Privacy policy

This English version is for reading only. The German version is the binding one: Datenschutzerklärung.

What data we process, for what purpose, for how long, and what rights you have.

---

1. Who the controller is

The controller responsible for the processing of your data is:

PartABoat
Owner: Ekkehard Körbel
Am Würzgarten 12
65375 Oestrich-Winkel
Germany

Phone: +49 179 4653016
Email: ek@partaboat.com

2. There is no data protection officer

We have not appointed a data protection officer because the statutory requirements for doing so are not met: fewer than twenty persons at our business are constantly engaged in the automated processing of personal data (§ 38(1) sentence 1 of the German Federal Data Protection Act (BDSG)). Contact the address given above in all data protection matters; it is read by the person responsible personally.

3. Your rights

You have the following rights against us:

• Access to information on whether and what data we process about you (Art. 15 GDPR). This also includes the notes we make in conversations with you.
• Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR).
• Erasure (Art. 17 GDPR). Where we are obliged to retain data or need it to defend against a claim, we tell you so and give the reason.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR), meaning the handing over of the data you have given us in a commonly used format. This right applies to data we process on the basis of your consent or to perform a contract with you, not to data we base on a legitimate interest.
• Withdrawal of consent with effect for the future, if we have your consent (Art. 7(3) GDPR).
• Complaint to a supervisory authority (Art. 77 GDPR). The choice is yours: you can contact the authority of your place of residence, your place of work or the place of the alleged infringement. The authority competent for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Wilhelmstraße 7, 65185 Wiesbaden, phone 0611 1408 0, poststelle@datenschutz.hessen.de.

You will receive a reply within one month. Free of charge, except in the case of manifestly unfounded or excessive requests.

4. Your right to object

You can object to the processing of your data insofar as we base it on a legitimate interest (Art. 6(1)(f) GDPR). Grounds relating to your particular situation are sufficient for this; you must state them but not prove them (Art. 21(1) GDPR). We then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the assertion or defence of legal claims.

This concerns sections 5 to 8, 11, 14 to 16 and 18 to 20, in each case insofar as we base the processing there on Art. 6(1)(f) GDPR. A message to the address in section 1 is sufficient; no form is prescribed.

5. When you visit this site or send us an email

With every visit your browser transmits data to our server without which a page cannot be delivered: your IP address, the date and time, the address requested, the page previously visited, if your browser sends it, as well as browser and operating system.

We also operate our mail server ourselves. For every incoming and outgoing message it records from which address it went to which, when, via which system and with what delivery status. This is necessary so that mail can be delivered at all and junk mail can be fended off. What your message says is not part of this; section 7 applies to that.

Purpose:

Delivering the page, delivering email, stability of operation, detecting and investigating attacks and faults.

Legal basis:

Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free operation of the website and the mail server.

Storage period:

14 days, for both logs. If a security incident occurs, the entries concerned remain stored until it has been investigated.

We do not evaluate this data in order to recognise you, and we do not combine it with other data.

From these logs our server produces visitor statistics: which pages are viewed, which website you came from, from which country and with what type of device. They show us which content is read and how visitors find us. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving the site. The reports are accessible only to us.

6. What we store on your device

This site manages without a consent banner, and not because we have left one out, but because we store nothing that would need one.

We embed no analytics tools, no advertising networks, no maps and no videos. The visitor statistics in section 5 are produced solely on our server. Your page views are not reported to third parties. Nothing is loaded that contacts a server other than ours.

When you read, exactly one thing is stored on your device, and if you are signed in, a second:

Our software sets the session identifier on every page, even if you only read, because sign-in and forms can be reached from every page and the protection of the forms depends on it. It contains no information about you, ends when you close the browser and is based on § 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act (TDDDG).

Legal basis for storage on the device:

§ 25(2) no. 2 TDDDG. The storage is strictly necessary for us to provide the service you have expressly requested; we do not need consent for this.

Legal basis for the subsequent processing:

Art. 6(1)(f) GDPR, legitimate interest in functioning operation.

If we ever change this and want to store something that is not strictly necessary, we will ask you beforehand, and you can say no without the site working any worse for you.

7. Contact form and email

If you write to us via the contact form or by email, we process your name, your email address, the content of your message and the date and time of receipt.

Purpose:

Handling and answering your enquiry.

Legal basis:

Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at a contract with us or prepares one; otherwise Art. 6(1)(f) GDPR, with our legitimate interest in answering enquiries and being able to prove that they were handled.

