Privacy notice

Controller and contact

BrandMyBoat.lol is operated by STRICS IT GmbH, Florian-Gmainer-Straße 4, 4240 Freistadt, Austria. For privacy requests, access, correction or deletion, email hello@strics.at.

Visits and public counters

The hosting infrastructure receives ordinary connection data such as network address, date and time, requested path, browser and response information. To provide the approximate live-browser and total-visit counters and protect them from manipulation, the BrandMyBoat API briefly combines the request network address, browser user-agent and a random page-load reference with a private server secret. Only keyed identifiers, short anti-abuse counters and first/last-seen timestamps are stored in Firebase; raw addresses and user-agent strings are not written to the counter database. No analytics cookie is set.

A refresh is a new visit, while live is an approximate recent-browser count. This limited processing supports our legitimate interests in operating, securing and understanding the campaign site under Article 6(1)(f) GDPR. The figures are not audited sponsor impressions.

Reservation requests

When an EU business applies, we process its legal company name, registered street address, postal code, city and claimed establishment country, contact name, company-domain email, EU VAT ID, website, reverse-charge declarations, requested spaces, fixed server-calculated net prices, application and review status, evidence methods and references, and timestamps. The unpaid application does not reserve inventory. Stripe Checkout, customer, PaymentIntent, invoice and refund references are added only if the authenticated owner first approves the business and the applicant then continues to payment. The opaque customer-status credential is stored only as a cryptographic hash. It stays in the private URL's browser fragment and returns to BrandMyBoat only in non-cacheable same-origin POST requests.

The server sends the EU VAT ID and STRICS IT GmbH's requester VAT ID to the European Commission VIES service. BrandMyBoat compares the exact legal form, name and full registered address submitted in the form with the registration details returned by VIES; the submitted name and address are not sent to VIES by this check. VIES and a VAT number are not treated as proof of establishment or applicant authority. Before Checkout, the authenticated owner separately records official establishment evidence, company-control evidence and signer-authority evidence. An unavailable, inconclusive or mismatching check blocks payment.

Only after that pre-payment approval does Stripe collect the payment method, billing address, legal business name and business tax ID where supported. BrandMyBoat receives payment status and limited billing/business details needed for reverse-charge verification, accounting, refunds and the sponsorship contract, but it does not receive or store full card numbers.

We use these data to take requested pre-contractual steps, verify the business before payment, activate and administer an approved paid hold, prevent conflicting reservations and prepare a conditional B2B sponsorship order under Article 6(1)(b) GDPR. Security, rate limiting and fraud prevention rely on Article 6(1)(f); payment, contractual, tax and accounting records are retained where Article 6(1)(c) requires them.

The logo upload in the 3D preview stays in the visitor's browser and is not sent with the reservation form. Artwork supplied later for a confirmed sponsorship becomes public only after separate owner approval; its public file and placement mapping contain no reservation, contact, tax or payment record.

Sold-out waitlist

If every sponsorship space is currently reserved or taken, you may ask to be contacted if availability returns. We process only the email address you submit, a keyed identifier used to prevent duplicate or abusive entries, and the submission and expiry timestamps. Joining the waitlist creates no payment, reservation, priority, sponsorship right or obligation to proceed.

We use the address solely to respond to your requested potential sponsorship follow-up under Article 6(1)(b) GDPR and to protect the form from misuse under Article 6(1)(f). The address is visible only in the protected owner view and is never included in public inventory responses. You can ask us to remove it at any time by emailing hello@strics.at.

Providers and recipients

Vercel hosts and delivers the website and API. Google Cloud/Firebase stores the private counter, waitlist and reservation records in the EU region configured for this project. Stripe hosts Checkout, processes the €100 reservation payment, supports tax-ID collection, fraud checks, receipts and refunds. These providers receive only the data needed for their role and operate under their applicable data-protection terms and transfer safeguards.

The public inventory response contains only a sponsorship-space identifier and whether that space is available, reserved or taken. It does not contain a reservation reference, company name, contact, email, tax or registration data, Stripe data, private token or owner-review information. We do not sell personal data, use reservation details for third-party advertising or publish a company's details or logo merely because it submitted a request.

Retention, security and your rights

Pseudonymous live-visitor records expire after 48 hours, daily network abuse counters after three days, and generic API rate-limit records after their window plus one day. Waitlist entries become ineligible for owner follow-up after 12 months, are excluded from the owner list after expiry and are deleted in bounded batches during the next waitlist submission or owner-list refresh; they are removed sooner if you request deletion. Abandoned, rejected, refunded or released operational reservation records are scheduled for deletion after 180 days unless a legal claim requires a hold. Active approved requests and resulting contracts are retained for the applicable contractual, tax and statutory periods.

Direct browser access to every database collection is denied. The API returns explicit minimum-data projections, uses encrypted transport, private no-store responses, server-authoritative prices, expiring transactional holds, hashed tokens, same-origin checks, rate limits and signed raw-body Stripe webhook verification. Private waitlist and reservation data and Stripe secrets remain server-side; complete business evidence is available only in the authenticated owner console, while a customer's private status link receives only its minimal status, selected-space and amount projection. The former bearer owner-review route is retired. No storage system can guarantee absolute security.

Subject to applicable law, you may request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You may complain to the Austrian Data Protection Authority at dsb.gv.at.

Changes

This notice may change when the campaign flow, providers or legal obligations change. The current version and update date remain available on this page. The broader STRICS privacy policy is available at strics.at/privacy.