Privacy Policy.

1. Controller

IP Strategy UG (haftungsbeschränkt), Niederrheinstraße 46f, 41472 Neuss, Germany — full details in the Impressum. Data protection contact: info@ipstrategy-group.de.

2. What we process, and why

Visiting the site

Our host, Vercel, processes technical request data including your IP address, user agent and the pages requested, in order to serve the site and keep it secure. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

Analytics — only if you agree

We use DataFast to understand which channels bring people to the ledger. The tracking script is not loaded until you accept the cookie banner. Decline, and it is never loaded and no analytics cookie is set. Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG, withdrawable at any time.

When enabled it records page views, referrer, campaign parameters, approximate location derived from IP, device and browser type, and the goals listed in our documentation, and sets the cookies in section 3.

Placing a bid

To create your listing we process the house name, link and one-line description you enter, the amount, and your logo if you send one. This data is published publicly on the ledger — that is the product. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

Payment

Payments are handled by Dodo Payments as merchant of record. Your name, email, billing address and payment details are collected by Dodo directly — we never see or store card details. Dodo acts as an independent controller for the payment and applies its own privacy policy. We receive the payment confirmation, the amount, and your name and email in order to deliver your crest and to meet our record-keeping obligations. Legal basis: contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) GDPR.

Fulfilment

Your listing (house name, link, description), your payment reference and amount, your email address, and your minted crest image are stored in our database and file storage, operated by Supabase and hosted in Frankfurt, Germany (EU). The crest image itself is publicly accessible by design — it is made to be shared. Your crest is delivered by email through Resend, which processes your email address and the message for that purpose. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.

Your consent choice

Your accept-or-decline is stored in your browser's localStorage under elite_club_consent. It never leaves your device and exists so a refusal is honoured on your next visit.

Fonts are self-hosted on this domain. No font CDN, and no Google service, sees your visit.

3. Cookies and similar storage

Confirm the current DataFast cookie names and lifetimes against their documentation before publishing, and update this table if they differ.

You can change your mind whenever you like: reopen the cookie choice. Declining after previously accepting also deletes the DataFast cookies listed above.

4. Who receives your data

The ledger database is hosted in the EU. Vercel, DataFast and Resend may process data outside the EU/EEA; where they do, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision (EU–US Data Privacy Framework), per each provider's data processing agreement.

5. How long we keep it

• Listing data — for as long as the listing runs, then up to 12 months after it lapses.
• Payment records — for the statutory retention period, which in Germany is up to ten years under tax and commercial law.
• Analytics — for as long as the DataFast account retains them, per DataFast's current retention settings.
• Server logs — for the short period set by Vercel's platform defaults.

6. Your rights

You have the right to access your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

Write to info@ipstrategy-group.de to exercise any of these.

You may also complain to a supervisory authority. The one responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

Note that listings are published deliberately and permanently record capital deployed; erasure of a listing does not remove payment records we are legally required to retain.