Privacy policy

1. Controller

Rcado
Julien Lieske
c/o Autorenglück #62015
Albert-Einstein-Str. 47
02977 Hoyerswerda
Deutschland

Email: kontakt@rcado.de

No data protection officer has been appointed, as the legal requirements for this are not met. For any questions about data protection, you can reach us at the email address given above.

2. What this is about

Rcado is a catalogue and marketplace for RC gear: private individuals list used items, retailers maintain their range, visitors compare prices. We only act as an intermediary; we don’t process payments. You can use a lot without an account (catalogue, search, viewing listings, checking the theft register, reporting content). You need an account to post listings, write messages, save items and use search alerts.

3. Hosting and security

The application, database and uploaded photos are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in a data centre in Nuremberg (Germany). We run the software ourselves; the provider only supplies the infrastructure and is contractually bound as a processor (Art. 28 GDPR). The legal basis is Art. 6(1)(b) and (f) GDPR (providing the service, secure and reliable operation).

The connection is encrypted with TLS. There is no password that could be stolen; login links work only once. We create backups on the server regularly and delete them after a short time.

4. Accessing the pages and log data

When you access the site, our server automatically processes:

• IP address, date and time of the request
• the requested address, HTTP method, status code and amount of data transferred
• browser and operating system (user agent)

We need this to deliver the pages, find errors and fend off attacks (Art. 6(1)(f) GDPR). We don’t combine the logs with other data and overwrite them continuously.

To protect against abuse, we limit logins, messages, reports and uploads. For this, the server briefly counts requests per account, email address or IP address in memory; the counters are discarded after a short time (Art. 6(1)(f) GDPR).

To prevent fraud, new listings and the first message to a seller only work with a connection from the EU, Norway, Iceland, Liechtenstein or Switzerland and not via VPN, Tor or data centres. For this, at the moment you post or write, the server checks your IP address against lists on our own server: country per address range (DB-IP, CC BY 4.0), known VPN and data-centre networks (X4BNet), Tor exit nodes (Tor Project) and Apple’s iCloud Private Relay egress addresses. The IP address is not passed on to anyone and is not stored; we only count how often per day something was blocked and for what reason (Art. 6(1)(f) GDPR, protecting users from fraud).

5. Cookies and browser storage (no tracking)

We don’t set cookies for advertising or tracking and don’t embed third-party analytics or advertising services. Only what is needed for the service you request is stored:

• Session cookie (rcm_session): keeps you logged in for up to 30 days and is extended when you use the site. It is deleted when you log out.
• Your browser’s local storage: saved items, list or grid view, recent search terms, your chosen location (postcode) and, if you log in only to write a message, your draft. This data doesn’t leave your browser unless you use a feature that needs it.

This is strictly necessary for the service you request (Section 25(2) No. 2 TDDDG) and doesn’t require consent, which is why there is no cookie banner. You can delete the data at any time in your browser settings; you’ll then need to log in again.

Anonymous access figures: On our server we count how often AI crawlers and assistants request page types, without IP address, user agent, URL or any personal reference. For retailers we count per offer and day how often it was shown as an ad and clicked, also without any personal reference (Art. 6(1)(f) GDPR).

6. Account and login

For an account we process your email address, a display name and the times of registration and login. New accounts are initially called “Nutzer” (user) with a number; you can change the name. Others see your display name in your listings and messages, but never your email address. You log in with a link we send you by email; it is valid for 15 minutes and only once. A session ends when you log out or are inactive for 30 days.

The legal basis is Art. 6(1)(b) GDPR (user relationship). We store the data as long as the account exists. You can delete your account yourself at any time in your profile: this permanently removes your listings including photos, your conversations and search alerts (Art. 17 GDPR). What remains afterwards is described in section 12.

7. Seller profile

Anyone who posts listings has a public seller profile so that buyers can judge who they are dealing with. It shows your display name, the month and year since which your account has existed, the number of listings that have been online so far, the number currently online and those reported as sold, as well as your current listings. Once there are enough enquiries, it also shows your response rate: the share of enquiries in the last 90 days that you answered within seven days, and the typical time to reply in rough steps. We calculate this from the timestamps of the messages without analysing their content. Your email address, location and messages never appear there. We count these figures ourselves; you can’t change them. The profile can be viewed without logging in but is not made available to search engines. You choose the display name yourself and can pick a different one at any time (for example just your first name); the profile disappears when you delete your account. The legal basis is Art. 6(1)(b) and (f) GDPR (trust between the contracting parties, protection against fraud).

8. Posting listings

For a listing we store the title, description, condition, price, shipping method, photos and the link to a catalogue product. Listings are public, can be viewed without logging in and can be indexed by search engines. A listing expires after 60 days; shortly before, we remind you by email. Afterwards the page remains available as “sold” or “expired” so the price history isn’t lost.

