Updated: 19 October 2026. This notice covers collectors-hub.io, its APIs, contact form and existing account area. The local-storage CollectorsHub app also has a separate app privacy notice.
1. Controller and data protection contact
market port GmbH
Splieterstraße 27
48231 Warendorf, Germany
Email: info@marketport.de
Phone: +49 2581 94933-60
Website: marketport.de
Data protection officer: Nils Möllers, Keyed GmbH
Email: info@keyed.de
Phone: +49 2505 639797
2. Website access and technical security
Accessing our website and APIs involves processing connection data, including IP address, time, requested address, HTTP status and technical information sent by the browser, such as browser, operating system and, where provided, referrer. Server and security logs support service delivery, troubleshooting and protection against misuse. This may include upstream security checks. For sending and request limits, the application also uses cryptographically hashed identifiers derived from the IP address with short expiry periods.
The legal basis is Article 6(1)(f) GDPR: our legitimate interest in an available and secure service. Data is retained only as needed for operation, troubleshooting and security; a specific security incident may require longer retention for investigation or legal claims.
3. Cookies and storage on your device
Technically necessary cookies and security identifiers are used for login, sessions and protection of forms against forged requests. The existing account area also stores login tokens, preferences, cached content and changes awaiting synchronization in the browser. Its service worker caches the account area for local use. This storage supports the login and account service you request; you can remove it in your browser settings. Doing so may lose changes that have not been transmitted.
Where storage or access is strictly necessary for a service you explicitly request, it relies on section 25(2)(2) TDDDG. Subsequent processing relies on Article 6(1)(b) or (f) GDPR, depending on its purpose. CollectorsHub pages do not embed marketport.de marketing or analytics scripts. Fonts and website styling are served from our own site.
4. Contact form and app feedback
When you contact us, we process your name, email address, subject, message and selected language to handle your request. Website and app requests are distinguished. App feedback may also include submitted technical information such as app version, build, platform, device model, operating system, device identifier and IP address for troubleshooting. Please submit only information needed for your request.
Messages are sent through Microsoft 365. Your request is forwarded to our configured support/project mailbox for handling in awork. A copy is sent to the email address you provide; that copy excludes technical feedback diagnostics. The website does not create an additional contact archive in its application database; messages are nevertheless stored in the email and project systems used to handle them.
The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual inquiries, otherwise Article 6(1)(f) GDPR based on our interest in answering your request and improving reliability. The requested details are necessary to handle the inquiry; the form cannot be submitted without them. Messages are deleted after handling is complete unless statutory retention requirements or legitimate reasons require continued storage.
5. Existing user accounts and lists
The website provides an existing account area separate from the current local-storage app. Registration and use involve storing your username, email address, display name, password hash, any additional profile details and your saved lists, entries and photos on our server. This includes account identifiers, favorites, blocks and still-existing previously accepted shares. Authorized recipients of such a share can use shared content according to their read or write permissions. New list invitations are disabled.
For authenticated sessions, we process hashed access tokens, their validity and submitted device information. Access tokens expire after six hours and refresh tokens after 49 days; renewal replaces them. Password recovery uses your email address and temporary reset identifiers and sends the requested email through Microsoft 365. Changing the password ends existing sessions.
The legal basis is Article 6(1)(b) GDPR for requested account features and Article 6(1)(f) GDPR for protecting them. Account use is not possible without the required account information. Accounts and associated content are stored for the duration of their use. You can request deletion through the data protection contact. Backups and administratively archived content may remain until the relevant backup is cleaned up or the retention purpose ends; their retention does not itself make them publicly available.
6. Catalog requests and external content
When you initiate a catalog or price lookup, our server processes the search terms, selected language and item or set identifier. Depending on the feature, these details are sent to Rebrickable for LEGO, TCGdex for Pokémon or the integrated Playmobil catalog sources PlaymoDB or PlaymoWatch. Catalog providers receive the connection from our server. Entire collections, private notes and photos are not submitted as part of these catalog requests. Results are cached briefly to reduce load on the services.
If you open external sources, app-store links or remote images, or use remote images in the account area, the respective providers may receive your IP address and technical connection data. Their own services are subject to their privacy notices. The legal basis for the catalog feature you request is Article 6(1)(b) GDPR; operational security and request limits rely on Article 6(1)(f) GDPR. The separate app privacy notice explains optional AI use in the current app.
7. Recipients and processing outside the EEA
Access is available to people authorized to handle requests and administer the service, and service providers for hosting, technical operation, email and project handling. Microsoft 365 and awork support the communication described above; catalog providers are involved when you initiate a lookup. Data is also disclosed when legally required. Where providers process data on our behalf, the requirements of Article 28 GDPR apply.
International providers may involve recipients outside the European Economic Area, depending on the service and processing. Such transfers must meet Articles 44 et seq. GDPR, for example through an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses. Contact our data protection officer for information about the recipients and safeguards used in a specific case. Further provider information: Microsoft and awork.
8. Retention, backups and your rights
We retain personal data only for the purposes described and while a legal basis exists. Statutory retention obligations and establishing or defending legal claims may require longer retention. Data in technical backups is cleaned up through backup management; removing data from the active system does not simultaneously remove every backup copy.
Subject to the applicable legal conditions, you have rights to access, rectification, erasure, restriction of processing and data portability, and to object to processing based on legitimate interests. You can withdraw consent at any time for the future without affecting the lawfulness of earlier processing. Use the data protection contact above to exercise your rights.
You can complain to a data protection supervisory authority, particularly where you live, work or believe an infringement occurred. The authority responsible for our registered location is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia. We do not use this website for solely automated decisions with legal or similarly significant effects, or corresponding profiling.