Storage period:

three months after your enquiry has been dealt with, if it leads to neither a contract nor a user account. If either of the two comes about, the period in the relevant section applies. Statutory retention obligations remain unaffected.

Providing your data:

voluntary. Without an address to which we can reply, however, we cannot answer your enquiry.

For enquiries about a specific listed boat, section 14 applies in addition.

8. Proof sent to us without being requested

We need no medical certificates, no attestations and no other proof from you, and we do not request them. There is one exception in section 19: if your details partly match an entry on a sanctions list, we may ask you for proof in order to clarify this. If you otherwise send us proof, we deal with it as follows:

We do not read its content, do not add it to a case, do not pass it on and delete it without undue delay, including from the recycle bin. A note remains in the case recording that an unrequested document was received and deleted without evaluation of its content, with sender, date of receipt and time of deletion. We do not record what kind of document it was. If the same message contains a declaration that matters legally, such as a withdrawal, we keep only this declaration with the time of its receipt.

Legal basis of this procedure: Art. 6(1)(f) GDPR. Our legitimate interest is to get rid of data that we did not request and do not need as quickly as possible.

This does not put you at any disadvantage. Please do not send us such documents; if you have done so, you do not need to do anything further.

9. Accounting and statutory retention

If you conclude a contract with us, we process your invoicing and payment data for accounting purposes.

Legal basis:

Art. 6(1)(b) GDPR for the performance and Art. 6(1)(c) GDPR for the retention.

Storage period:

the statutory retention periods of commercial and tax law, meaning ten years for financial statements and records, eight years for accounting vouchers including invoices and payment receipts, and six years for business letters. The period begins in each case at the end of the year in which the document was created or received by us. As long as the tax office may still assess or amend a tax for which a document is relevant, we also keep the document beyond this period (§ 147(3) sentence 5 of the German Fiscal Code (AO)). During this time the data is blocked for the original purpose and is held only to fulfil the retention obligation.

10. Recipients of your data

We pass on your data only where this is necessary for the purpose described or where we are obliged to do so. Recipients are:

• the operator of the data centre in which our servers are located, Welcome 2 Inter.Net, owner Bernd Mößinger, Schießhüttenstraße 35, 60386 Frankfurt am Main, as processor under Art. 28 GDPR, bound by our instructions. We operate the website and mail server ourselves. A web service provider helps us with the maintenance and further development of the website, who for this purpose has access to the administration of the website and can see your data in doing so, as processor under Art. 28 GDPR, bound by our instructions;
• the seller of a boat, namely in three cases: if we establish contact with them for your concern; at the end of their listing, or at their request earlier, in a list of the prospective buyers whose names they already know through us; and if we assert a claim against them arising from the documented contact; all to the extent of section 14;
• prospective buyers, if you list a boat and we establish contact between you for a viewing or a conversation: they learn your name and the details you release for this, such as a phone number or the berth; to the extent of section 15;
• other prospective buyers of the same boat, if both you and they agree: they learn your name and your email address; to the extent of section 14;
• the parties to a reporting procedure, to the extent of section 18: the lister learns which content has been reported and why, and the name of the reporting person only if this is strictly necessary; the reporting person learns our decision;
• Anthropic Ireland, Limited, Dublin, Ireland, provider of the AI assistant Claude, as a controller in its own right, to the extent of section 11;
• our tax advisers, insofar as transactions have to be recorded for tax purposes;
• lawyers, courts and authorities, if we are obliged to do so or have to assert or defend against a claim.

Beyond this we do not pass on your data. We do not sell data, and we do not run any advertising for which we give data to third parties.

11. Transfers to third countries

In principle we process your data within the European Union. One exception: to handle messages, enquiries and documents we use the AI assistant Claude from Anthropic Ireland, Limited, Dublin. In doing so, content containing your details may go to Anthropic. Anthropic processes it as a controller in its own right under its privacy policy, not as our processor, and in doing so, by its own account, also transfers it to servers in the USA; Anthropic bases such transfers on adequacy decisions of the European Commission and on standard contractual clauses (Arts. 45 and 46 GDPR). We have switched off the use of the content for training its AI models in our account; Anthropic names exceptions, for example for security reviews, in its privacy policy.

Purpose:

To handle messages, enquiries and documents promptly and completely.

Legal basis:

Art. 6(1)(f) GDPR; our legitimate interest is, as a small business, to handle your concerns promptly and completely with technical help. You can object under section 4.

Storage period:

with us for as long as provided for by the section to which the message or document belongs, for emails for example section 7; with Anthropic in accordance with its privacy policy.

