Privacy Policy

This is a translation of the German Datenschutzerklärung. If the two versions differ, the German version prevails.

This policy explains, in line with Art. 13 and 14 GDPR, which personal data we process when you visit getbrickconnect.com and use the web app app.getbrickconnect.com (together "BrickConnect"), for what purposes and on which legal basis.

1. Controller

Gödecke Reich GmbH
De-Saint-Exupéry-Straße 10, 60549 Frankfurt am Main, Deutschland
Represented by: Andrea Liesel Gödecke
Email: support@ledfoto.de · Phone: 069 34876888

Data protection officer (if appointed): nicht benannt (keine gesetzliche Pflicht)

2. Overview: controller or processor?

We are the controller for data about website visitors, prospects and customers (account holders). Data that our customers have BrickConnect process from their sales platforms, in particular orders containing buyers' names and addresses, is processed by us as a processor under Art. 28 GDPR on behalf of and on the instructions of the customer. Our Data Processing Agreement (DPA) applies. Buyers should direct requests about their data to the respective seller.

3. Hosting and server log files

BrickConnect runs on a virtual private server (VPS) provided by UltaHost (data centre location: Amsterdam, Niederlande (EU)), acting as our processor under Art. 28 GDPR. When you access our pages, the web server processes technically necessary data: IP address, date and time, requested URL, referrer, browser identifier (user agent) and HTTP status code. These log files are used for secure and stable operation and to defend against attacks, and are deleted after 14 days at the latest unless needed longer to investigate a security incident. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).

4. Privacy-friendly page view statistics

We count page views on our website with a self-hosted solution, without cookies, without storing anything in your browser and without third parties. We store the page path, referrer, browser language, browser identifier (user agent), any UTM campaign parameters in the URL and a hash of the IP address computed with a secret key that changes daily (HMAC-SHA256). The IP address itself is not stored in clear text. The hash is only used to count unique visitors per day and avoid double counting; it is not linked across days or with other data. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in statistical analysis of how our website is used). As nothing is stored on or read from your device, no consent under § 25 TDDDG is required. The data is deleted after 24 months at the latest.

5. Waitlist

If you join our waitlist, we process your name and email address to inform you about the launch of BrickConnect. A hidden form field and a timestamp are used to block spam. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps at your request). You can leave the waitlist at any time by emailing support@ledfoto.de; your data is then deleted, and in any case six months after launch if you do not create an account.

6. Customer account and sign-in

You need an account to use the app. We process your email address, name, your declaration that you act as a business (with timestamp), language setting, sign-in times and the settings you save. Legal basis: Art. 6(1)(b) GDPR (performance of contract).

• Sign-in by email link (magic link): we send a single-use, time-limited sign-in link to your email address.
• Sign in with Google: if you choose "Continue with Google" you are redirected to Google. With your consent, Google sends us your name, email address and a Google identifier. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; data may be transferred to Google LLC (USA). Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); standard contractual clauses apply in addition. More information: policies.google.com/privacy.

7. Cookies and local storage

We use no tracking, marketing or analytics cookies. There is exactly one cookie: a technically necessary refresh-token cookie that is only sent over HTTPS and cannot be read by scripts (httpOnly). It is set after you sign in so that you stay signed in, deleted when you sign out and expires after 7 days at the latest. Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(b) GDPR.

The app also stores your language, colour scheme (light/dark) and display settings such as currency in your browser's local storage. The short-lived session access token is kept only in the memory of the browser tab. This storage is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

8. Fonts

Fonts are served from our own server. There is no connection to Google Fonts or other font providers. Our website does not load content from third-party servers.

9. Payments via Stripe

Paid subscriptions are billed via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). When you subscribe, you are redirected to a Stripe checkout page where Stripe processes your name, email address, billing address, VAT ID if any and payment details. We do not receive card details. Stripe provides us with the subscription status, invoice data and a customer ID. Stripe may transfer data to Stripe, Inc. (USA), which is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. For some purposes (e.g. fraud prevention, legal obligations) Stripe acts as an independent controller. Legal basis: Art. 6(1)(b) and (c) GDPR. More information: stripe.com/privacy.

10. Sending emails

Transactional emails (sign-in links, notifications, billing and account notices) are sent via Resend, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA (EU-U.S. Data Privacy Framework / Standardvertragsklauseln)) acting as our processor. We process the email address, name, message content and technical delivery data. Legal basis: Art. 6(1)(b) GDPR. We only send marketing emails with your consent or within the limits of § 7(3) UWG.

11. Connecting your sales platforms

The core of BrickConnect is synchronising your inventory and orders across your sales channels. When you connect a platform, we store your API credentials or OAuth tokens in encrypted form and use the official interfaces of BrickLink, BrickOwl, eBay, Shopify and your WooCommerce store to read data and push stock changes. This involves item and stock data, prices, and orders including the buyer's name, shipping and billing address, email address and phone number if provided, order lines, shipping and payment status.

For your own account data on these platforms (e.g. shop name, credentials) we are the controller; legal basis Art. 6(1)(b) GDPR. We process your buyers' data solely as a processor on your behalf (see DPA). The platforms themselves are independent controllers towards you and their own privacy policies apply. Content shown using Brick Owl data carries a source attribution.

12. Part recognition (Brickognize)

In the "Scan" and "Part-out" features you can take photos of LEGO® parts. These photos are sent to the Brickognize service (api.brickognize.com) to identify the part number. Please photograph parts only, not people or documents. We do not store the photos permanently, only the recognition result. Legal basis: Art. 6(1)(b) GDPR.

13. Shipping labels

If you use the shipping label feature, we transmit the data needed for shipping (recipient name and address, email address and phone number if required, parcel weight) to the provider you choose, e.g. Sendcloud, Shippo or DHL. This is done on behalf of the seller (see DPA); carriers act as independent controllers for the transport.

14. Contact by email

If you email us, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR) and delete them once the request has been dealt with, unless statutory retention obligations apply.

15. Recipients and sub-processors

We only disclose data to others where we are legally required to (e.g. to tax advisers or authorities).

16. Retention

We keep personal data only as long as necessary for the respective purpose. Account data and platform data processed on your behalf are deleted no later than 30 days after the contract ends, unless you request an export beforehand. Invoices and accounting records are retained for up to eight or ten years under § 147 AO and § 257 HGB.

17. Your rights

Under the GDPR you have the right to

• access (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21),
• withdraw any consent with effect for the future (Art. 7(3)).

An informal email to support@ledfoto.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

18. Obligation to provide data, automated decisions

Providing account data is required to conclude the contract; without it we cannot provide BrickConnect. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

19. Changes

We update this policy when our service or the law changes. The version published here applies.

Last updated: Oktober 2026