Privātuma politika

1. Data Controller

Laszlo Bekoe
erosee — Einzelunternehmen
Christian-Pless-Strasse 11-13
63069 Offenbach am Main
E-Mail: support@erosee.com
Phone: +49 170 4811885

2. Data We Collect

2.1 Registration & Profile

During registration, we collect: email address, username, password (stored only as a cryptographic hash, never in plain text), and chosen role (Guest, Girl, Club). Optional: profile picture, phone number (for SMS verification). Legal basis: Art. 6(1)(b) GDPR (contract performance).

2.2 Reviews & Forum Posts

Reviews and forum posts are published under your username (pseudonymous). Legal basis: Art. 6(1)(b) GDPR.

2.3 SMS Verification

For verification, we send a one-time code via SMS. Your phone number is stored in our database; only you and the platform administration can see it, not other users or venues. To deliver the code, we pass the number to our SMS provider ClickSend (Australia); beyond that, we do not share it. Legal basis: Art. 6(1)(f) GDPR (fraud prevention).

2.4 Payment Data

Payments are processed through CCBill. We do not store credit card data. CCBill receives data necessary for processing. Billing data (company, address, VAT ID) is retained for 10 years (§ 257 HGB). Legal basis: Art. 6(1)(b) and (c) GDPR.

2.5 Server Logs

When visiting our website, the server automatically records: IP address, browser type, operating system, referrer URL, time of access. This data is deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR (IT security).

2.6 Ad Delivery Measurement

Advertisements on erosee are billed by impressions and clicks. To avoid counting the same visitor repeatedly per page view, we derive a hash value from IP address, user agent and the current date, salted with a secret server key. Only this hash is stored — neither the IP address nor the user agent is retained for this purpose, and the value changes daily. Entries are deleted after one day. No cross-device recognition and no profiling take place. Legal basis: Art. 6(1)(f) GDPR (accurate billing towards advertisers, protection against manipulation).

2.7 Protection of Sign-in Forms (Cloudflare Turnstile)

Sign-in, registration and password reset are protected by Cloudflare Turnstile, a check that distinguishes automated from human access. Without this protection our registration form was abused to send confirmation emails to third-party addresses. Opening these three forms establishes a connection to Cloudflare (Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA); IP address, browser details and interaction data are transmitted to Cloudflare and, according to their own statement, retained for at most 30 minutes. Turnstile sets no advertising cookies and builds no cross-device profile. The transfer to the USA relies on the European Commission's standard contractual clauses. Legal basis: Art. 6(1)(f) GDPR (prevention of abuse, protecting third parties from unsolicited email). No such connection takes place on any other page.

3. Cookies

We set technically necessary cookies without consent (§ 25(2) TDDDG): session management, language setting, dark mode, your confirmation of the age check (age_verified, 30 days) and your choice regarding usage statistics (statistik, 12 months if you agree, 6 months if you decline). Analytics cookies are set only with your consent (section 3.1). We set no advertising cookies.

3.1 Usage Statistics (Google Analytics)

If you agree, we use Google Analytics 4 to measure how erosee is used in order to improve the site. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is integrated via Google Tag Manager, which is likewise loaded only after your consent — before that, no connection to Google takes place.

We record: pages visited (without personal address components), search filters (city, type of venue — no free text), clicks on a venue's contact options, completion of registration or review and confirmation of a phone number (each without content or number), steps in the area for venues (claiming a listing, plan selection without amount), device and browser details, and approximate location (country/region). For this, Google Analytics stores the cookies _ga and _ga_<ID> containing a random identifier for up to 14 months. According to Google, Google Analytics 4 does not store IP addresses. We do not transmit names, email addresses, phone numbers or account identifiers. Google Signals, linking with Google advertising services and personalised advertising are switched off. The data is deleted after 14 months.

Which pages you view on erosee may allow conclusions about your interests. We therefore measure only with your explicit consent. Legal basis: § 25(1) TDDDG, Art. 6(1)(a) and Art. 9(2)(a) GDPR. No page views are measured on sign-in and registration pages, in your account, in the area for ladies, for advertisers or in the admin area; the completion of a registration or phone number confirmation is reported only on the next visit to a measured page, without content. A transfer to Google LLC in the USA is possible; Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023).

You can withdraw your consent at any time with effect for the future — via the “Privacy settings” link at the bottom of every page. We then delete the Google Analytics cookies in your browser.

4. Data Processors

We work with the following service providers:

• Supabase — Database & Authentication (Self-hosted, EU servers)
• Google (Gmail SMTP) — Email delivery (USA, Standard Contractual Clauses)
• Google (Analytics, Tag Manager) — Usage statistics, only with consent (Ireland/USA, EU-US Data Privacy Framework)
• ClickSend — SMS delivery (Australia, Standard Contractual Clauses)
• CCBill — Payment processing (USA, Standard Contractual Clauses)

5. Your Rights

You have the right to:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)

Please direct requests to: support@erosee.com

6. Right to Complain

You have the right to lodge a complaint with the competent supervisory authority:

The Hessian Commissioner for Data Protection and Freedom of Information
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Phone: +49 611 1408-0
datenschutz.hessen.de

7. Data Security

We use SSL/TLS encryption for all data transmissions. Passwords are stored exclusively as cryptographic hashes. Access to personal data is restricted to authorized personnel.

8. Changes

We reserve the right to update this privacy policy as needed. The current version is always available on this page.