Privacy Policy

for the Extrusio online marketplace (extrus.io)

Last updated: August 2026

This is a courtesy translation. The legally binding version is the German Datenschutzerklärung.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

LT GmbH
Elly-Beinhorn-Str. 12
73760 Ostfildern
Germany

Represented by the Managing Director: Alexander Ide
Commercial register: HRB 768551, Local Court of Stuttgart

Telephone: +49 (0) 7158 980 22 23
E-mail: datenschutz@extrus.io

Data protection officer

LT GmbH is not legally required to appoint a data protection officer. For all data protection matters, please contact us using the details above.

2. General information

2.1 Scope

This privacy policy applies to the website and online marketplace at the domain extrus.io, including all subpages and associated functions. Linked third-party websites are governed by their own privacy policies.

2.2 Legal bases for processing

We process personal data on the following legal bases:

Art. 6(1)(a) GDPR – consent: newsletter and any future services requiring consent
Art. 6(1)(b) GDPR – contract / pre-contractual measures: user account, publication of listings, messaging function, billing
Art. 6(1)(c) GDPR – legal obligation: commercial and tax retention, disclosure to authorities, obligations under the Digital Services Act
Art. 6(1)(f) GDPR – legitimate interests: IT security, prevention of misuse and fraud, establishment and defence of legal claims

Where we rely on a legitimate interest, that interest is stated specifically in the relevant section below.

2.3 Recipients and processors

Personal data is disclosed to service providers who support us in operating the Platform. We have concluded agreements pursuant to Art. 28 GDPR with all processors. An overview of the service providers used can be found in section 9.

Beyond this, we disclose data only where you have consented, where we are legally obliged to do so, or where this is necessary for the establishment, exercise or defence of legal claims. We do not sell your data.

2.4 Transfers to third countries

Some of the service providers we use are established in the USA. Transfers take place only on one of the following bases:

the adequacy decision of the European Commission of 10 July 2023 for organisations certified under the EU-US Data Privacy Framework (Art. 45 GDPR), or
the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR) together with supplementary safeguards, or
your express consent (Art. 49(1)(a) GDPR).

We note that, despite these measures, US authorities may under certain conditions access data, and that legal protection fully equivalent to the European level cannot be guaranteed in all cases.

2.5 Retention periods

We store personal data only for as long as necessary for the respective purposes. Data is then deleted unless statutory retention obligations apply. In particular:

Invoices and accounting records: 10 years (Section 147 AO, Section 257 HGB)
Commercial letters, including contract-related e-mails: 6 years
Server log files: see section 4.1
User account and listings: until deletion of the account, thereafter subject to the above periods

2.6 Necessity of provision

The publicly accessible areas of the Platform can be used without providing personal data. Registration, publishing listings and using the messaging function require certain data; without it we cannot provide the corresponding services.

3. Your rights as a data subject

You have the following rights regarding your personal data:

Access to the data processed (Art. 15 GDPR)
Rectification of inaccurate or incomplete data (Art. 16 GDPR)
Erasure (Art. 17 GDPR)
Restriction of processing (Art. 18 GDPR)
Data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
Objection to processing based on legitimate interests (Art. 21 GDPR)

An informal message to datenschutz@extrus.io is sufficient to exercise these rights.

Withdrawal of consent

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected. An informal message to datenschutz@extrus.io is sufficient.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Where your data is processed for direct marketing purposes, you have the right to object at any time without giving reasons; the data will then no longer be processed for that purpose.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Telephone: +49 (0) 711 615541-0 · www.baden-wuerttemberg.datenschutz.de

You may also contact the supervisory authority of your habitual residence or place of work.

4. Operation of the website

4.1 Hosting and server log files

The Platform is technically provided by:

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA

Vercel processes on our behalf all data arising from use of the website. We have concluded a data processing agreement with Vercel. Vercel Inc. is certified under the EU-US Data Privacy Framework; transfers to the USA therefore take place on the basis of the European Commission's adequacy decision (Art. 45 GDPR), supplemented by Standard Contractual Clauses.

The domain extrus.io is managed via Neue Medien Münnich GmbH (ALL-INKL.COM), Hauptstraße 68, 02742 Friedersdorf, Germany. Data relating to domain and DNS operation and to the e-mail service is processed there in Germany.

