Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website and within the Renuir platform, within the meaning of Art. 4(7) GDPR, is Renuir UG (haftungsbeschränkt), Hönower Wiesenweg 57, 10318 Berlin, Germany. For any privacy matter, including to reach the person responsible for data protection, contact us at privacy@renuir.com. We have not appointed a statutory Data Protection Officer because we are not currently required to do so under Art. 37 GDPR; if this changes, the contact details will be published here.

2. Data We Collect

We collect and process the following categories of personal data:

• Account data: name, email address, phone number, password (hashed)
• Item photos and descriptions uploaded when reporting lost or found items
• Location data: venue or approximate location associated with a lost/found report
• Chat messages exchanged between users and venues within the platform
• Payment data: processed by Stripe; we store only transaction references, not card details
• Technical data: IP address, browser type, device information, cookies

3. Legal Basis for Processing

We process personal data on the following legal bases under Art. 6(1) GDPR:

• Consent (Art. 6(1)(a)): for analytics cookies and optional communications
• Contract performance (Art. 6(1)(b)): to provide the Renuir service, process claims, and facilitate returns
• Legitimate interest (Art. 6(1)(f)): for fraud prevention, platform security, and service improvement
• Legal obligation (Art. 6(1)(c)): for tax records, regulatory compliance, and law enforcement requests

4. Third-Party Processors

We share data with the following categories of processors, all bound by data processing agreements:

• Hosting and infrastructure: Vercel (EU/US), for website and application hosting
• Payment processing: Stripe, for secure payment handling via Stripe Connect
• AI services: for image recognition and item matching (data minimized, no personal identifiers sent)
• Analytics: privacy-focused analytics tools to understand usage patterns

5. Data Retention

Account data is retained for the duration of your account and up to 30 days after deletion. Item reports and associated photos are retained for 12 months after resolution or 6 months after expiry if unresolved. Chat messages are retained for 6 months after claim resolution. Payment records are retained for 10 years as required by German tax law (§ 147 AO). Technical logs are deleted after 90 days.

6. International Transfers

Some of our processors operate outside the EU/EEA. Where data is transferred internationally, we ensure adequate protection through EU Standard Contractual Clauses (SCCs) or adequacy decisions. Stripe and Vercel maintain EU data processing commitments.

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): obtain a copy of your data
• Right to rectification (Art. 16): correct inaccurate data
• Right to erasure (Art. 17): request deletion of your data
• Right to restriction (Art. 18): limit processing of your data
• Right to data portability (Art. 20): receive your data in a machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests
• Right to withdraw consent: withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at privacy@renuir.com. We will respond within 30 days.

8. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin, Germany.

9. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a notice on our website. The current version is always available at this URL.