1. Controller

The controller responsible for data processing on this website:

Tobias Cors
c/o IP-Management #10199
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
Email: [email protected]

2. Hosting (Cloudflare Pages)

This website is hosted by Cloudflare, Inc. (San Francisco, USA). Each visit triggers automatic server logs (IP address, date, requested page, browser, OS, referrer). Processed for technical delivery and security purposes (Art. 6(1)(f) GDPR — legitimate interest). Cloudflare is certified under the EU-US Data Privacy Framework.

3. Cookies and local storage

This site uses only the following technically necessary storage:

  • bag_lang — your language choice (EN/DE)

This storage is strictly necessary for the service you requested (language choice) and does not require consent (§ 25(2)(2) TDDDG / ePrivacy).

4. Reach measurement

Own visit count. The site counts page views itself; we use no external analytics services. A view is counted only when a visitor interacts with the page (scrolling, mouse, touch or keyboard) and the page has been visible for at least 8 seconds. Sent are: the page path, the referring website's host name, the language and, for visits arriving through one of our domains, that domain name. Stored with it are the country and network (ASN) derived from the request, and a hashed value formed from IP address, browser identifier, date and a secret key, so that one visitor counts once per day and page. The IP address itself is not stored, and the hashed value cannot be linked across days. No cookies are set and nothing is stored on your device. The data is held in our Cloudflare database (D1) and evaluated in aggregate only. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a reliable count of human visits).

5. Contact forms and email inquiries

When you contact us through one of our forms (inquiry, quick offer, advertising request) or by email, we process your details – depending on the form: name, email address, company, domain of interest, type of acquisition, time frame, offer amount and message, plus the page from which you sent the form – to handle your inquiry and any follow-up. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract) or Art. 6(1)(f) GDPR (legitimate interest in handling inquiries).

To prevent abuse and spam we also store the IP address the inquiry was sent from. It is deleted automatically after 30 days. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of the form).

Service providers:

  • Cloudflare D1 (Cloudflare, Inc., USA) – storage of inquiries in our inquiry database. Cloudflare is certified under the EU-US Data Privacy Framework; a data processing agreement is in place.
  • Resend (Resend, Inc., USA) – sending the internal notification about a new inquiry, via the service's EU region. Transfers on the basis of the EU Standard Contractual Clauses.
  • Microsoft (Microsoft Ireland Operations Ltd., Ireland) – receiving and handling email. Transfers to the USA may occur on the basis of the EU-US Data Privacy Framework.

Your data is shared only with the providers listed here and, if a transaction takes place, with Escrow.com (section 6).

Retention: until the transaction is complete or while you are an active prospect, max. 36 months. We delete on request.

6. Domain transactions via Escrow.com

Actual domain transactions are processed via Escrow.com (Internet Escrow Services, Inc., USA). When you initiate a transaction, you proceed independently to escrow.com — their privacy policy applies: escrow.com/about/privacy-policy.

7. Third-party resources

All fonts are served from our own server; no connection to Google is made. The only external resource is:

  • Partner advertisement: product images in the advertisement for bitcoin21.shop are loaded from cdn.shopify.com (Shopify Inc.). Your IP address is transmitted to Shopify when the images load. Legal basis: Art. 6(1)(f) GDPR.

8. Your rights

You have the right to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure / "right to be forgotten" (Art. 17 GDPR)
  • Restriction (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object (Art. 21 GDPR)
  • Withdraw consent at any time (Art. 7(3) GDPR)
  • Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise rights, email [email protected].

9. SSL/TLS encryption

This site uses HTTPS encryption to protect transmission of confidential data.

10. No consent banner

This website sets no cookies and uses no tracking technologies from advertising or analytics vendors. A consent banner is therefore not shown.

Last updated: October 2026 · Version 1.3