Privacy Policy

The controller responsible for data processing on this platform is:

FurtherSales GmbH

Upstalsboom 20

28259 Bremen

Germany

Managing Director: Fabiola Kleppe-Nava

Commercial Register: HRB 42127, Amtsgericht Bremen

VAT ID: DE459040752

Email: info@furthersales.com

Platform: https://www.furthersales-network.com

Corporate Website: https://www.furthersales.de

FurtherSales Network is operated using the technical platform provider Base44 (base44.com). Base44 provides the following core services:

• Application hosting and runtime environment

• Database operation and data storage

• User authentication and session management

• File storage (logos, images, documents)

• Execution of server-side backend functions

A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Base44. Base44 acts exclusively as a processor and processes personal data only on our documented instructions.

Further information: https://base44.com | DPA: https://base44.com/dpa

As FurtherSales Network operates on the infrastructure of Base44, a US-based provider, personal data may be transferred to and processed in the United States. This applies in particular to data stored in the platform database, authentication data, uploaded files, and server-side processing results.

Transfer Mechanism

These transfers are carried out on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to Art. 46(2)(c) GDPR. SCCs are a legally recognised mechanism for ensuring an adequate level of data protection when transferring personal data to third countries that do not have an adequacy decision from the European Commission.

Scope of the Transfer

The following categories of data may be affected by transfers to the US:

• Dealer account and profile data

• User authentication data

• Uploaded files (logos, images)

• Contact inquiry data

• Email dispatch and delivery data processed via Brevo (EU-based, Paris, France)

Protective Measures

In addition to the SCCs, the following protective measures are in place:

• Encryption of all data in transit using TLS/SSL

• Encryption of data at rest

• Access restricted to authenticated and authorised personnel only

• Role-based permissions limiting access to personal data

Note on Data Residency

By default, data is stored on US-based Base44 servers. As soon as EU-region storage becomes the configured option for our workspace, this section will be updated accordingly. We continuously monitor infrastructure options to reduce third-country transfers.

If you have questions about international data transfers or wish to obtain a copy of the applicable SCCs, please contact us at info@furthersales.com.

FurtherSales Network operates an international directory of used machinery dealers. Dealers can publish and maintain a public profile on the platform.

The following data may be published in a public dealer profile:

• Company name, logo, and description

• Website and social media links

• Contact person, phone number, and email address

• Business address

• Brands and product categories

• Photo galleries

• Countries and regions served

This data is either provided directly by the dealer or compiled from publicly available business information and subsequently confirmed by the dealer.

Public dealer profiles may continue to be stored even if the associated user account is no longer actively used, provided there is a legitimate interest in displaying publicly available company information. Affected companies may at any time request review, update, or deletion of their dealer profile.

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in operating a verified B2B dealer network).

Dealers can create and manage user accounts on the platform. The following data is processed for this purpose:

• Name and email address

• Password (stored in encrypted form)

• User role

• Timestamps of registration and account changes

Retention: Account data is retained for as long as the account remains active. Upon deletion, account data is removed within 30 days, subject to any statutory retention obligations.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

The platform allows dealers to claim ownership of a pre-created dealer profile. The following data is processed during this procedure:

• Email address

• Claim token (secure, time-limited)

• Timestamp of claim request and expiry

• Claim status

• IP address (server logs)

Retention: Claim invitation data is retained for 12 months after dispatch or rejection.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in preventing unauthorised profile takeovers).

Visitors can submit contact inquiries to dealers via the platform. When a contact request is submitted, it is forwarded to the relevant dealer. The dealer acts as an independent controller for any further processing of that inquiry. FurtherSales has no influence over the further processing of data by the respective dealer.

The following data is processed:

• Name

• Email address

• Message content

• Any voluntarily provided contact details

Retention: Contact request data is retained for up to 24 months for business correspondence purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in facilitating B2B contact) or Art. 6(1)(a) GDPR (consent).

Dealers can upload files to personalise their public profiles. The following types of files may be stored:

• Company logos

• Profile and contact person photos

• Gallery images

• Cover images

Uploaded files are stored via Base44's file storage infrastructure and are publicly accessible as part of the dealer's profile. Files are retained for as long as the dealer profile is active. Upon profile deletion, associated files are removed accordingly.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in profile presentation).

FurtherSales uses Brevo (formerly Sendinblue), operated by Brevo SAS, 55 rue d'Amsterdam, 75008 Paris, France, for sending transactional emails.