Each time the website is accessed, information transmitted by your browser is automatically recorded (server log files):

truncated or full IP address of the requesting device
date and time of access
name and URL of the file retrieved and volume of data transferred
notification of whether retrieval was successful (HTTP status code)
browser type and version, operating system and language
referrer URL, where transmitted

Purpose: ensuring a smooth connection, guaranteeing system security and stability, defending against attacks, and analysis in cases of misuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision and protection of the Platform.
Retention: generally 7 days; in the event of security-relevant incidents, until the matter has been resolved.

Log file data is not combined with other data sets to create profiles.

4.2 SSL/TLS encryption

For security reasons, the website uses TLS encryption. You can recognise an encrypted connection by https:// in the address bar and the padlock symbol in your browser.

5. Cookies and consent management

5.1 Principle

We use cookies and comparable technologies on the Platform that store information on your device or access information stored there (e.g. local storage, session storage).

Access to your device takes place

without consent where this is strictly necessary in order to provide the service you have expressly requested (Section 25(2) no. 2 TDDDG), and
otherwise exclusively with your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

5.2 Strictly necessary storage (no consent required)

Session / authentication token — purpose: login to the user account, maintaining the session. Retention: session duration or until logout.
CSRF token — purpose: protection against cross-site request forgery. Retention: session duration.
Language setting, watchlist — purpose: retaining your selection during and between visits. Retention: up to 12 months.

This storage takes place without consent pursuant to Section 25(2) no. 2 TDDDG because it is strictly necessary in order to provide the service you have expressly requested. We base the associated processing of personal data on Art. 6(1)(b) GDPR.

5.3 No tracking, analytics or advertising technologies

We do not use any cookies or comparable technologies for analytics, tracking or advertising purposes. In particular, no reach measurement, cross-site tracking, profiling or integration of advertising networks takes place. Web fonts are served from our own server; no connection to external font providers is established.

Content that does not come from our own servers or from our processors is embedded in only two clearly identified cases, both described in section 7:

Bot and abuse protection on the contact form and the quote request form (section 7.3). This check is loaded only when the respective form is opened and is strictly necessary in order for us to accept your enquiry (Section 25(2) no. 2 TDDDG); we do not display a consent banner for it.
Videos embedded by sellers on individual dealer profiles (section 7.4). These are loaded only on the dealer profile page concerned.

We do not currently operate a general consent banner.

5.4 Managing cookies in your browser

You can delete or block cookies and local storage content at any time in your browser settings; those settings usually also allow you to block the loading of third-party content such as embedded videos. Please note that in that case individual functions of the Platform, in particular logging in to your user account and submitting our forms, may not be fully usable.

Should we use further services requiring consent in future, we will obtain your consent beforehand via a consent banner and amend this privacy policy accordingly.

6. Processing within the marketplace

6.1 Registration and user account

A user account is required to publish listings and use the messaging function.

Data processed: e-mail address, password (stored exclusively as a cryptographic hash), first and last name; for commercial sellers additionally company name, legal form, address, telephone number, authorised representatives, register number and VAT identification number; further, time of registration, IP address at registration and login times.

Purpose: establishing and performing the user agreement, authentication, communication on contractual matters, prevention of misuse.
Legal basis: Art. 6(1)(b) GDPR; with regard to logging of IP address and login times, Art. 6(1)(f) GDPR (interest in account security and investigation of misuse).
Retention: until deletion of the account; thereafter deletion unless retention obligations apply.

User account data is stored in our database at Supabase (section 6.5).

6.2 Publication of listings

Data processed: all information you provide in the listing, in particular designation, manufacturer, model, year of manufacture, technical data, condition, price, location, photographs, videos and file attachments, together with the associated contact details.

Please note: listings are publicly accessible and may be indexed by search engines. The contact details you provide in the listing are visible to all visitors of the Platform. Please provide only data that you intend to publish.

Purpose: provision of the contractually owed service, namely publication and discoverability of your offer.
Legal basis: Art. 6(1)(b) GDPR.
Retention: until you delete the listing or the user agreement ends. For technical reasons, listings may remain discoverable in search engine caches for a transitional period over which we have no influence.

6.3 Contact and messaging function

Interested parties can send enquiries to sellers via the Platform.

Data processed: name, e-mail address, where applicable telephone number and company, content of the message, time, and the listing concerned.

