extrus.io
Sign in

Privacy Policy

for the Extrusio online marketplace (extrus.io)

Last updated: October 2026

This is a courtesy translation. The legally binding version is the German Datenschutzerklärung.

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

LT GmbH
Elly-Beinhorn-Str. 12
73760 Ostfildern
Germany

Represented by the Managing Director: Alexander Ide
Commercial register: HRB 768551, Local Court of Stuttgart

Telephone: +49 (0) 7158 980 22 23
E-mail: datenschutz@extrus.io

Data protection officer

LT GmbH is not legally required to appoint a data protection officer. For all data protection matters, please contact us using the details above.

2. General information

2.1 Scope

This privacy policy applies to the website and online marketplace at the domain extrus.io, including all subpages and associated functions. Linked third-party websites are governed by their own privacy policies.

2.2 Legal bases for processing

We process personal data on the following legal bases:

  • Art. 6(1)(a) GDPR – consent: newsletter and any future services requiring consent
  • Art. 6(1)(b) GDPR – contract / pre-contractual measures: user account, publication of listings, messaging function, billing
  • Art. 6(1)(c) GDPR – legal obligation: commercial and tax retention, disclosure to authorities, obligations under the Digital Services Act
  • Art. 6(1)(f) GDPR – legitimate interests: IT security, prevention of misuse and fraud, establishment and defence of legal claims

Where we rely on a legitimate interest, that interest is stated specifically in the relevant section below.

2.3 Recipients and processors

Personal data is disclosed to service providers who support us in operating the Platform. We have concluded agreements pursuant to Art. 28 GDPR with all processors. An overview of the service providers used can be found in section 9.

Beyond this, we disclose data only where you have consented, where we are legally obliged to do so, or where this is necessary for the establishment, exercise or defence of legal claims. We do not sell your data.

2.4 Transfers to third countries

Some of the service providers we use are established in the USA. Transfers take place only on one of the following bases:

  • the adequacy decision of the European Commission of 10 July 2023 for organisations certified under the EU-US Data Privacy Framework (Art. 45 GDPR), or
  • the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR) together with supplementary safeguards, or
  • your express consent (Art. 49(1)(a) GDPR).

We note that, despite these measures, US authorities may under certain conditions access data, and that legal protection fully equivalent to the European level cannot be guaranteed in all cases.

2.5 Retention periods

We store personal data only for as long as necessary for the respective purposes. Data is then deleted unless statutory retention obligations apply. In particular:

  • Invoices and accounting records: 10 years (Section 147 AO, Section 257 HGB)
  • Commercial letters, including contract-related e-mails: 6 years
  • Server log files: see section 4.1
  • User account and listings: until deletion of the account, thereafter subject to the above periods

2.6 Necessity of provision

The publicly accessible areas of the Platform can be used without providing personal data. Registration, publishing listings and using the messaging function require certain data; without it we cannot provide the corresponding services.

3. Your rights as a data subject

You have the following rights regarding your personal data:

  • Access to the data processed (Art. 15 GDPR)
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
  • Objection to processing based on legitimate interests (Art. 21 GDPR)

An informal message to datenschutz@extrus.io is sufficient to exercise these rights.

Withdrawal of consent

You may withdraw consent at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected. An informal message to datenschutz@extrus.io is sufficient.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing purposes, you have the right to object at any time without giving reasons; the data will then no longer be processed for that purpose.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
Telephone: +49 (0) 711 615541-0 · www.baden-wuerttemberg.datenschutz.de

You may also contact the supervisory authority of your habitual residence or place of work.

4. Operation of the website

4.1 Hosting and server log files

The Platform is technically provided by:

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA

Vercel processes on our behalf all data arising from use of the website. We have concluded a data processing agreement with Vercel. Vercel Inc. is certified under the EU-US Data Privacy Framework; transfers to the USA therefore take place on the basis of the European Commission's adequacy decision (Art. 45 GDPR), supplemented by Standard Contractual Clauses.

The domain extrus.io is managed via Neue Medien Münnich GmbH (ALL-INKL.COM), Hauptstraße 68, 02742 Friedersdorf, Germany. Data relating to domain and DNS operation and to the e-mail service is processed there in Germany.

