Privacy

Bazify respects the privacy of visitors, registered users, customers and business contacts. This Privacy Policy explains which personal data Bazify processes, for which purposes, on which legal bases, how long data is retained, which recipients may receive it and which rights data subjects have. It applies to the Bazify website and to Bazify functions that are actually activated and available to the user; planned, experimental or merely documented features do not by themselves mean that the corresponding personal-data processing takes place.

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Aleksandar Stajić
Akazienstr. 20
D-82024 Taufkirchen near Munich
Germany

Phone / Mobile: +49 (0) 163 555 4441
Email: info@stajic.de

The controller determines the purposes and means of processing personal data in connection with Bazify. If a legally required data protection officer is appointed in the future, the corresponding contact information will be added to this Privacy Policy.

2. Scope of this Privacy Policy

This Privacy Policy applies to bazify.com and to the functions made available through the Bazify platform, including website access, registration and authentication, account functions, product and commerce functions, communications, and transaction functions where they are activated.

External websites, merchant websites, social networks, payment services and other third-party services are governed by their own privacy information when the user leaves Bazify or deliberately activates a third-party service.

3. What Personal Data Means

Personal data is any information relating to an identified or identifiable natural person. Depending on how Bazify is used, this may include technical connection data, account and authentication data, contact details, correspondence, shopping or transaction data, user-selected preferences and requirements, and other information deliberately submitted through an available Bazify function.

Product specifications, public product documentation, merchant offers and other commerce information normally relate to products or businesses rather than natural persons. They are personal data only where they relate to an identified or identifiable individual.

4. General Principles of Processing

Bazify processes personal data only where a legal basis exists and only to the extent necessary for the respective purpose. Data minimisation, purpose limitation, storage limitation, integrity, confidentiality and transparency are applied according to the GDPR.

Where the same technical event involves both access to information on a user's terminal device and subsequent processing of personal data, the requirements of Section 25 TDDDG and the GDPR are assessed separately.

5. Hosting, Delivery and Server Log Files

Bazify is currently hosted on server infrastructure provided by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany. Where Contabo processes personal data on behalf of Bazify, this processing is carried out under the applicable requirements for processors, including Article 28 GDPR where required.

When Bazify is accessed, the server may automatically process technical data necessary to establish and secure the connection. This can include IP address, date and time, requested URL or resource, HTTP status code, amount of data transferred, referrer information, browser and user-agent information, operating system, device information and technical error or security information.

The purpose is to deliver the requested content, maintain the technical operation and security of Bazify, diagnose faults, detect attacks and misuse, and protect the infrastructure. The legal basis for personal-data processing is Article 6(1)(f) GDPR. The legitimate interests are reliable service delivery, IT security, abuse prevention and technical diagnostics.

Server and security logs are retained only for as long as necessary for these purposes. Individual records may be retained for longer where required to investigate a security incident, prevent abuse, comply with a legal obligation or establish, exercise or defend legal claims.

6. HTTPS and Security Measures

Bazify uses encrypted HTTPS/TLS connections for data transmitted between the user's device and the Bazify servers. Appropriate technical and organisational measures are used to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

No internet service can guarantee absolute security. Security measures are therefore reviewed and adapted according to risk, technical development and changes to the Bazify infrastructure.

7. Cookies, Local Storage and Similar Technologies

Bazify may use cookies, local storage, session storage or comparable technologies where they are required to provide a function expressly requested by the user, for example session handling, authentication, security, language or locale selection, a shopping cart, consent choices or other technically necessary functionality.

Where storage of information on, or access to information from, the user's terminal device is strictly necessary to provide a digital service expressly requested by the user, the legal basis for that terminal-device access is Section 25(2) TDDDG. Any subsequent processing of personal data is assessed separately under the GDPR, in particular Article 6(1)(b) or Article 6(1)(f) GDPR depending on the purpose.

Technologies that are not strictly necessary and require consent are not to be activated before the required consent has been obtained. In such cases, terminal-device access is based on Section 25(1) TDDDG and the associated personal-data processing on Article 6(1)(a) GDPR unless another legal basis lawfully applies.