This includes in particular:

• Profile claiming invitations

• Confirmation emails

• Password reset emails

• System notifications

The following data is processed by Brevo:

• Email address

• Sending and delivery status

A data processing agreement pursuant to Art. 28 GDPR has been concluded with Brevo. Brevo acts solely as a processor and does not use this data for its own purposes. Brevo is EU-based and data is processed within the European Union.

Further information: https://www.brevo.com/legal/privacypolicy/

To ensure the delivery and proper functioning of our communication processes, we log technical information about the sending and delivery of emails.

Where technically available, information about delivery status, email retrieval, and the use of links contained in emails may be processed. Processing is carried out exclusively for the purposes of quality assurance, system security, error analysis, and improvement of our communication processes. This data is not used for advertising purposes or to create individual user profiles.

Retention: Email log data is retained for up to 6 months.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in maintaining reliable and secure communication systems).

When you visit this website, our servers automatically collect technically necessary log data. This includes:

• IP address

• Browser type and version

• Operating system

• Date and time of access

• Pages accessed and files requested

• Referring URL

This data is used exclusively for technical operation, security monitoring, and error diagnosis. It is not merged with other personal data and is deleted after a maximum of 30 days.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the platform).

This website currently uses only technically necessary cookies. These are required for the platform to function correctly (e.g., session management and language preferences).

No marketing cookies, tracking pixels, or advertising-related cookies are currently used. A cookie consent banner is therefore not required at this time.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse:

• Transport encryption: All data transmissions are encrypted using TLS/SSL.

• Encryption at rest: Stored data is encrypted at the infrastructure level.

• Authentication: Access to the platform requires authenticated user accounts with secure credentials.

• Role-based permissions: Access to personal data is restricted based on user roles. Dealers can only access their own data; administrators access is logged and limited.

• Audit logging: Security-relevant actions are recorded in an internal audit log to detect and prevent misuse.

• Processor controls: All third-party processors are bound by data processing agreements and subject to regular review.

Personal data is deleted as soon as the purpose for which it was collected no longer applies, unless statutory retention obligations require longer storage. The following specific retention periods apply:

• User accounts: Retained for as long as the account is active. Deleted within 30 days of account termination.

• Dealer profiles: Retained while the dealer relationship is active or a legitimate interest in displaying publicly available business information exists. Deletion on request, unless statutory retention obligations or overriding legitimate interests apply.

• Contact requests: Retained for up to 24 months for business correspondence.

• Claim invitations: Retained for 12 months after dispatch or rejection.

• Email logs: Retained for up to 6 months for quality assurance and error diagnosis.

• Server logs: Deleted after a maximum of 30 days.

• Uploaded files: Deleted upon profile or account deletion.

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — You may request information about the personal data we process about you.

• Right to rectification (Art. 16 GDPR) — You may request the correction of inaccurate data.

• Right to erasure (Art. 17 GDPR) — You may request the deletion of your personal data where no legal obligation requires its retention.

• Right to restriction (Art. 18 GDPR) — You may request that processing of your data be restricted in certain circumstances.

• Right to data portability (Art. 20 GDPR) — You may request to receive your data in a structured, machine-readable format.

• Right to withdraw consent (Art. 7(3) GDPR) — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

• Right to lodge a complaint — You have the right to lodge a complaint with a supervisory authority. The competent authority for FurtherSales GmbH is:

Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen

Arndtstraße 1, 27570 Bremerhaven

www.datenschutz.bremen.de

To exercise your rights, please contact us at: info@furthersales.com

If you contact us directly — for example by emailing info@furthersales.com — the personal data you provide (name, email address, message content) will be processed solely for the purpose of handling your inquiry and any follow-up communication.

This data is not passed on to third parties unless this is necessary for processing your request.

Retention: Correspondence data is retained for as long as necessary to process your inquiry and for a reasonable follow-up period, and in any case in accordance with applicable statutory retention obligations.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries) or Art. 6(1)(b) GDPR where the inquiry relates to a contractual relationship.

FurtherSales Network is a B2B platform exclusively intended for companies and commercial users. The platform does not knowingly address or collect personal data from minors. If we become aware that personal data of a minor has been submitted without appropriate authorisation, we will delete it without undue delay.

No automated decision-making within the meaning of Art. 22 GDPR takes place on this platform. No decisions with legal or similarly significant effects are made solely on the basis of automated processing of personal data.

We reserve the right to update this Privacy Policy to reflect changes in legal requirements or our services. The current version is always available on this page. We recommend checking this page periodically. The version history at the top of this page documents all material changes.