12. No automated decision about you

With us there is no decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you, and no profiling within the meaning of Art. 22 GDPR.

13. Changes to this policy

If what we do with your data changes, we change this policy. The version in force at any given time is on this page and bears its date. As of: 9 November 2026.

14. Enquiry about a listed boat

If you make an enquiry about a specific boat via a listing, this gives rise to two separate data records, which are kept for different lengths of time.

First, the content of your enquiry: your name, your contact details, your free text and the information about which boat you mean. We use it to handle your enquiry. Your enquiry stays with us for the time being; it is not automatically forwarded to the seller. If contact with the seller is necessary for your concern, for example for a viewing, we establish it. The legal basis is Art. 6(1)(b) GDPR, because your enquiry prepares a contract. We delete the free text three months after the enquiry has been dealt with.

Introducing you to other prospective buyers. In our reply to your enquiry we ask whether we may introduce you to other prospective buyers of the same boat. If you agree, we give your name and email address to the other prospective buyers who have also agreed, and you receive theirs. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time; a message to the address in section 1 is enough. What we have passed on until then is not affected. Your consent applies to this one boat; we keep it with your enquiry and delete it together with it (section 7).

The software that provides the enquiry form also stores your IP address for 24 hours. We need it for the limit under § 9(4) of the terms of use, so that nobody floods the form with enquiries; it is then deleted. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is an enquiry channel that remains open to everyone.

Second, the documentation of the contact. We broker between you and the seller and receive our commission only if a purchase comes about through this contact. So that we can prove that a contact ran through us, we record a minimal data record: your name, the date, the type of contact and the boat concerned. Nothing more, in particular not your free text and not your financial details. We create this data record only once the seller has concluded a brokerage agreement with us; before then it does not arise. If the seller concludes the agreement only after your enquiry, we create it from your enquiry, as long as that is still stored with us.

Legal basis:

Art. 6(1)(f) GDPR. Our legitimate interest is proof of the contact we brokered. We have weighed up and documented why this interest overrides your interests here; the data record is small, it is kept separately from everything else, and it is not evaluated.

Storage period:

If the seller has not learned your name through us by the end of their listing, we delete the data record at the end of the listing, not already when they merely pause it. Otherwise the data record remains until the follow-on period of the brokerage agreement has expired, plus the period of 14 days within which a seller must report a completed sale to us, and a checking buffer of 30 days. The follow-on period is six months from the end of the listing, and twelve months if you are documented by name and at least one viewing organised or accompanied by us, a recorded initial conversation or a group meeting organised by us has taken place. We then delete. We keep a data record for longer only if a completed sale has been reported for it or a contact has been disputed; it then remains in a blocked file until the matter is resolved, at most until limitation.

What the seller learns:

At the end of their listing the seller receives a list of the prospective buyers whose names they already know through us, with the date and type of contact and the day on which the follow-on period for this contact ends; if they ask for it in text form, also earlier. The purpose is the same as for the documentation, proof of the contact we brokered: the seller is to know for which prospective buyers they must report a completed sale to us. They do not receive your free text, your contact details or attachments. If we assert a claim on the basis of the documentation, we disclose it to them.

You can object to this documentation under Art. 21(1) GDPR (see section 4). It is based on a legitimate interest, not on consent and not on an obligation.

15. Your listing as a seller

If you list a boat, we process your contact details, the information about the boat, your asking price, your declaration that you are selling as a private person, and your statement of how many owners the boat has.

Purpose:

Displaying the listing, brokerage, and the correct classification of your role, because this determines what consumer protection rights a buyer has against you; the number of owners, so that we know whose consent or power of attorney we need before you conclude.

Legal basis:

Art. 6(1)(b) GDPR for the publication of your listing under the terms of use and, if you have concluded a brokerage agreement with us, for the brokerage; for the declaration as a private person and the classification that depends on it, additionally Art. 6(1)(f) GDPR, with our legitimate interest in being able to prove, in the event of a dispute, what statement you made.

Storage period:

The listing data remains as long as your listing exists and, if you have concluded a brokerage agreement with us, as long as it runs. The details that matter in the event of a dispute remain until the end of the third year after the year in which the listing or the agreement ended; in the event of an ongoing dispute, longer.

The listing shows your information about the boat and the note that you have declared to us that you are offering as a private person; if you are selling a share in a boat, it also states how many owners the boat has today. Your contact details do not appear there; enquiries go through us. If we establish contact with a prospective buyer for a viewing or a conversation, they learn your name and the details you release for this (Art. 6(1)(b) GDPR). If you list as a broker for a client, the listing shows, instead of your declaration as a private person, the note “On behalf of the client (private person)”; we do not publish the name and place of residence of your client that you give us.

