Privacy policy

Stand: 16 June 2026

This is a translation of the German privacy policy. In the event of any discrepancy, the German version shall prevail.

1. Controller

The controller within the meaning of the General Data Protection Regulation (DSGVO) is:

A data protection officer is not required by law and has therefore not been appointed. If you have any questions regarding data protection, please contact the address stated above.

2. General Information

This privacy policy provides information about the nature, scope and purpose of the processing of personal data on this website. Personal data is any data relating to an identified or identifiable natural person.

Insofar as we refer to a legal basis for processing operations, the following applies: Art. 6 Abs. 1 lit. a DSGVO as the legal basis for processing based on consent; Art. 6 Abs. 1 lit. b DSGVO for the performance of contracts and pre-contractual measures; Art. 6 Abs. 1 lit. c DSGVO for compliance with legal obligations; Art. 6 Abs. 1 lit. f DSGVO for safeguarding our legitimate interests. For the storage of information on your device and access to it, § 25 TDDDG additionally applies.

3. Hosting

This website is hosted by an external service provider. The personal data collected in the course of use is stored on the servers of the host. The hosting provider is:

The server location is in Germany. A data processing agreement (AVV) pursuant to Art. 28 DSGVO exists with the provider, which ensures processing that is bound by instructions and compliant with data protection law. The legal basis is our legitimate interest in the secure and efficient operation of the website (Art. 6 Abs. 1 lit. f DSGVO) as well as, where consent is requested, Art. 6 Abs. 1 lit. a DSGVO in conjunction with § 25 Abs. 1 TDDDG.

3.1 Server Log Files

The hosting provider automatically collects and stores information that your browser transmits in server log files. These are:

• IP address of the accessing device,
• date and time of the request,
• page/file accessed and amount of data transferred,
• HTTP status code,
• referrer URL (page previously visited),
• browser and operating system used (user agent).

This data serves the technical delivery of the website, ensuring system security and error analysis. The legal basis is our legitimate interest (Art. 6 Abs. 1 lit. f DSGVO). As a rule, the log files are deleted after no later than 7 days, unless they are needed for longer to investigate security-relevant incidents. Any further application-side logging of individual page views does not take place in live operation.

4. Cookies and Consent

This website uses cookies and comparable techniques for storing information on your device. We distinguish two categories:

4.1 Technically Necessary Cookies

These cookies are required for the operation of the website and the functions you have requested. No consent is necessary for them (§ 25 Abs. 2 Nr. 2 TDDDG); the legal basis is Art. 6 Abs. 1 lit. f DSGVO. These include in particular:

• PHP session cookie (default name "PHPSESSID") — temporary session identifier that is set on every visit, so that security functions (protection against cross-site request forgery) and sessions work. It is deleted when the browser is closed or when the session expires.
• frontend_uid — keeps you logged in to your user account. It is only set after a successful login (lifetime approx. 24 hours).
• h0_locale — stores your language preference, so that on subsequent visits you are shown the appropriate language version. It is set automatically on your first visit based on your browser language (lifetime up to 1 year).
• frontend_notice — short-lived notice (e.g. "logged out", "session expired"), which is removed again shortly after it is displayed.
• Consent cookie — stores your selection in the cookie banner, so that it is not requested again on every visit.

4.2 Cookies and Services Requiring Consent

Cookies and services that are not strictly necessary — in particular for reach measurement (Google Analytics) and for the delivery of advertising (Google AdSense) — are set or loaded exclusively after your express consent. The legal basis is § 25 Abs. 1 TDDDG in conjunction with Art. 6 Abs. 1 lit. a DSGVO.

On your first visit to the website, a consent banner appears. Until you make a selection, no services requiring consent are loaded; the corresponding functions are deactivated via a consent mechanism ("Consent Mode", default setting "denied"). You can revoke or change your consent at any time with effect for the future, by calling up the cookie settings again. The revocation does not affect the lawfulness of the processing carried out up to that point.

5. Google Analytics

After your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The associated measurement ID is G-1GK21R833X.

