TRANSFERMKT

Privacy Policy

Last updated: 8/27/2026

1. Controller

TransferMKT (transfermkt.de) is operated by Glombica Service. For the full legal entity, address and contact details, see our Legal Notice. This Privacy Policy explains how we collect, use, disclose and safeguard your information under the EU General Data Protection Regulation (GDPR).

2. Information We Collect

Account & Profile Information

  • Name, display name and email address
  • Profile picture
  • Player profile information (handle, game, role, region, stats, socials)
  • Team information, if you create or manage a team
  • Messages sent through our conversation/offer system

Authentication Data

If you sign in with Discord or Google, we receive your basic profile information (name, email, avatar, provider account ID) from that provider to create and secure your account.

Usage Data

  • Pages visited and time spent (via Vercel Web Analytics)
  • Search queries and filters used
  • Interaction with listings and profiles

Login & Session Data

For every login session we record the IP address and browser/device (user agent) used, and how long the session stays active. This is used to secure your account and is visible to platform staff for abuse investigation.

Payment Data (Premium)

If you subscribe to Premium, our payment processor Stripe collects and processes your payment details directly. We never see or store your full card number — we only receive confirmation of your subscription status.

3. Legal Basis & Purpose of Processing

  • Performance of a contract (Art. 6(1)(b) GDPR) — to provide your account and the marketplace itself
  • Legitimate interest (Art. 6(1)(f) GDPR) — to secure the platform, prevent fraud and improve our service
  • Consent (Art. 6(1)(a) GDPR) — for optional cookies and analytics, see our Cookie Policy
  • Legal obligation (Art. 6(1)(c) GDPR) — where we are required to retain or disclose data by law

4. Third-Party Services (Processors)

We use the following service providers to operate TransferMKT. We do not sell your personal information.

  • Supabase — hosts our Postgres database (EU region)
  • Vercel — hosts and serves the platform, provides Web Analytics
  • Discord — optional OAuth sign-in and, if you opt in, our Discord community/bot integration
  • Google — optional OAuth sign-in
  • Resend — sends transactional emails on our behalf (password resets, account notifications you've opted into)
  • Stripe — processes Premium subscription payments

Where these providers process data outside the EU/EEA, they do so under appropriate safeguards such as Standard Contractual Clauses.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we remove or anonymize your personal data within a reasonable period, unless we are legally required to retain it longer.

6. Data Security

We implement appropriate technical and organizational measures — including encrypted connections (TLS), hashed credentials and access controls — to protect your personal information against unauthorized access, alteration, disclosure or destruction. No method of transmission over the internet is 100% secure.

7. Your Rights (Art. 15–21 GDPR)

You have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request deletion of your data ("right to be forgotten")
  • Request restriction of or object to processing
  • Request data portability
  • Withdraw consent at any time, where processing is based on consent
  • Lodge a complaint with your local data protection supervisory authority

8. Contact

For any questions about this Privacy Policy or to exercise your rights, please contact us using the details in our Legal Notice.