For information about people in your listing we are joint controllers with you (Art. 26 GDPR). Before we activate a listing, we therefore review it for information about the health, origin, religious or political beliefs or sex life of a person and for information about persons other than you, such as names or recognisable faces in photos. Such information must come out before the listing appears. Anyone wishing to assert their rights because of the information in a listing should contact us at the address in section 1.

16. Your user account

If you create an account, we process your sign-in data, your name, your email address and the cases managed in your account.

Purpose:

Sign-in and management of your cases.

Legal basis:

Art. 6(1)(b) GDPR; for the security logs of the account, meaning sign-in attempts and changes to the access credentials, Art. 6(1)(f) GDPR, with our legitimate interest in protecting your account from unauthorised access and detecting misuse.

Storage period:

until you delete the account or the last contractual relationship has ended. If your contract of use ends, we block your account and delete your saved boats; the account then serves only as proof that, and on what terms, the contract existed, and to reach you if someone brings claims against us because of content you posted (§ 8(4) of the terms of use). The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest is to be able to prove the contract and to involve you in such a case. We delete the account at the end of the third year after the year of termination, unless a statutory retention obligation or an open claim stands in the way. We delete the security logs after 30 days. If you do not complete the registration because you do not click the confirmation link, we delete your details after 30 days.

Your agreement to the terms of use. On registration you agree to our terms of use. We record this: your user ID, the date and time, the version of the terms of use and a checksum identifying exactly this text; we keep the text of each version for this purpose. The software that provides our forms also records your agreement, with the identifier of your session at the time, your name and username and a copy of the terms of use.

Purpose:

to be able to prove that, and in which version, the terms of use apply between you and us.

Legal basis:

Art. 6(1)(f) GDPR; our legitimate interest is to be able to prove, in the event of a dispute, which terms you agreed to.

Storage period:

until the end of the third year after the year in which your contract of use with us ends; longer for as long as a claim is asserted or disputed. If you delete your account, the entry remains until then and serves only as this proof. If you do not complete the registration, we delete it with your other details after 30 days.

Your saved boats. In your account you can save listings. For this we store which listing you have saved and assign it to your account; no further data arises in the process. Nobody but you sees your saved boats.

Purpose:

You can find a listing again later without searching for it again.

Legal basis:

Art. 6(1)(b) GDPR; saved boats are a function of your account.

Storage period:

until you remove the listing from your saved boats, and otherwise until your account is blocked or deleted; we then delete your saved boats too.

17. When you withdraw from a contract

If you use the “Withdraw from a contract” button in the footer, we process your name, the information about which contract you are withdrawing from, your information on how we can identify it, the email address for the confirmation of receipt and the date and time of receipt.

Purpose:

to accept your withdrawal, to confirm receipt to you and to be able to prove when it reached us.

Legal basis:

Art. 6(1)(b) GDPR for the winding-up of the contract from which you are withdrawing; Art. 6(1)(c) GDPR insofar as § 356a(4) of the German Civil Code (BGB) requires us to confirm receipt.

Storage period:

until the end of the third year after the year in which your withdrawal reached us. The reason is the burden of proof: we must be able to prove when a withdrawal period began and ended, and the standard limitation period for this is three years from the end of the year. Statutory retention obligations remain unaffected, and as long as a claim is asserted or disputed, retention lasts longer.

Providing your data:

required. Without this information we cannot assign your withdrawal to a contract or confirm receipt to you.

We do not store your IP address in this process. We do not need it for the receipt of your withdrawal, and what we do not need, we do not collect.

Withdrawal via this button is only one of several ways. If you write us an email or a letter instead, section 7 applies.

18. When you report content

If you consider content on our platform to be illegal, you can report it to us, via the “Report content” button on every listing or by any other means. We then process what you state: the type of report, the address of the page, your reasons and your declaration that your information is correct and complete. In addition there are the date and time of receipt, a case number and our notes on the handling. We process your name and your email address only if you give them. If your report concerns a criminal offence against the sexual self-determination of children and young people, we do not ask for either.

Purpose:

to handle your report and decide on the content, to confirm receipt to you and notify you of our decision, and to be able to prove how we dealt with the report.

Legal basis:

Art. 6(1)(c) GDPR in conjunction with Art. 16 of the Digital Services Act, which obliges us to handle reports, confirm their receipt and notify the decision. For retention after the end of the case, Art. 6(1)(f) GDPR, with our legitimate interest in being able to prove to you and to the lister how we decided.

