Only the German version is legally binding.
Privacy policy
Pursuant to DSGVO (EU) 2016/679 and DSG (Austria)
1. Controller and contact details
Pazar Center — a service of Car Trade23 GmbH
Landstraße 3a, 4470 Enns, Österreich
Email: support@pazar.center
Phone: +43 660 2029338
Company register number: FN 614578 t, Landesgericht Steyr
VAT ID: ATU80241579
You can send requests regarding access, rectification, erasure or objection directly to our support email address above at any time.
2. Detailed overview of the data collected and processed
We always process our users' personal data in compliance with the applicable data protection regulations. Processing takes place to the following extent:
A. Registration and account data
When an account is created, we necessarily collect your name (or username), your email address and the password you have chosen.
- Security: Passwords are stored cryptographically salted and hashed using the modern BCrypt method. They cannot be read in plain text either by us or by unauthorised third parties.
- Optional information: Profile picture, phone number (for contact regarding listings), short bio, linked social media links.
B. Listing data, photos & interactive image annotations
When you create listings on the platform, we process the data you enter (title, description, price, price type, condition, category, subcategory and optional details such as vehicle data, property dimensions, job descriptions or event times).
- Uploaded media: Listing images stored on our servers.
- Image annotations (image markers): If you place markers on images, we store their exact geometric position (x and y coordinates in percent) and the associated text label.
C. Location data & geocoding (radius search)
To enable an effective regional search within a radius, we process the postcode you provide and the location of a listing or event venue.
- Geocoding: This information is converted fully automatically via a geocoding API (using local caches as an intermediate layer) into geographic coordinates (longitude/latitude).
- Purpose: Exclusively for calculating the distance for other users in radius queries. No permanent movement profiles of users are created.
D. Reward and token system (coin system)
To promote sales and reward active users, we operate an internal coin system. In this context we process:
- The current balance of your coins.
- The transaction history (e.g. rewards for creating listings, reviews, imports or spending on discounts and highlights).
E. B2B & dealer interfaces (OpenImmo & API imports)
For commercial partners, estate agents and dealers, we process additional business data:
- Company name, B2B address, dealer logo.
- API access keys (API keys) for automated transfer.
- Incoming XML data streams (e.g. in OpenImmo format) and their import logs.
F. Server log files
Each time the platform is accessed, the web server automatically collects technical data to ensure operational security (IP address, date/time of access, browser type and version, operating system, referrer URL, amount of data transferred).
3. Legal bases for processing
The processing of your personal data is based on the following provisions of the DSGVO:
- Art. 6 Abs. 1 lit. a DSGVO (consent): Applies to optional processing, such as activating Google Analytics tracking, subscribing to voluntary newsletters or receiving web push notifications.
- Art. 6 Abs. 1 lit. b DSGVO (performance of contract): Creating the account, creating listings, processing coin discounts, sending private messages and carrying out B2B data imports are strictly necessary for the performance of the user agreement between you and us.
- Art. 6 Abs. 1 lit. c DSGVO (legal obligation): We are subject to retention obligations under tax and commercial law (e.g. under the Bundesabgabenordnung BAO for commercial invoicing).
- Art. 6 Abs. 1 lit. f DSGVO (legitimate interest): To defend against cyber attacks (server log files), to prevent spam, fraud and abusive reviews (auto-moderation) and for anonymised platform statistics.
4. Storage period and data erasure
We store your data only for as long as is necessary to provide the service or as required by legal obligations:
- User account & profile data: Retained until the account is deleted. You can delete your account yourself at any time. In this case, your data (including email and passwords) is physically deleted immediately.
- Listings & images: When a listing is deleted or expires, they are by default kept in a security archive for a maximum of 90 days (to combat abuse and for restoration in the event of accidental deletion) and then irrevocably deleted.
- Server log files: Are automatically deleted or anonymised after a maximum of 30 days.
- Retention obligations: Invoices and business accounting data are retained for 7 years due to legal requirements (§ 132 BAO).