Google Analytics uses cookies and similar identifiers to evaluate the use of the website pseudonymously (e.g. pages accessed, time spent, approximate location, device and browser information). Your IP address is used by Google for rough location determination, but according to Google is not permanently logged and not merged with other data of Google. The purpose is the analysis and improvement of our offering. The legal basis is exclusively your consent (Art. 6 Abs. 1 lit. a DSGVO).

A transfer of data to the USA to Google LLC cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses of the EU Commission exist. You can find further information in Google's privacy policy: https://policies.google.com/privacy. You can revoke your consent at any time via the cookie settings.

6. Google AdSense

After your consent, we integrate Google AdSense, a service for the integration of advertisements provided by Google Ireland Limited (address as above). Our publisher ID is ca-pub-4053631408823405.

Google AdSense uses cookies and advertising identifiers to display ads and to measure their delivery. Depending on the scope of your consent, the ads can be displayed personalized (based on usage interests) or non-personalized. Among other things, IP address, advertising identifiers, device and browser data as well as interactions with the ads are processed. The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO). Here too, a data transfer to Google LLC in the USA may occur (EU-US Data Privacy Framework, standard contractual clauses).

You can manage your advertising settings at Google at https://adssettings.google.com. You can revoke your consent to AdSense at any time via the cookie settings.

7. User Account

You can create a user account on the website. In doing so, we process the data you provide: username, e-mail address, password (stored exclusively as a cryptographic hash, never in plain text) as well as optionally salutation, first and last name and address. For activation, you confirm your e-mail address via a confirmation link (double opt-in). The purpose is the provision of the account functions (e.g. forum, wishlist, inventory, marketplace, reviews). The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO).

If you mark your profile as public, your username may be visible to other users. To prevent misuse, we log login and logout processes as well as security-relevant changes to the account (each with timestamp, IP address and browser identifier). The legal basis is our legitimate interest in the security of the user accounts (Art. 6 Abs. 1 lit. f DSGVO). We delete your account and the associated data at your request; you can request this at any time via the contact address stated above.

8. Newsletter

For the receipt of our newsletter we use the double opt-in procedure: After your registration you receive an e-mail asking you to confirm your registration. We store your e-mail address, the chosen language as well as, as proof of consent, the timestamp and IP address of registration, confirmation and unsubscription in each case. The legal basis is your consent (Art. 6 Abs. 1 lit. a DSGVO). You can unsubscribe from the newsletter at any time via the unsubscribe link in every newsletter e-mail; your consent is thereby deemed revoked.

9. Contact Form

If you contact us via the contact form, we process the data you provide (name, e-mail address, subject, message) as well as, for misuse prevention, automatically your IP address, browser identifier and the timestamp of the transmission. We use this data exclusively to process your inquiry. The legal basis is Art. 6 Abs. 1 lit. b DSGVO (insofar as your inquiry aims at a contract) or our legitimate interest in answering inquiries (Art. 6 Abs. 1 lit. f DSGVO). We delete the data as soon as your inquiry has been conclusively processed and no statutory retention obligations preclude this.

10. Forum

In our forum, registered users can write posts. Your username and your posts are publicly visible and findable via search engines. To provide the forum functions, we additionally process reading and activity data (e.g. which posts you last read, in order to mark unread posts), reactions, topic subscriptions as well as reports and moderation processes. The legal basis is the performance of the contract or our legitimate interest in a functional, moderated forum (Art. 6 Abs. 1 lit. b und lit. f DSGVO). Please note that publicly published posts may remain permanently visible.

11. Product Reviews

You can rate and comment on products. The rating, a title, your comment and, where applicable, your username are published. Reviews are checked before publication (moderation). The legal basis is your consent upon submitting the review or our legitimate interest in meaningful product information (Art. 6 Abs. 1 lit. a und lit. f DSGVO).

12. Wishlist and Inventory

Registered users can earmark products on a wishlist and maintain a personal inventory (their own collection). In doing so, we store the link between your account and the selected products. This data is private and serves exclusively the function used by you. The legal basis is the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO).