Each time the website is accessed, information transmitted by your browser is automatically recorded (server log files):

  • truncated or full IP address of the requesting device
  • date and time of access
  • name and URL of the file retrieved and volume of data transferred
  • notification of whether retrieval was successful (HTTP status code)
  • browser type and version, operating system and language
  • referrer URL, where transmitted

Purpose: ensuring a smooth connection, guaranteeing system security and stability, defending against attacks, and analysis in cases of misuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the technical provision and protection of the Platform.
Retention: generally 7 days; in the event of security-relevant incidents, until the matter has been resolved.

Log file data is not combined with other data sets to create profiles.

4.2 SSL/TLS encryption

For security reasons, the website uses TLS encryption. You can recognise an encrypted connection by https:// in the address bar and the padlock symbol in your browser.

5. Cookies and consent management

5.1 Principle

We use cookies and comparable technologies on the Platform that store information on your device or access information stored there (e.g. local storage, session storage).

Access to your device takes place

  • without consent where this is strictly necessary in order to provide the service you have expressly requested (Section 25(2) no. 2 TDDDG), and
  • otherwise exclusively with your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

5.2 Strictly necessary storage (no consent required)

  • Session / authentication token — purpose: login to the user account, maintaining the session. Retention: session duration or until logout.
  • CSRF token — purpose: protection against cross-site request forgery. Retention: session duration.
  • Language setting, watchlist — purpose: retaining your selection during and between visits. Retention: up to 12 months.

This storage takes place without consent pursuant to Section 25(2) no. 2 TDDDG because it is strictly necessary in order to provide the service you have expressly requested. We base the associated processing of personal data on Art. 6(1)(b) GDPR.

5.3 No advertising or tracking technologies; cookieless reach measurement

We do not use any cookies for analytics, tracking or advertising purposes. In particular, no cross-site tracking, profiling or integration of advertising networks takes place. Web fonts are served from our own server; no connection to external font providers is established.

To understand how our service is used, we use Vercel Web Analytics, a service of our hosting provider Vercel Inc. (section 4.1). Vercel acts as our processor on the basis of the same data processing agreement as for hosting; the transfer bases named in section 4.1 apply to transfers to the USA. The measurement script is loaded from our own domain and also sends its measurements there; no connection to third-party servers is established.

With each page view the following is transmitted: the address of the page visited without search and filter parameters (the part of the address after "?" is removed in your browser before sending), the previously visited page (referrer) and — derived from the technical connection — country, browser, operating system and device type. So that visitors can be counted within a day, Vercel states that it creates a server-side hash from the request data which expires after 24 hours; the IP address is not stored in the process. We ourselves receive aggregated statistics only.

For this measurement no cookies are set and no information is stored on your device. The measurement script merely checks whether your browser's local storage contains an entry for user attribution; we do not create such an entry and do not use this function. The measurements are not combined with your user account and are not passed on to third parties.

In addition, we use Vercel Speed Insights, likewise a service of Vercel Inc. acting as our processor, to measure how quickly our pages load and respond for you. The measurement script reads the so-called Web Vitals (such as the time until content is first displayed) through your browser's interfaces and sends them to our own domain with each page view. Stored with each measurement are: the page address without search and filter parameters and the corresponding page pattern, the type of network connection (e.g. 4G), browser, operating system and device type, the country derived from the connection, where applicable the page element a measurement relates to, and the time of receipt. According to Vercel, no information is collected that would allow a visit to be traced across several pages or a person to be identified; the IP address is not stored and no cookies are set.

Purpose: determining the reach of our service, the use of individual pages and their loading times, in order to develop it in line with demand.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in a service that meets demand and is easy to use.
Objection: you may object to this processing at any time under Art. 21(1) GDPR (section 3), for example by a message to datenschutz@extrus.io or by blocking the measurement script in your browser or with a browser extension. The platform remains fully usable without this measurement.

Content that does not come from our own servers or from our processors is embedded in only two clearly identified cases, both described in section 7:

  • Bot and abuse protection on the contact form, the quote request form and the registration, sign-in and password reset forms (section 7.3). This check is loaded only when the respective form is opened and is strictly necessary in order for us to accept your enquiry (Section 25(2) no. 2 TDDDG); we do not display a consent banner for it.
  • Videos embedded by sellers on individual dealer profiles (section 7.4). These are loaded only on the dealer profile page concerned.

