023).

Where recipients are not covered by the DPF, we use the Standard Contractual Clauses (SCCs) of the European Commission pursuant to Art. 46(2)(c) GDPR as an appropriate safeguard.

We only store your personal data for as long as is necessary for the respective purposes:

• Account data: Until you delete your account, then promptly deleted (unless legal retention obligations apply).
• Community posts: Until deleted by you or us. After account deletion, posts are anonymized.
• Server log files (incl. IP addresses): Maximum 30 days, then automatically deleted.
• Analytics data: Stored anonymized, no personal reference after collection.
• Cookie consent decision: 12 months, then re-prompted.
• Affiliate tracking data: In accordance with the retention periods of the respective affiliate networks (typically 30--90 days).

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about your personal data stored by us.
• Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate or completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You can request the deletion of your personal data, provided no legal retention obligations apply.
• Right to restriction of processing (Art. 18 GDPR): You can request the restriction of processing of your data.
• Right to data portability (Art. 20 GDPR): You can request to receive your data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21 GDPR): You can object to the processing of your personal data at any time, insofar as the processing is based on Art. 6(1)(f) GDPR (legitimate interest).
• Right to withdraw consent (Art. 7(3) GDPR): You can withdraw any given consent at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal remains unaffected.

To exercise your rights, contact us at: info@machinefinder.org

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data is unlawful.

Note for users in Germany: You may alternatively contact your local state data protection authority (Landesdatenschutzbeauftragte).

For questions about data protection or to exercise your rights, please contact: