Datenschutzerklärung

UsedLater? Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how personal data is processed when you visit or use UsedLater?, create an account, sign in, submit or update an owner experience, contact us, or otherwise interact with the platform.

The controller responsible for the processing of personal data is:

[LEGAL NAME / BUSINESS NAME]
[POSTAL ADDRESS]
[COUNTRY]
Email: [PRIVACY / CONTACT EMAIL]

1. General principles

We process personal data only where there is a lawful basis and only to the extent necessary for the relevant purpose.

UsedLater? is designed to collect structured long-term product experiences. Individual responses may be combined into aggregate product statistics, rankings, comparisons and badges.

Unless explicitly stated otherwise, owner experiences are self-reported.

2. Visiting the website

When you access UsedLater?, the hosting infrastructure may process technical information necessary to deliver and secure the website.

This may include:

  • IP address;
  • date and time of access;
  • requested URL or resource;
  • referrer information, where transmitted;
  • browser and device information;
  • HTTP status and similar server-log information.

Purpose

This data may be processed to:

  • deliver the website;
  • maintain technical stability and security;
  • detect abuse, attacks and technical errors;
  • troubleshoot the service.

Legal basis

Where processing is necessary to provide the requested website, the legal basis may be Article 6(1)(b) GDPR where the visit forms part of requested services, or Article 6(1)(f) GDPR for legitimate interests in the secure and reliable operation of the website.

Retention

[INSERT HOSTING / SERVER-LOG RETENTION PERIOD]

3. Hosting provider

UsedLater? is hosted by:

[HOSTING PROVIDER]
[PROVIDER ADDRESS / COUNTRY]

The hosting provider may process technical and account-related data on our behalf where necessary to provide the hosting service.

Where required, we use a data-processing agreement with the hosting provider.

If the provider or any subprocessor processes data outside the European Economic Area, the relevant transfer mechanism must be described here:

[INSERT THIRD-COUNTRY TRANSFER INFORMATION, IF APPLICABLE]

4. User accounts

When you create a UsedLater? account, we process the information required to create and manage the account.

Depending on the final account configuration, this may include:

  • email address;
  • username or display name;
  • internal WordPress user ID;
  • password in technically protected / hashed form;
  • account creation and modification timestamps;
  • login and session information;
  • account status.

Purpose

We use this data to:

  • create and manage your account;
  • authenticate you;
  • associate your owner experiences with your account internally;
  • enforce the one-active-response-per-user-and-product rule;
  • prevent duplicate or abusive submissions;
  • enable updates to an existing experience;
  • secure the platform.

Legal basis

The main legal basis is Article 6(1)(b) GDPR where processing is necessary to provide the account and requested platform functions.

Security and abuse-prevention processing may additionally be based on Article 6(1)(f) GDPR, where our legitimate interests are the security, integrity and reliability of UsedLater?.

Retention

Account data is generally retained while the account remains active and thereafter only for as long as necessary for legal, security or technical purposes.

Specific retention periods should be added here once the deletion workflow is final:

[INSERT FINAL ACCOUNT-DELETION / RETENTION RULE]

5. Login and technically necessary cookies

UsedLater? is built on WordPress.

WordPress uses authentication and logged-in cookies to keep registered users signed in and to identify an authenticated session. Depending on the WordPress configuration, additional settings cookies may be used for user-interface preferences.

These cookies are used only where necessary to provide login and account functionality.

A consent banner is not normally required for storage or access that is strictly necessary to provide a digital service expressly requested by the user. Any non-essential analytics, marketing or third-party technologies are handled separately below.

6. Owner experiences and product responses

When you submit or update an owner experience, UsedLater? processes the structured answers you provide.

Depending on the response form, this may include information such as:

  • the product concerned;
  • usage frequency;
  • changes in usage over time;
  • reasons why usage declined;
  • whether you regret the purchase;
  • whether you would buy the product again;
  • internal response identifiers;
  • the internal account-to-response association.

The response system currently uses internal WordPress / platform identifiers so that one account can maintain one active experience per product.

Purpose

We process response data to:

  • save and display your submitted experience where applicable;
  • allow you to update it;
  • calculate aggregate product statistics;
  • calculate comparisons and rankings;
  • determine whether a product qualifies for UsedLater? badges or other long-term signals;
  • protect the integrity of the dataset;
  • detect duplicate or manipulated submissions.

Legal basis

Where you deliberately submit an experience as part of the platform service, processing is generally based on Article 6(1)(b) GDPR.

Integrity, fraud-prevention and abuse-detection measures may be based on Article 6(1)(f) GDPR.

7. Public and aggregate use of owner responses

UsedLater? may combine valid responses into product-level results such as:

  • Regret rate;
  • Would buy again;
  • Still using it;
  • reasons why usage declined;
  • rankings;
  • product comparisons;
  • UsedLater? badges.

These aggregate results are intended to describe patterns across responses rather than expose account credentials or private account data.

If individual responses or free-text contributions are later displayed publicly, this Privacy Policy must be updated to describe exactly which fields are public.

8. Account deletion, response deletion and anonymisation

You may exercise your data-protection rights, including requesting deletion where the legal conditions are met.

The exact technical deletion model for UsedLater? must match this Privacy Policy.