We do not currently operate a general consent banner.

5.4 Managing cookies in your browser

You can delete or block cookies and local storage content at any time in your browser settings; those settings usually also allow you to block the loading of third-party content such as embedded videos. Please note that in that case individual functions of the Platform, in particular logging in to your user account and submitting our forms, may not be fully usable.

Should we use further services requiring consent in future, we will obtain your consent beforehand via a consent banner and amend this privacy policy accordingly.

6. Processing within the marketplace

6.1 Registration and user account

A user account is required to publish listings and use the messaging function.

Data processed: e-mail address, password (stored exclusively as a cryptographic hash), first and last name; for commercial sellers additionally company name, legal form, address, telephone number, authorised representatives, register number and VAT identification number; further, time of registration, IP address at registration and login times.

Purpose: establishing and performing the user agreement, authentication, communication on contractual matters, prevention of misuse.
Legal basis: Art. 6(1)(b) GDPR; with regard to logging of IP address and login times, Art. 6(1)(f) GDPR (interest in account security and investigation of misuse).
Retention: until deletion of the account; thereafter deletion unless retention obligations apply.

User account data is stored in our database at Supabase (section 6.5).

6.2 Publication of listings

Data processed: all information you provide in the listing, in particular designation, manufacturer, model, year of manufacture, technical data, condition, price, location, photographs, videos and file attachments, together with the associated contact details.

Please note: listings are publicly accessible and may be indexed by search engines. The contact details you provide in the listing are visible to all visitors of the Platform. Please provide only data that you intend to publish.

Purpose: provision of the contractually owed service, namely publication and discoverability of your offer.
Legal basis: Art. 6(1)(b) GDPR.
Retention: until you delete the listing or the user agreement ends. For technical reasons, listings may remain discoverable in search engine caches for a transitional period over which we have no influence.

6.3 Contact and messaging function

Interested parties can send enquiries to sellers via the Platform.

Data processed: name, e-mail address, where applicable telephone number and company, content of the message, time, and the listing concerned.

Purpose: forwarding the enquiry to the respective seller, evidence of communication, prevention and investigation of fraud and misuse.
Legal basis: Art. 6(1)(b) GDPR for forwarding the enquiry; Art. 6(1)(f) GDPR for storage and review for the prevention of misuse.
Retention: 24 months after the last exchange of messages, unless longer retention is required for contractual or commercial law reasons.

Your message is transmitted to the respective seller. That seller becomes an independent controller within the meaning of the GDPR for the subsequent communication and initiation of a contract. The seller's own privacy policy applies to their processing.

Messages are checked automatically, to the extent permitted by law, for indicators of fraud, phishing and spam. This does not involve any automated decision producing legal effects within the meaning of Art. 22 GDPR; flagged cases are reviewed manually.

When the contact form and the quote request form are submitted, we additionally use bot and abuse protection (section 7.3).

6.4 Seller verification

At the request of commercial sellers, we verify identity, commercial register entry and VAT identification number and label the seller as "verified".

Data processed: supporting documents submitted, register extracts, result of the VAT identification number check.
Purpose: increasing security and trust on the marketplace.
Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR with regard to obligations under Regulation (EU) 2022/2065.
Retention: for the duration of the verification; documents submitted are deleted after 6 months at the latest.

6.5 Database and backend (Supabase)

For data storage, authentication and file storage we use:

Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992 (operationally based in San Francisco, USA)

A data processing agreement is in place with Supabase. Our database instance is operated in a data centre region within the European Union. Supabase, Inc. is not certified under the EU-US Data Privacy Framework; any access from third countries, in particular in the context of support and maintenance, therefore takes place on the basis of the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with supplementary technical and organisational measures.

6.6 E-mail dispatch

System messages such as registration confirmations, password resets, notifications of purchase enquiries and invoices are sent via the mail servers of Neue Medien Münnich GmbH (ALL-INKL.COM), Hauptstraße 68, 02742 Friedersdorf, Germany. Processing takes place on servers in Germany; a data processing agreement is in place.