Recipients:

If we hear the lister, they learn which content has been reported and why, but not your name and not your email address. We give them your name only if this is strictly necessary for them to defend themselves against a measure (Art. 17(3)(b) Digital Services Act). If a report gives rise to a suspicion of a criminal offence that endangers the life or safety of a person, we must inform the law enforcement authorities and make the available information available to them (Art. 18 Digital Services Act).

Storage period:

until the end of the third year after the year in which the case ends. The reason: anyone affected by our decision on a report can take action against it, and the standard limitation period for this is three years from the end of the year. As long as a claim is asserted or disputed, retention lasts longer.

Providing your data:

voluntary. We also handle your report without a name and email address; without them, however, we can neither confirm receipt to you nor notify you of our decision.

We do not store your IP address in this process. We do not need it to handle your report.

This applies to every way in which a report reaches us. If you write us an email, this section applies to it and not section 7.

If content of yours is reported, we process the report, the reported content, your statement and our decision for the same purpose, on the same legal basis and for the same period. This data comes in part from the person who made the report. You learn of the report when we hear you or take a measure; our statement of reasons then also tells you whether the measure goes back to a report.

19. Check against sanctions lists

Before we publish your listing and before we perform a contract with you, we check your name against the sanctions lists of the European Union; as long as a case is running, including in the 90 days after the handover of the boat, additionally once a month. We do not do this voluntarily: it is prohibited to make funds or economic resources available to the persons named there, and this prohibition applies to everyone. The check is the only way in which we can comply with it. If a broker offers a client’s boat, we also check the name of this owner; in that case we have the name and place of residence from the broker, not from the owner, and they appear nowhere on the website.

What we process:

your name, your date of birth, if it is needed to tell persons apart, and your country. Nothing more goes into the check. If we have to clarify whether you are the person meant, the details and proof we ask you for in this connection are added, for example your identity card.

Legal basis:

Art. 6(1)(c) GDPR in conjunction with the prohibition on making available in the applicable EU sanctions regulation; in the alternative Art. 6(1)(f) GDPR, with our legitimate interest in not making ourselves criminally liable.

Storage period:

We keep the check log for five years from the check. The reason is the limitation period for prosecution of the criminal offence against the accusation of which the log proves our diligence. If there is a hit, the case remains stored until it has been resolved. We delete any proof you send or show us for clarification as soon as the clarification has been completed; only its result is recorded.

Recipients:

none; we carry out the check ourselves against the official lists. If a hit is established, the competent authorities, because sanctions law obliges us to report.

If your details only partly match an entry on a sanctions list, for example in the name, this does not automatically lead to termination: we first clarify whether you are the person meant. For this we may ask you for further details or proof. You can write to us at any time explaining why you are not the person meant. Until this has been clarified, your case is on hold. If, by contrast, it is established that you are listed on a sanctions list, we may no longer act for you. We then stop all steps, terminate our contract with you and report the case, with your name and the details of your case, to the competent authorities, because the sanctions law of the European Union obliges us to do so (Art. 6(1)(c) GDPR). We inform you of this insofar as the law permits.

20. Our pages on Instagram and Facebook

We run a profile on Instagram and a page on Facebook. In the European Union, both services are provided by Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland. What Meta does with your data when you use Instagram or Facebook is decided by Meta itself and described in its privacy policy. On this website we only link to our Instagram profile; data goes to Meta only when you follow the link.

When you visit our profile or our page or react to a post, Meta compiles statistics from this. We only see them in aggregated form, for example how many people have seen a post, not who they were. For these statistics we are joint controllers with Meta (Art. 26 GDPR). For the Facebook page, this is governed by Meta’s Page Insights Controller Addendum: under it, Meta fulfils the information obligations and your rights as a data subject; which data Meta processes for this is described in its information about Page Insights data. You can exercise your rights under sections 3 and 4 against Meta and against us; anything that reaches us and concerns Meta we forward to Meta.

If you send us a message or a comment there, we see your name, your profile picture and your text, and we reply to you.

Purpose:

to see how our posts are received, and to reply to your messages and comments.

Legal basis:

Art. 6(1)(f) GDPR, with our legitimate interest in making PartABoat known and replying to messages; if your message is aimed at a contract with us, Art. 6(1)(b) GDPR.

Storage period:

Meta keeps the statistics under its own rules. Messages and comments remain with Meta until you or we delete them there; anything we take from them we treat like an email under section 7.

Providing your data:

voluntary. You need neither Instagram nor Facebook for this website.