5. Data security, message encryption & confidentiality of communications
The security of your data is our top priority. We use state-of-the-art encryption technologies:
A. AES-256-GCM message encryption
All private chat messages between buyers and sellers are stored encrypted at database level using the extremely secure encryption standard AES-256-GCM.
Even in the event of complete, unauthorised access to our database, the content of your messages remains absolutely unreadable in plain text.
B. Strict confidentiality of communications
In accordance with § 93 TKG 2021 (confidentiality of communications), administrators, programmers and moderators of Pazar Center have no access whatsoever to your private messages.
Only exception: If a user explicitly reports a message via the button provided for this purpose on suspicion of fraud, harassment or a breach of the Terms and Conditions, exactly this chat history is released to our moderation team for manual review (legal basis: Art. 6 Abs. 1 lit. f DSGVO – abuse prevention).
6. Cookies and detailed cookie policy
Our platform uses cookies to provide core functions and to save your settings. We distinguish between two categories:
| Cookie name | Purpose | Duration | Class |
|---|---|---|---|
| next-auth.session-token | Secures your user login (session) | 30 days | Essential |
| pazar-cookie-consent | Stores your cookie choice (consent) | 1 year | Essential |
| _ga / _gid | Google Analytics user identification (anonymised) | 2 years / 24 hrs | Statistics (opt-in) |
Google Analytics integration
If you give your express consent via the cookie banner, we use Google Analytics, a service of Google Ireland Limited. Your IP address is **anonymised (IP masking)** by default, so that direct attribution to the individual user is ruled out.
You can withdraw the consent you have given at any time by deleting the cookies in your browser or by adjusting your cookie preferences via the settings link in the footer.
7. Web push notifications
You can sign up on our platform to receive direct in-app and web push notifications (e.g. for new chat messages or price reductions on items you have marked).
- Legal basis: Consent pursuant to Art. 6 Abs. 1 lit. a DSGVO by confirming the browser prompt.
- Mechanism: An anonymous identification key (push subscription token) of your browser is stored on our servers. We do not transmit any real names or email addresses to push service providers in this process.
- Withdrawal: You can completely deactivate the receipt of push notifications at any time via the settings of your web browser (e.g. under site settings / notifications).
8. Data transfer to processors & third parties
We only pass your data on to third parties if this is strictly necessary for the performance of the contract or if we are legally obliged to do so:
- Hosting & server infrastructure: Our servers are operated in highly secure data centres within the European Union. We have concluded legally binding data processing agreements (AVV) pursuant to Art. 28 DSGVO with our hosting providers (e.g. Hetzner Online GmbH, DigitalOcean).
- Geocoding: To resolve postcodes, structured location data is transmitted to recognised open-source geocoding services (e.g. OpenStreetMap/Nominatim). No personal data of the user whatsoever (such as IP or name) is transmitted in this process.
9. Your rights as a data subject (Art. 15-22 DSGVO)
As a data subject, you have comprehensive statutory rights regarding your personal data:
Right of access (Art. 15)
You can request confirmation as to whether and which data we process about you.
Right to rectification (Art. 16)
You have the right to the immediate correction of inaccurate or incomplete data.
Right to erasure (Art. 17)
Right to erasure (“right to be forgotten”), e.g. if the purpose no longer applies or you withdraw your consent.
Restriction (Art. 18)
You can request the restriction of processing, e.g. while the accuracy of the data is being verified.
Data portability (Art. 20)
Receipt of the data you have provided in a common, machine-readable format.
Right to object (Art. 21)
You can object to the processing at any time on grounds relating to your particular situation.
10. Right to lodge a complaint with the supervisory authority
If you believe that our data processing violates applicable data protection law, you have the statutory right to lodge a complaint with the competent supervisory authority:
Österreichische Datenschutzbehörde
Barichgasse 40-42, 1030 Wien, Österreich
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
Website: www.dsb.gv.at
Last updated: October 2026