Purpose: forwarding the enquiry to the respective seller, evidence of communication, prevention and investigation of fraud and misuse.
Legal basis: Art. 6(1)(b) GDPR for forwarding the enquiry; Art. 6(1)(f) GDPR for storage and review for the prevention of misuse.
Retention: 24 months after the last exchange of messages, unless longer retention is required for contractual or commercial law reasons.

Your message is transmitted to the respective seller. That seller becomes an independent controller within the meaning of the GDPR for the subsequent communication and initiation of a contract. The seller's own privacy policy applies to their processing.

Messages are checked automatically, to the extent permitted by law, for indicators of fraud, phishing and spam. This does not involve any automated decision producing legal effects within the meaning of Art. 22 GDPR; flagged cases are reviewed manually.

When the contact form and the quote request form are submitted, we additionally use bot and abuse protection (section 7.3).

6.4 Seller verification

At the request of commercial sellers, we verify identity, commercial register entry and VAT identification number and label the seller as "verified".

Data processed: supporting documents submitted, register extracts, result of the VAT identification number check.
Purpose: increasing security and trust on the marketplace.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR with regard to obligations under Regulation (EU) 2022/2065.
Retention: for the duration of the verification; documents submitted are deleted after 6 months at the latest.

6.5 Database and backend (Supabase)

For data storage, authentication and file storage we use:

Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992 (operationally based in San Francisco, USA)

A data processing agreement is in place with Supabase. Our database instance is operated in a data centre region within the European Union. Supabase, Inc. is not certified under the EU-US Data Privacy Framework; any access from third countries, in particular in the context of support and maintenance, therefore takes place on the basis of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with supplementary technical and organisational measures.

6.6 E-mail dispatch

System messages such as registration confirmations, password resets, notifications of purchase enquiries and invoices are sent via the mail servers of Neue Medien Münnich GmbH (ALL-INKL.COM), Hauptstraße 68, 02742 Friedersdorf, Germany. Processing takes place on servers in Germany; a data processing agreement is in place.

Legal basis: Art. 6(1)(b) GDPR.

Please note that the content of unencrypted e-mails may be read by third parties in transit. For confidential information we recommend postal mail or encrypted transmission.

6.7 Billing of chargeable services (from 1 January 2027)

Use of the Platform is free of charge until 31 December 2026. From 1 January 2027, published listings are subject to a fee.

Data processed: billing address, VAT identification number, package booked, payment data, invoice and payment history.
Purpose: contract performance, invoicing, compliance with commercial and tax obligations.
Legal basis: Art. 6(1)(b) and (c) GDPR.
Retention: 10 years after the end of the calendar year of invoicing.

7. Third-party services embedded

As a rule, we deliver the content of our pages from our own servers or via our processors. In particular, we do not use:

any web analytics or reach measurement services
any advertising networks, tracking pixels or social media plugins
any externally hosted web fonts

Third-party content is loaded in only the two cases described below: the bot and abuse protection on our forms (section 7.3) and videos that individual sellers have embedded in their own profile (section 7.4). Neither is loaded on every page, only where described.

7.1 Web fonts

The fonts used on the Platform are served locally from our own server. No connection to third-party servers is established when a font is loaded and no IP address is transmitted to third parties.

7.2 Delivery of images from object storage

Photographs and file attachments belonging to listings are delivered from the object storage of our backend service provider Supabase (see section 6.5). For technical reasons, your IP address is transmitted to that provider when an image is retrieved. In this respect Supabase acts as a processor exclusively on our instructions; it does not use the data for its own purposes.

Legal basis: Art. 6(1)(b) GDPR (display of the listings you have accessed).

7.3 Bot and abuse protection (Cloudflare Turnstile)

To protect against automated access, bulk enquiries and spam, we use the Turnstile service on the contact form and on the quote request form.

Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

When the contact form is opened, or when the quote request form is opened, the verification widget is loaded from the provider's servers (challenges.cloudflare.com); your IP address is transmitted to the provider in the process. Turnstile evaluates technical characteristics of your browser and of your interaction with the form in order to distinguish whether the input is made by a human or automatically, and generates a single-use verification token from this. After the form is submitted, we transmit that token from our server to the provider again for confirmation. The provider may store information on your device or access information stored there in order to carry out the check. According to the provider, the data collected is not used for advertising purposes and not for cross-site recognition.

