Privacy Policy

Last updated: 28 May 2026

1. Controller

The controller responsible for processing personal data on this platform is:

zekahub IT-Dienstleistungen

Email: info@shop-billiard.com

2. General information

This Privacy Policy explains which personal data is processed when you use Billardshop.

Billardshop is a platform for product listings, seller profiles and direct communication between users. The platform operator does not provide checkout, payment processing or shipping services unless explicitly stated otherwise.

3. Access data and server logs

When the platform is accessed, technically necessary access data is processed. This may include:

• IP address,
• date and time of access,
• requested URL,
• HTTP status code,
• browser and device information,
• referrer URL,
• technical error and security information.

The data is processed to provide the platform, maintain system security, analyse errors and prevent misuse.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the platform.

4. Registration and user account

If you create a user account, we process the data required for registration, login and account management. This may include:

• name or display name,
• email address,
• password in encrypted form,
• roles and permissions,
• account status,
• registration and update timestamps.

The data is processed to create and manage your user account and provide protected functions.

The legal basis is Art. 6(1)(b) GDPR. Where security or evidence requirements are involved, Art. 6(1)(f) GDPR may also apply.

5. Seller profile

If you become active as a seller, we additionally process data relating to your seller profile. This may include:

• seller display name,
• seller profile description,
• approval status,
• approval timestamp,
• moderation status.

This data is processed so that you can list products and interested users can contact you.

The legal basis is Art. 6(1)(b) GDPR. For moderation and security purposes, the legal basis is Art. 6(1)(f) GDPR.

6. Product listings, variants and images

If you list products, we process the product data you enter. This may include:

• product name, description, brand and category,
• variants such as size, colour, price and stock,
• product images,
• assignment to the seller profile,
• listing status,
• moderation status and internal administration data.

Product listings and public seller information may be visible to visitors of the platform.

The legal basis is Art. 6(1)(b) GDPR. For moderation, misuse prevention and security, the legal basis is Art. 6(1)(f) GDPR.

7. Chat and communication between users

If you use the chat function, we process the data required for communication. This may include:

• chat participants,
• reference to a product,
• message content,
• message timestamps,
• unread-message status.

The chat function is used for direct communication between interested users and sellers. Please only share data in the chat that is necessary for the communication.

The legal basis is Art. 6(1)(b) GDPR.

8. Wishlist

If you add products or variants to your wishlist, we store the association between your user account and the saved product variant.

The legal basis is Art. 6(1)(b) GDPR.

9. Reporting listings and moderation

Logged-in users can report listings. When a report is submitted, we process in particular:

• the reported listing,
• the reporting user,
• the affected seller,
• reason for the report,
• report text,
• report status,
• internal admin note,
• processing timestamp,
• the admin or moderator handling the report.

The report is treated confidentially. The reported seller is not automatically told which user submitted the report.

Moderation decisions may result in a listing or seller profile being blocked. The listing or seller is not automatically deleted; the decision remains stored so that it can be traced.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in reviewing reported content, securing the platform, preventing misuse and enforcing our terms of use. Where legal obligations are involved, Art. 6(1)(c) GDPR may apply.

10. Cookies and similar technologies

We use necessary cookies and similar technologies for login, security, CSRF protection, session management and storing your cookie decision.

Optional categories such as analytics, marketing, personalisation or external media are used only if they are technically enabled and you have given your consent.

Further information can be found in our Cookie Information.

11. Email communication

We may send you emails where this is necessary for your account, registration, security, system notifications, moderation or other platform functions.

We send newsletters or promotional emails only where separate consent or another legal basis exists.

Depending on the content, the legal basis is Art. 6(1)(b), (c) or (f) GDPR. Where consent is given voluntarily, the legal basis is Art. 6(1)(a) GDPR.

12. Recipients and service providers

Personal data may be transferred to technical service providers where necessary for operation, hosting, maintenance, email delivery, security or support.

Where service providers process personal data on our behalf, we enter into the required data processing agreements.

Data is disclosed to third parties only where this is necessary for platform functionality, you have consented, a legal obligation applies, or we are permitted to rely on legitimate interests.

13. Transfers to third countries

Personal data is transferred to countries outside the European Union or the European Economic Area only where an appropriate legal basis and the required safeguards are in place.

If external services such as analytics, marketing, map or media providers are integrated in the future, this Privacy Policy will be updated accordingly.

14. Retention period

We store personal data only for as long as necessary for the relevant purposes.

User account data is generally stored for as long as the account exists. Product listings, chat data, reports and moderation data may remain stored after restriction or suspension where necessary for evidence, security, misuse prevention, legal defence or statutory obligations.

Statutory retention periods remain unaffected.

15. Your rights

Subject to the statutory requirements, you have the following rights:

• right of access,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to data portability,
• right to object to processing based on legitimate interests,
• right to withdraw consent with effect for the future.

To exercise your rights, you can contact us using the contact details above.

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law.

17. Security

We implement technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unauthorised alteration.

18. Changes to this Privacy Policy

We may update this Privacy Policy if legal, technical or organisational changes occur.