Consent may be withdrawn with effect for the future through the available consent or privacy settings where consent-based technologies are used. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

8. Consent Management

Where Bazify uses a consent-management function, information necessary to store and demonstrate the user's privacy choice may itself be processed. This may include the consent status, categories selected, timestamp, policy or configuration version and a technical identifier required to recognise the choice.

Such storage is used only to manage or document the user's privacy decision and is retained according to the necessity of demonstrating and respecting that decision. Consent-management technology is not used to convert an optional tracker into a technically necessary service.

9. Registration, User Accounts and Authentication

Where Bazify provides registration or account functionality, data necessary to create, maintain and secure the account is processed. Depending on the function, this may include name, email address, account identifier, authentication data, account status, language or locale, security information and account preferences.

Where an account is necessary to provide a service requested by the user, processing is based on Article 6(1)(b) GDPR. Processing necessary for account security, misuse prevention, fraud prevention and integrity may additionally be based on Article 6(1)(f) GDPR.

Account data is generally retained while the account is active. After account closure, data is deleted or restricted unless continued retention is required by law, necessary for security, needed for outstanding contractual obligations or required for the establishment, exercise or defence of legal claims.

10. Product Discovery, Comparisons and Decision-Support Functions

Where Bazify offers product discovery, comparison or decision-support functions, users may provide or select information such as intended use, product requirements, mandatory constraints, preferences, budget, market, exclusions, selected products, saved comparisons or decision criteria.

Such information is processed to provide the function requested by the user. Where the function forms part of a contractual or pre-contractual service, Article 6(1)(b) GDPR applies. Security and integrity processing may be based on Article 6(1)(f) GDPR.

Product requirements and decision criteria are not automatically personal data. They become personal data where they can be linked to an identifiable person, for example through an account, session or other identifier.

11. Commerce Data, Claims, Evidence and Public Sources

Bazify is designed to separate product identity, merchant offers, claims, evidence and decision criteria. Public product specifications, manufacturer documentation, merchant listings and similar commerce data generally concern products or organisations rather than individuals.

If information obtained from public or third-party sources contains personal data relating to an identifiable person, Bazify processes that information only where a legal basis exists. Where Article 14 GDPR applies, the required information will be provided unless a lawful exception applies.

Bazify does not treat user account information, private correspondence or private decision profiles as public product evidence merely because the platform also processes public commerce information.

12. Contact by Email, Telephone or Other Available Channels

If a user contacts Bazify by email, telephone or another available communication channel, the information provided is processed to handle the inquiry. This may include name, contact information, message content, related correspondence and technical information necessary to process the request.

If the inquiry concerns a contract or steps prior to entering into a contract, processing is based on Article 6(1)(b) GDPR. Other inquiries are generally processed on the basis of Article 6(1)(f) GDPR, with the legitimate interest of handling communications addressed to Bazify effectively. Where consent is specifically requested, Article 6(1)(a) GDPR applies.

Correspondence is retained only for as long as necessary for the respective purpose, subject to statutory retention obligations and the need to establish, exercise or defend legal claims.

13. Orders, Contracts and Transaction Data

Where Bazify enables the purchase of products or services, personal data necessary to initiate, perform and administer the transaction is processed. Depending on the transaction, this may include name, contact details, billing or delivery address, ordered products or services, order number, order status, price, payment status, shipping information and customer communication.

Processing necessary for the transaction is based on Article 6(1)(b) GDPR. Data required to comply with tax, accounting, commercial-law or other statutory obligations is processed on the basis of Article 6(1)(c) GDPR and retained for the applicable statutory period.

14. Payment Providers

Where payment functionality is available, the payment method selected by the user determines which payment provider receives payment-related data. Payment providers may process information such as name, billing information, transaction amount, payment method, payment status and technical transaction data where required to execute the payment.

Payment processing necessary to perform a transaction is based on Article 6(1)(b) GDPR. A payment provider may also process data under its own legal responsibility. Its own privacy information applies to such independent processing.

Only payment methods that are actually displayed and available in the Bazify checkout should be regarded as active Bazify payment integrations. The mere technical possibility of connecting another payment provider does not mean that data is transferred to that provider.