• Photos: On upload we remove metadata such as the location where the photo was taken (EXIF) and store resized versions.
• Location: You enter a postcode. We only store the approximate centre of that postcode with a random offset of about 2 km, never your address.
• Serial number: For transmitters, receivers and turbines we require a photo of the info screen. We only store the serial number as an irreversible hash and never display it; it is used to check against the theft register.
• Contact details in the text: We automatically hide email addresses, phone numbers and messenger IDs in the title and description. Contact goes through our messages.
• Automatic pre-check: Every listing is checked against fixed rules when posted and changed (prohibited items, serial number in the register, unusual prices). A listing can be rejected automatically; suspicious listings are reviewed by a human. You can request a manual review (Art. 22(3) GDPR).

The legal basis is Art. 6(1)(b) GDPR and, for the pre-check, (f) (protection against abuse and stolen goods).

9. Messages, blocking and search alerts

We store messages between buyers and sellers until the listing or one of the two accounts is deleted. If you don’t read a message within 15 minutes, we send you an email with the sender, listing and an excerpt; the next one only once you’ve read the conversation. You can block users; we store the block, and the blocked person isn’t told. Messages and listings can be reported; moderation then reads the reported message (section 11).

When a message is sent, the server automatically checks the text against fixed rules, without a human and without profiling: if a message mentions contact details (email, phone number, messenger ID) or words relating to payment and messengers, we only store a “show notice” flag on the message; both sides then see a notice in the conversation. Accounts in their first 2 days after registration can’t send contact details or links; these are hidden before saving and only the cleaned version is stored. For this we compare the registration date with the current date. The legal basis is Art. 6(1)(f) GDPR (protection against fraud and abuse). In the conversation you also see since when the other side has been a member and how many listings they have had online (section 7).

With a search alert we store your search criteria and email you new matching listings at the frequency you chose. You can delete it at any time. The legal basis is Art. 6(1)(b) GDPR.

10. Theft register

Anyone can check serial numbers, even without an account; the answer is “no entry” or “reported stolen”. Anyone registering devices or reporting a theft provides the serial number, for a theft the date and place, and optionally a police reference number. We store the serial number as a hash. Only you and moderation see the details. A report is a claim, not an established fact; those affected can object to it (see terms). The legal basis is Art. 6(1)(b) and (f) GDPR (protection against trading in stolen goods).

11. Reports and moderation

Anyone reporting content (Art. 16 DSA) provides a reason and explanation; without an account also an email address to which we send confirmation of receipt and the decision. We process the report, the reported content and our decision including the statement of reasons (Art. 17 DSA), which the affected person also receives. We keep the moderation log to keep decisions traceable and to identify repeat offenders (Art. 6(1)(c) and (f) GDPR).

12. Sale reports and price statistics

If you mark a listing as sold, you can voluntarily enter the final price. We store it with the product, time and a rough region (the first two digits of the postcode), not with your account. From such reports we calculate the price figures on product pages, never as an individual sale and only from a minimum number (see How our prices work). This anonymous sales data is kept even after your account is deleted; it can no longer be linked to you (legitimate interest in reliable price statistics, Art. 6(1)(f) GDPR).

13. Retailers

When registering, retailers provide company name, address, VAT identification number, contact details and shop address, and supply offer data via a product feed. Shop name, address and offers are public. To match offers to catalogue products, a language model from Anthropic (Anthropic, PBC, USA) may compare offer titles and catalogue names; no user data is transmitted, and the model never changes the catalogue itself. If someone clicks on a retailer offer, we forward them to the shop via our address and count the click without any personal reference. Once you switch to the shop, its privacy policy applies.

14. Sending emails

We send system emails (login link, reminders about expiring listings, messages, search alerts, decisions on reports) via the mail server of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur (processor, servers in Germany). The recipient address and the content of the message are processed. We don’t send advertising or newsletters.

15. External content and links

We serve fonts, icons and photos ourselves; your browser doesn’t connect to third parties for them. Links to shops and other sites only open the respective service when you click on them; their privacy policies apply there.

16. Recipients and third countries

We don’t sell data and don’t pass it on for advertising purposes. The only recipients are the processors named, the competent authorities in case of suspected criminal offences, and, within the platform, other users as part of your listings and messages. Transfers to countries outside the EU only take place when matching retailer offers (section 13), and then without any user data. There is no profiling or automated decision-making with legal effect within the meaning of Art. 22 GDPR; you can have the automatic rejection of prohibited items reviewed manually.

17. Your rights

You have the right to

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

To do so, write to us at kontakt@rcado.de. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), or in the Member State of your habitual residence, place of work or the alleged infringement.

18. Changes

We adapt this policy when the service or the legal situation changes. The version published here applies.