Legal basis: Art. 6(1)(b) GDPR.

Please note that the content of unencrypted e-mails may be read by third parties in transit. For confidential information we recommend postal mail or encrypted transmission.

6.7 Billing of chargeable services (from 1 January 2027)

Use of the Platform is free of charge until 31 December 2026. From 1 January 2027, published listings are subject to a fee.

Data processed: billing address, VAT identification number, package booked, payment data, invoice and payment history.
Purpose: contract performance, invoicing, compliance with commercial and tax obligations.
Legal basis: Art. 6(1)(b) and (c) GDPR.
Retention: 10 years after the end of the calendar year of invoicing.

7. Third-party services embedded

As a rule, we deliver the content of our pages from our own servers or via our processors. In particular, we do not use:

  • any third-party web analytics or reach measurement services (for the cookieless reach measurement by our hosting provider, see section 5.3)
  • any advertising networks, tracking pixels or social media plugins
  • any externally hosted web fonts

Third-party content is loaded in only the two cases described below: the bot and abuse protection on our forms (section 7.3) and videos that individual sellers have embedded in their own profile (section 7.4). Neither is loaded on every page, only where described.

7.1 Web fonts

The fonts used on the Platform are served locally from our own server. No connection to third-party servers is established when a font is loaded and no IP address is transmitted to third parties.

7.2 Delivery of images from object storage

Photographs and file attachments belonging to listings are delivered from the object storage of our backend service provider Supabase (see section 6.5). For technical reasons, your IP address is transmitted to that provider when an image is retrieved. In this respect Supabase acts as a processor exclusively on our instructions; it does not use the data for its own purposes.

Legal basis: Art. 6(1)(b) GDPR (display of the listings you have accessed).

7.3 Bot and abuse protection (Cloudflare Turnstile)

To protect against automated access, bulk enquiries and spam, we use the Turnstile service on the contact form, on the quote request form and on the registration, sign-in and password reset forms.

Provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA

When one of these forms is opened, the verification widget is loaded from the provider's servers (challenges.cloudflare.com); your IP address is transmitted to the provider in the process. Turnstile evaluates technical characteristics of your browser and of your interaction with the form in order to distinguish whether the input is made by a human or automatically, and generates a single-use verification token from this. After the form is submitted, that token is transmitted server-side to the provider again for confirmation — by our server for the contact and quote request forms, and by our authentication service provider Supabase for registration, sign-in and password reset (section 6.5). The provider may store information on your device or access information stored there in order to carry out the check. According to the provider, the data collected is not used for advertising purposes and not for cross-site recognition.

Without this check we cannot accept messages sent via those forms. In addition, we protect our forms on the server side through rate limiting and plausibility checks.

Purpose: defence against automated bulk enquiries and against spam and fraud attempts via our forms.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in keeping our contact and enquiry functions operational and free of misuse. Storing information on, or accessing information stored on, your device is strictly necessary in order to provide the service you have expressly requested — the transmission of your enquiry (Section 25(2) no. 2 TDDDG).
Third-country transfer: we base transfers to the USA on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the provider's data processing agreement.

For details of the processing by the provider, please see their privacy policy.

7.4 Videos embedded by sellers

Commercial sellers can add an introductory video to their dealer profile. Only videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA) are permitted.

Such a video is displayed only on the dealer profile page concerned and only where that seller has added a video. When you open such a profile page, your browser establishes a connection to the video provider's servers; your IP address and technical information about your browser and device are transmitted to the provider in the process. The provider may store information on your device or access information stored there and use it for its own purposes; if you are logged in with that provider, it may associate the retrieval with your account there. We have no influence on the nature and extent of that processing; in this respect the video provider is an independent controller.

Purpose: complete display of the profile as designed by the respective seller.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in displaying seller profiles completely and unaltered.
Third-country transfer: the transfer is made directly by your browser to the respective provider; a transfer to the USA is possible in the process.

If you wish to avoid this connection, do not open the dealer profile page concerned, or block third-party content in your browser settings. For details of the processing by these providers, please see their privacy policies: Google/YouTube and Vimeo.