15. Shipping, Fulfilment and Transaction Partners

Where an order requires shipping, fulfilment or another transaction partner, Bazify may transmit the personal data necessary to perform that part of the transaction. This may include name, delivery address, contact details, order reference and information necessary for delivery or fulfilment.

The legal basis is Article 6(1)(b) GDPR where the disclosure is necessary to perform the contract. Additional processing required by law is based on Article 6(1)(c) GDPR.

16. Newsletter and Marketing Communications

If Bazify offers a newsletter or comparable electronic marketing communication and the user voluntarily subscribes, the email address and information necessary to document the subscription may be processed for that purpose.

Marketing communications requiring consent are sent on the basis of Article 6(1)(a) GDPR and applicable electronic-marketing law. Consent can be withdrawn at any time with effect for the future, for example through an unsubscribe function.

Transactional or security messages necessary for an account, order or requested service are not treated as optional marketing merely because they are sent by email.

17. Analytics, Advertising and Tracking

Bazify does not classify analytics, advertising pixels, remarketing, cross-site tracking or similar technologies as technically necessary merely because they may be useful for business or optimisation.

Where Bazify introduces a non-essential analytics, advertising or tracking service that requires consent, it is to remain blocked until the required consent has been obtained. The applicable provider, purpose, data categories, legal basis, retention information and any relevant third-country transfer mechanism must be disclosed before or when the processing is activated.

A service that is mentioned in development code, configuration, documentation or a roadmap is not automatically an active tracking service. The decisive factor is whether the production system actually contacts or transmits data to that service.

18. Share Functions and Social Networks

Bazify may provide share controls that allow a user to share a page deliberately. Where sharing is implemented through the browser or operating system's native share function, the user's device controls which available app or destination is selected. Bazify does not need to establish an automatic connection to a social network merely to display such a share control.

Where a share control is implemented as an ordinary external link, a connection to the external provider is established only when the user actively follows that link. The external provider then processes data under its own responsibility, including technical connection data transmitted by the user's browser.

If Bazify later integrates a social-media SDK, plug-in, tracking pixel, embedded timeline, login service or comparable component that communicates with a third party before the user deliberately opens that third-party service, the corresponding privacy information and any required consent mechanism must be implemented before activation.

19. Embedded Third-Party Content

Bazify may link to or, where technically implemented, embed external media or content. A simple external link does not itself require the external provider to receive data before the user opens the destination.

Embedded third-party content that establishes a connection to the external provider may transmit IP address, browser information, referrer information or other technical data. Where such transmission is not strictly necessary and requires consent, the embed must remain blocked until the required consent has been obtained.

20. External Links and Merchant Websites

Bazify may link to manufacturers, merchants, publishers, documentation, evidence sources or other external websites. Following an external link causes the user to leave the Bazify-controlled environment. The destination operator is responsible for processing carried out on the external website.

A normal external link does not by itself mean that Bazify transfers the user's account data, private decision profile or other stored personal information to the destination. Additional data is transferred only where a specific function technically requires it, a legal basis exists and the transfer is described appropriately.

21. Artificial Intelligence and Automated Decision-Making

Bazify is being developed with concepts for AI-assisted commerce, structured product knowledge and decision-support systems. The existence of such concepts, architecture descriptions or future interfaces does not by itself mean that personal data is currently transmitted to an external AI provider.

At the time of this Privacy Policy, Bazify does not rely on solely automated decision-making that produces legal effects concerning a user or similarly significantly affects a user within the meaning of Article 22 GDPR.

If a future AI function processes personal data, the relevant purpose, categories of data, provider or provider category, legal basis, recipients, retention rules and any relevant international data transfers must be assessed and disclosed before or when that processing is introduced. Where consent is legally required, the function must not process the relevant data before consent.

AI-generated product assessments, recommendations or proposals must not automatically be treated as verified facts merely because an automated system produced them.

22. Recipients and Categories of Recipients

Personal data is disclosed to external recipients only where this is necessary and legally permitted. Depending on the function actually used, recipients may include hosting and infrastructure providers, technical processors, payment providers, shipping or fulfilment providers, professional advisers, contractual partners necessary to provide the requested service, and public authorities where disclosure is legally required.

