Privacy notice

1. Controller and contact

The controller for platform processing is the operator identified in the contact block above and the legal notice. Send privacy enquiries to info@hausblitz24.de.

2. Website access and operation

Technical connection data includes IP address, request time and address, browser information and technical errors. It supports delivery, stability and abuse prevention. The basis is Article 6(1)(f) GDPR and our legitimate interest in secure operation. The actual hosting provider must be added before publication.

3. Accounts, jobs and communication

Registration and sign-in involve email address, authentication data and profile information. Depending on use, we also process contact details, job descriptions, locations, dates, photos, offers, contracts, messages, reviews and payment status. This supports the requested platform features and relevant pre-contractual or contractual relationships under Article 6(1)(b) GDPR.

If you choose the offered Google sign-in, you are redirected to that provider’s authentication flow. Google and Supabase process the information needed to authenticate and link the account. The relevant sign-in flow shows what information is shared.

Customers and providers receive information needed for their particular transaction according to their role and access rights. Avoid including unnecessary personal information about others in public descriptions and reviews.

4. Provider verification and payouts

Providers may submit identity, business and authorisation information for verification, abuse prevention and proper processing. Depending on the purpose, Article 6(1)(b), (f) and applicable legal obligations under (c) GDPR apply. Verification documents are available only to authorised reviewers.

The administration may receive a submission notification containing basic details and a reference to the protected review area. Identity documents are not attached to that notification. Bank details and payment references are processed for requested payments and payouts.

5. Contact forms and email

Enquiries are processed to respond to your request. Article 6(1)(b) GDPR applies to contractual enquiries and Article 6(1)(f) to other enquiries. Messages go to info@hausblitz24.de, and your sender address allows us to reply.

Resend delivers transactional email. The company mailbox uses Zoho Mail. Administrative notifications may additionally go to a Google Mail account used by the operator. Sending an enquiry or verifying an email address does not subscribe you to marketing.

6. Database, authentication and files — Supabase

Supabase supports authentication, database, file storage and real-time features. It processes the information needed for those functions. The actual project region and applicable processing and international-transfer agreements must be confirmed before publication. Sign-in uses Supabase Auth. Do not include passwords in job descriptions or messages.

7. Payments — Stripe and bank transfer

Selecting an available Stripe payment transmits necessary transaction information to Stripe. Card information is entered in the Stripe payment flow. The platform receives payment references and status information. Bank transfers involve information needed for allocation, confirmation and accounting. Articles 6(1)(b) and (c) GDPR apply. A payment does not grant marketing consent.

8. Cookies and device storage

Essential storage supports sign-in, security, your cookie choice and features you expressly request. This includes necessary Supabase sign-in cookies, an email-verification continuation cookie where needed, local security timestamps, requested job drafts and your chosen appearance. Strictly necessary device access relies on section 25(2) TDDDG. Related personal-data processing relies in particular on Article 6(1)(b) or (f) GDPR.

The hb24-consent cookie stores a version, your cookie choice and selection time for up to 180 days. Expired or invalid choices trigger a new request. Use the cookie icon or “Cookie preferences” to change your decision. Rejecting optional content does not delete essential sign-in cookies.

When you choose to install the web app, your browser may store app metadata and icons. Our service worker does not place account pages, messages or payment information in Cache Storage. It only displays a static notice when a connection fails.

This version includes no analytics or advertising trackers. Any new optional service must be assessed, described here and included in a new consent request where required.

9. Map and location search

The street map uses OpenStreetMap data. Your browser loads map images through our servers and does not connect directly to OpenStreetMap for them. Our servers retrieve and cache the required map tiles. The map provider receives tile coordinates, our server IP address and the public origin of our website; visitor IP addresses, sign-in cookies and contact details are not forwarded. Processing on our servers supports location display and secure technical operation under Article 6(1)(f) GDPR. The map uses no optional tracking cookies.

At your request, our servers query OpenPLZ for place and postcode searches and Nominatim for geocoding. The entered search or location information is sent for that purpose. Public provider markers use the city location; this map does not display a private address.

10. Abuse prevention and external links

Forms may use server-side rate limits and Cloudflare Turnstile where configured. Turnstile processes connection and device signals needed for its security checks. The purpose is protection against automated abuse under Article 6(1)(f) GDPR. The active configuration must be verified before publication.

Social-media icons are links rather than embedded feeds. Merely displaying those links does not load social feeds. Opening a link makes the destination provider’s notices relevant.

11. Recipients and international processing

Recipients include authorised transaction participants, administration, contracted technical providers and authorities or advisers where a legal basis permits. International providers may process data outside the EEA. Actual locations, roles, processing agreements and any necessary transfer safeguards must be documented for this configuration before publication. We do not make a blanket claim that all data stays in Germany.

12. Retention and deletion

Personal information is retained for the stated purposes. Legal retention duties or the establishment and defence of claims may require longer retention of contractual, payment and accounting records. Closing an account therefore does not necessarily erase every transaction record immediately. Specific retention and deletion schedules, especially for verification files and technical logs, must be fixed before publication. You can also remove local browser data through browser settings.

13. Your rights

Subject to statutory conditions, you can request access, correction, erasure, restriction and portability. You may withdraw consent for the future. You may object to legitimate-interest processing for reasons relating to your situation, and there is a separate right to object to direct marketing.

You may complain to a supervisory authority, especially where you usually live or work or where the alleged infringement occurred. Proportionate identity checks may be necessary when handling access requests. The reviewed platform flows do not provide for solely automated decisions with legal or similarly significant effects.