7.5 Invisible bot check (Vercel BotID)

In addition to Turnstile, we check registrations, contact messages and quote requests with Vercel BotID, a service of our hosting provider Vercel Inc. (section 4.1), which acts as our processor in this respect.

Only when you send something to our server on the sign-in and registration page, the contact page or a listing page — for example by submitting a form — does your browser load a check script from our own domain, which forwards the requests to Vercel. The script solves an automatically generated computational challenge and evaluates technical characteristics of your browser in the process; the result is sent to our server with the request. For the three forms named above, our server has it confirmed by Vercel. Vercel then merely tells us whether the input came from a human or was automated. The check is invisible to you and requires no input. No cookies are set and no information is stored permanently on your device; access to characteristics of your browser is strictly necessary for transmitting your enquiry.

Purpose: defence against automated registrations, bulk enquiries and spam and fraud attempts via our forms.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in keeping our forms operational and free of misuse. Accessing information on your device is strictly necessary in order to provide the service you have expressly requested (Section 25(2) no. 2 TDDDG).
Third-country transfer: the bases named in section 4.1 apply.

8. Newsletter and advertising

Where we offer a newsletter, registration takes place using the double opt-in procedure: after entering your e-mail address you receive a confirmation e-mail with which you confirm the registration. We log registration and confirmation as evidence.

Legal basis: Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG.
You can unsubscribe at any time via the unsubscribe link in every e-mail or by message to datenschutz@extrus.io.

As an existing customer, we may send you information about our own similar services to the e-mail address collected upon conclusion of a contract, pursuant to Section 7(3) UWG. You may object to this use at any time without incurring costs other than transmission costs at base rates.

9. Overview of service providers used

Processors acting on our behalf:

  • Vercel Inc., USA — hosting and delivery of the website, cookieless reach and loading-time measurement (section 5.3), and invisible bot checks (section 7.5). Processing in an EU region, support from the USA. Transfer basis: EU-US Data Privacy Framework, supplemented by Standard Contractual Clauses.
  • Supabase, Inc. — database, authentication, file storage. Processing in an EU region. Transfer basis: Standard Contractual Clauses.
  • Neue Medien Münnich GmbH (ALL-INKL.COM) — domain, DNS, e-mail dispatch. Processing in Germany. No third-country transfer.
  • Cloudflare, Inc., USA — bot and abuse protection (Turnstile) on the contact form, the quote request form and the registration, sign-in and password reset forms (section 7.3). Processing across the provider's global network, including in the USA. Transfer basis: Standard Contractual Clauses.

Data processing agreements pursuant to Art. 28 GDPR are in place with all of the above providers.

Independent controllers whose content may be embedded:

  • Google Ireland Limited (YouTube) and Vimeo.com, Inc. — exclusively on dealer profile pages where the seller concerned has embedded a video (section 7.4).

Apart from the cases set out above, we do not embed any external services that establish a connection to third parties when the page is accessed (see section 7).

10. Automated decision-making and profiling

No automated decision-making, including profiling, producing legal effects or similarly significantly affecting you within the meaning of Art. 22 GDPR takes place.

The order in which listings appear in search results is determined algorithmically. We have disclosed the relevant parameters in Section 9 of our Terms and Conditions. No personalisation based on a user profile takes place.

Automated checks for the detection of fraud and spam do not lead directly to suspension; flagged cases are reviewed manually before any measure is taken. The bot check described in section 7.3 relates solely to the submission of individual forms and does not involve any decision about you as a person.

11. Security of processing

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction, manipulation and unauthorised access. These include in particular transport encryption, encryption of data at rest, access restrictions based on the principle of least privilege, password hashing in line with the state of the art, logging of administrative access and regular updating of the systems used.

12. Changes to this privacy policy

We update this privacy policy whenever changes to our processing activities or to the legal situation make this necessary. The version published on this page applies. In the case of material changes affecting processing based on your consent, we will obtain your consent again.

LT GmbH · Elly-Beinhorn-Str. 12 · 73760 Ostfildern · Germany
Managing Director: Alexander Ide · HRB 768551, Local Court of Stuttgart
Imprint · Terms

Last updated: October 2026