Processors acting on behalf of Bazify are used under Article 28 GDPR where applicable. Bazify does not sell personal data.

23. International Data Transfers

Bazify aims to avoid unnecessary transfers of personal data to countries outside the European Union or European Economic Area. If a service provider processes personal data in a third country, the transfer takes place only where the requirements of Chapter V GDPR are met.

Depending on the recipient and country, the transfer mechanism may include an adequacy decision of the European Commission, an applicable recognised data-protection framework, Standard Contractual Clauses or another lawful transfer mechanism. Any supplementary measures required by the circumstances are assessed where applicable.

Where a new production integration creates a relevant international transfer, the provider and transfer basis must be added to the privacy documentation before or when the transfer begins.

24. Storage Periods and Deletion

Personal data is retained only for as long as necessary for the purpose for which it was collected unless longer retention is required or permitted by law.

The applicable period depends on the category of data and may be determined by the duration of an account or contract, completion of an order, resolution of an inquiry, security requirements, statutory tax or accounting retention obligations, limitation periods or the need to establish, exercise or defend legal claims.

When the relevant purpose and any mandatory retention period end, personal data is deleted or anonymised unless another lawful basis requires continued retention.

25. Legal Bases Used by Bazify

26. Requirement to Provide Data

Some personal data is required to provide a requested function or enter into a contract. For example, an email address may be required for registration and delivery information may be required for a shipment. Where information is mandatory, Bazify may be unable to provide the relevant function if the user does not provide it.

Data that is not necessary for the requested service should not be made mandatory without a separate legal justification.

27. Your Rights under the GDPR

Subject to the applicable legal requirements, data subjects have rights including access under Article 15 GDPR, rectification under Article 16 GDPR, erasure under Article 17 GDPR, restriction of processing under Article 18 GDPR, data portability under Article 20 GDPR, and the right to object under Article 21 GDPR.

Where processing is based on consent, consent may be withdrawn at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Requests can be directed to the controller using the contact details stated above. Bazify may request information necessary to verify the identity of the person making a rights request where this is reasonably required to prevent unauthorised disclosure or manipulation of personal data.

28. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedy, data subjects have the right under Article 77 GDPR to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement.

For private-sector controllers established in Bavaria, the competent supervisory authority is generally:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

29. Data Breaches

Personal-data breaches are handled in accordance with the GDPR. Where a breach is likely to result in a risk to the rights and freedoms of natural persons, the competent supervisory authority is notified as required by Article 33 GDPR. Where the conditions of Article 34 GDPR are met, affected data subjects are informed without undue delay.

30. Children and Sensitive Personal Data

Bazify is not designed to require special categories of personal data under Article 9 GDPR for ordinary commerce use. Users should not submit health data, biometric data, political opinions, religious beliefs, information concerning sex life or sexual orientation, or other special-category data unless a specific function expressly requires it and provides an appropriate legal basis and privacy notice.

Where a service is offered directly to children and consent is relied upon for information-society services, the applicable requirements concerning children's consent are assessed before that function is activated.

31. No Sale of Personal Data

Bazify does not sell personal data. Personal data is not made available to advertisers or other third parties in exchange for payment merely because a user visits or uses Bazify.

32. Privacy Activation Gate for New Features

Before a new production feature is enabled, Bazify should determine whether it introduces new personal-data processing, terminal-device access, a new recipient, a new purpose, profiling, an international transfer, automated decision-making, embedded third-party content or another material privacy change.

33. Changes to this Privacy Policy

This Privacy Policy may be updated when Bazify changes technically, introduces a new function, changes a provider, changes processing purposes or when legal requirements change. The version published on Bazify at the relevant time applies.

Material changes that require renewed consent do not become lawful merely by changing this text. Where the law requires consent, a new or updated consent must be obtained before the relevant processing is activated.

34. Current Version

Last updated: 13 October 2026.

This version is intended to replace legacy Bazify privacy text that referred to unrelated portal content or to third-party services not verified as active in the current Bazify production environment.