13. Marketplace

Via the marketplace, private individuals can offer and request model railway items. Offers are published with your username. For inquiries, we store the messages exchanged between provider and prospective buyer as well as, for misuse prevention, action logs (including IP address). The platform stores no address or payment data and does not process any payments. The legal basis is the performance of the contract or our legitimate interest in the operation of a secure marketplace (Art. 6 Abs. 1 lit. b und lit. f DSGVO). For data that you exchange directly with other users, you are jointly responsible yourself.

14. E-mail Dispatch

For the delivery of confirmation, newsletter and notification e-mails we process your e-mail address, your name as well as the respective message content. Dispatch takes place via the mail server of our hosting provider. Depending on the occasion, the legal basis is your consent, the performance of the contract or our legitimate interest (Art. 6 Abs. 1 lit. a, b bzw. f DSGVO).

15. Affiliate Links

This website contains affiliate links to retailers that are arranged via the partner network Awin (Awin AG, Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany). If you click on such a link or an advertisement of the partner network is loaded, Awin can set cookies or process identifiers in order to attribute a referred order to a commission. The processing on the target sites and by the partner network takes place under their responsibility. The legal basis for the integration is our legitimate economic interest (Art. 6 Abs. 1 lit. f DSGVO); insofar as non-necessary cookies are set in the process, this only takes place after your consent (§ 25 Abs. 1 TDDDG). Affiliate links are marked as such.

16. Recipients and Third-Country Transfer

Your data is only passed on insofar as this is necessary for the provision of the services described above — in particular to our hosting provider (processor, Germany) as well as, after your consent, to Google (analysis and advertising) and the partner network Awin. A transfer to the USA (Google LLC) takes place on the basis of the EU-US Data Privacy Framework and supplementary standard contractual clauses. Any further disclosure only takes place if we are legally obliged to do so.

17. Storage Period

We only process and store personal data for as long as is necessary for the respective purpose or as statutory retention periods exist. We store account data for the duration of the existing account; newsletter data until the revocation of consent; data from the contact form until conclusive processing. Server log files are deleted at short notice (see section 3.1). After that, the data is deleted or anonymized, unless a statutory retention obligation precludes this.

18. Your Rights

Under the DSGVO you have the following rights:

• Information about the data stored about you (Art. 15 DSGVO),
• Rectification of incorrect data (Art. 16 DSGVO),
• Erasure (Art. 17 DSGVO),
• Restriction of processing (Art. 18 DSGVO),
• Data portability (Art. 20 DSGVO),
• Objection to the processing (Art. 21 DSGVO, see below),
• Revocation of granted consents with effect for the future (Art. 7 Abs. 3 DSGVO).

To exercise your rights, an informal message to the contact address stated under section 1 is sufficient.

18.1 Right to Object

Insofar as we process data on the basis of legitimate interests (Art. 6 Abs. 1 lit. f DSGVO), you have the right, on grounds relating to your particular situation, to object at any time to this processing (Art. 21 DSGVO).

18.2 Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to other legal remedies, you have a right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

19. Data Security

Transmission is encrypted via TLS (recognizable by the "https" in the address bar). Passwords are stored exclusively as a cryptographic hash. We take appropriate technical and organizational measures to protect your data against loss, misuse and unauthorized access.

20. Automated Decision-Making

Automated decision-making including profiling with legal effect concerning you or similarly significant impairment within the meaning of Art. 22 DSGVO does not take place. Insofar as, after your consent, interest-based advertising is displayed via Google AdSense, the evaluation carried out in the process serves exclusively the selection of ads and has no legal effect concerning you.

21. Minors

Our offering is aimed at adults as well as young people aged 16 and over. Anyone who creates a user account or subscribes to the newsletter must be at least 16 years old. Persons under 16 years of age may not transmit any personal data to us without the consent of their guardians. If we become aware that we have processed data of a person under 16 years of age without the required consent, we delete it.

22. Currency and Changes

This privacy policy is adapted as soon as changes to the data processing or the legal situation require this. The version published on this page applies in each case. The current status is stated at the beginning of this policy.