Before launch, the following must be finalised:

  • whether an individual submitted response can be deleted independently;
  • what happens to responses when an account is deleted;
  • whether aggregate product statistics are recalculated;
  • whether any retained data is genuinely anonymised.

Information will only be described as anonymous where it can no longer reasonably be related to an identifiable person.

Genuinely anonymised statistical data is no longer personal data under the GDPR and may remain in aggregate datasets.

[REPLACE THIS SECTION WITH THE FINAL IMPLEMENTED DELETION WORKFLOW BEFORE LAUNCH]

9. Contacting us

If you contact UsedLater? by email or another contact form, we process the information you provide, such as:

  • email address;
  • name, if provided;
  • message contents;
  • any information necessary to respond.

Purpose

The data is used to process and respond to your request.

Legal basis

Depending on the context, processing may be based on:

  • Article 6(1)(b) GDPR for contract-related or pre-contractual enquiries; or
  • Article 6(1)(f) GDPR for other legitimate communication and support requests.

Retention

Contact messages are retained only as long as necessary for the enquiry and any applicable legal documentation requirements.

10. Reports of potentially illegal or rights-infringing content

If you submit a report regarding potentially illegal content or an alleged rights infringement, we may process:

  • your contact details;
  • the content or URL being reported;
  • your explanation and supporting information;
  • communications relating to the report;
  • information necessary to assess and document the report.

The data is processed to assess reports, comply with applicable legal obligations and protect the rights of users and third parties.

The legal basis may include Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation and Article 6(1)(f) GDPR where necessary to protect legitimate interests.

11. Cookies and similar technologies

Strictly necessary technologies

UsedLater? may use technologies that are technically necessary to:

  • operate the website;
  • maintain login sessions;
  • protect forms and sessions;
  • remember strictly necessary security or account state.

These technologies are used without consent only where the legal requirements for strictly necessary storage or access are met.

Analytics, marketing or optional third-party services

At the time this draft was prepared, the final list of optional analytics, marketing, embedded-media and third-party services had not yet been confirmed.

Before launch, this section must list every such service actually used, including:

  • provider;
  • purpose;
  • data processed;
  • cookies / storage used;
  • legal basis;
  • retention;
  • recipients;
  • third-country transfers;
  • how consent can be withdrawn.

If non-essential cookies or similar device access technologies are used, they must not be activated before the required consent is obtained.

[INSERT ACTUAL COOKIE / ANALYTICS / THIRD-PARTY SERVICES OR STATE CLEARLY THAT NONE ARE USED]

12. Recipients and processors

Personal data may be disclosed to service providers only where necessary for operating UsedLater?, such as:

  • hosting providers;
  • technical maintenance providers;
  • email service providers;
  • security or backup providers;
  • other processors actually used by the service.

The final Privacy Policy must identify relevant recipients or categories of recipients and, where appropriate, the specific providers.

[INSERT ACTUAL SERVICE PROVIDERS]

13. International data transfers

If personal data is transferred to a country outside the European Economic Area, UsedLater? will rely on an applicable legal transfer mechanism, such as an adequacy decision or appropriate safeguards where required.

The final Privacy Policy must identify any actual third-country transfers.

[INSERT DETAILS OR STATE THAT NO SUCH TRANSFERS OCCUR]

14. Legal bases at a glance

Depending on the specific processing activity, UsedLater? may rely on:

  • Article 6(1)(b) GDPR — processing necessary to provide requested account and platform functions;
  • Article 6(1)(c) GDPR — processing necessary to comply with a legal obligation;
  • Article 6(1)(f) GDPR — legitimate interests such as platform security, abuse prevention, service stability and protection of legal rights;
  • Article 6(1)(a) GDPR — consent, where optional processing requires consent.

Where processing is based on consent, you can withdraw that consent for the future.

15. Your rights

Subject to the conditions of the GDPR, you may have the right to:

  • obtain information about personal data processed about you;
  • obtain a copy of that data;
  • request correction of inaccurate data;
  • request deletion;
  • request restriction of processing;
  • receive certain data in a portable format;
  • object to processing based on legitimate interests;
  • withdraw consent at any time for future processing;
  • lodge a complaint with a competent data-protection supervisory authority.

To exercise your rights, contact:

[PRIVACY EMAIL]

16. Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing on grounds relating to your particular situation, subject to the conditions in Article 21 GDPR.

17. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority if you believe that the processing of your personal data infringes applicable data-protection law.

The competent supervisory authority depends on the controller’s establishment.

[INSERT COMPETENT GERMAN DATA-PROTECTION AUTHORITY ONCE BUSINESS LOCATION IS FINAL]

18. Data security

We take appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse and alteration.

No internet service can guarantee absolute security.

19. Automated decisions and profiling

UsedLater? automatically calculates product statistics, rankings and badges from submitted response data.

These product-level calculations are not intended to make decisions that produce legal effects or similarly significant effects concerning an individual user.

If this changes, this Privacy Policy must be updated accordingly.

20. Changes to this Privacy Policy

We may update this Privacy Policy when the service, technical infrastructure or legal requirements change.

The current version will be published on UsedLater? with its effective date.

21. Contact

For privacy-related questions:

[LEGAL NAME / BUSINESS NAME]
[ADDRESS]
Email: [PRIVACY EMAIL]