Without this check we cannot accept messages sent via those forms. In addition, we protect our forms on the server side through rate limiting and plausibility checks.

Purpose: defence against automated bulk enquiries and against spam and fraud attempts via our forms.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in keeping our contact and enquiry functions operational and free of misuse. Storing information on, or accessing information stored on, your device is strictly necessary in order to provide the service you have expressly requested — the transmission of your enquiry (Section 25(2) no. 2 TDDDG).
Third-country transfer: we base transfers to the USA on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the provider's data processing agreement.

For details of the processing by the provider, please see their privacy policy.

7.4 Videos embedded by sellers

Commercial sellers can add an introductory video to their dealer profile. Only videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA) are permitted.

Such a video is displayed only on the dealer profile page concerned and only where that seller has added a video. When you open such a profile page, your browser establishes a connection to the video provider's servers; your IP address and technical information about your browser and device are transmitted to the provider in the process. The provider may store information on your device or access information stored there and use it for its own purposes; if you are logged in with that provider, it may associate the retrieval with your account there. We have no influence on the nature and extent of that processing; in this respect the video provider is an independent controller.

Purpose: complete display of the profile as designed by the respective seller.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in displaying seller profiles completely and unaltered.
Third-country transfer: the transfer is made directly by your browser to the respective provider; a transfer to the USA is possible in the process.

If you wish to avoid this connection, do not open the dealer profile page concerned, or block third-party content in your browser settings. For details of the processing by these providers, please see their privacy policies: Google/YouTube and Vimeo.

8. Newsletter and advertising

Where we offer a newsletter, registration takes place using the double opt-in procedure: after entering your e-mail address you receive a confirmation e-mail with which you confirm the registration. We log registration and confirmation as evidence.

Legal basis: Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG.
You can unsubscribe at any time via the unsubscribe link in every e-mail or by message to datenschutz@extrus.io.

As an existing customer, we may send you information about our own similar services to the e-mail address collected upon conclusion of a contract, pursuant to Section 7(3) UWG. You may object to this use at any time without incurring costs other than transmission costs at base rates.

9. Overview of service providers used

Processors acting on our behalf:

Vercel Inc., USA — hosting and delivery of the website. Processing in an EU region, support from the USA. Transfer basis: EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.
Supabase, Inc. — database, authentication, file storage. Processing in an EU region. Transfer basis: Standard Contractual Clauses.
Neue Medien Münnich GmbH (ALL-INKL.COM) — domain, DNS, e-mail dispatch. Processing in Germany. No third-country transfer.
Cloudflare, Inc., USA — bot and abuse protection (Turnstile) on the contact form and the quote request form (section 7.3). Processing across the provider's global network, including in the USA. Transfer basis: Standard Contractual Clauses.

Data processing agreements pursuant to Art. 28 GDPR are in place with all of the above providers.

Independent controllers whose content may be embedded:

Google Ireland Limited (YouTube) and Vimeo.com, Inc. — exclusively on dealer profile pages where the seller concerned has embedded a video (section 7.4).

Apart from the cases set out above, we do not embed any external services that establish a connection to third parties when the page is accessed (see section 7).

10. Automated decision-making and profiling

No automated decision-making, including profiling, producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR takes place.

The order in which listings appear in search results is determined algorithmically. We have disclosed the relevant parameters in Section 9 of our Terms and Conditions. No personalisation based on a user profile takes place.

Automated checks for the detection of fraud and spam do not lead directly to suspension; flagged cases are reviewed manually before any measure is taken. The bot check described in section 7.3 relates solely to the submission of individual forms and does not involve any decision about you as a person.

11. Security of processing

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. These include in particular transport encryption, encryption of data at rest, access restrictions based on the principle of least privilege, password hashing in line with the state of the art, logging of administrative access and regular updating of the systems used.

12. Changes to this privacy policy

We update this privacy policy whenever changes to our processing activities or to the legal situation make this necessary. The version published on this page applies. In the case of material changes affecting processing based on your consent, we will obtain your consent again.

LT GmbH · Elly-Beinhorn-Str. 12 · 73760 Ostfildern · Germany
Managing Director: Alexander Ide · HRB 768551, Local Court of Stuttgart
Imprint · Terms

Last updated: August 2026