Privacy notice of the Silberwald platform

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the platform pages of Silberwald (the overview of shops at /forest and the “Create your own shop” form) is:

2. Scope and the individual shops

This notice covers the platform itself. The individual shops on Silberwald are run by their own operators. For everything that happens inside a shop — customer account, orders, shipping, the shop’s contact form and payment — the operator of that shop is the controller, and the shop’s own privacy notice applies:

Payments are handled inside the shops (through the payment provider Stripe); the shops explain this in their notices. No payment data is processed on the platform pages.

• Лавка Морисея — Morisey Ozolins
• Пчёлка Юля — Biene Julia

3. Visiting the pages (server log data)

When you open a page, the server processes technically necessary data sent by your browser: in particular IP address, date and time, requested address, status code, amount of data transferred, and browser and operating system details.

This is needed to deliver the pages, keep them running reliably and detect attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). The data is kept only as long as these purposes require and is not combined with other data sources.

The pages run on a server of a hosting provider, which processes the data on our behalf.

4. Cookies and local storage

On the platform pages we do not use analytics, advertising or tracking cookies and do not embed services that evaluate your behaviour. That is why there is no consent banner. The language comes from the page address (e.g. /en) and is stored neither in a cookie nor in local storage.

Only if you are signed in (sign-in takes place in a shop) does the platform work with cookies of the sign-in software Auth.js. On a page delivered over HTTPS they carry the prefix __Secure- or __Host-:

• authjs.session-token — keeps you signed in; lifetime 30 days.
• authjs.csrf-token — protects the sign-in and sign-out forms against forged submissions; valid until you close the browser.
• authjs.callback-url — remembers where to return to after signing in; valid until you close the browser.

In the shops, the shopping cart is also kept in your browser’s local storage (one key per shop, e.g. moresey.cart.v1). This does not concern the platform pages; the shop’s notice has the details.

These cookies are strictly necessary for the service you asked for. The legal basis for accessing your device is Section 25(2) no. 2 TDDDG, and for the related processing Art. 6(1)(b) GDPR.

5. Fonts and third-party content

The fonts are taken into our own delivery when the site is built and are loaded from our own server; opening a page creates no connection to Google Fonts. Images and sound on the platform pages also come from our server. There are no embedded third-party contents or scripts on the platform pages.

6. “Create your own shop” request

When you submit the form on the forest page, we process what you enter: name, e-mail address, optionally a phone number, optionally a website or profile, and your description of what you want to offer. We also store the language of the page, the time of the request and — for our handling — a status and an internal note. No IP address or browser identifier is stored with the request. As proof of your consent we also store the time of the consent and the version of this privacy notice (31 October 2026) that you agreed to when submitting.

The purpose is to review your request and contact you. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by ticking the box in the form, and taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). Providing the data is voluntary; without name, e-mail address and description we cannot process the request. You may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), informally at rnvl10@icloud.com.

Process: the request is saved in our database. A notification is then sent by e-mail to the operator’s mailbox, and you receive a confirmation at the address you gave. The e-mails are sent through an e-mail service provider, which processes your details in doing so.

Protection against abuse: the form contains a hidden field that only automated programs fill in; such submissions are not stored. We also limit the number of requests per e-mail address and overall per hour, counted from the stored requests and not by IP address. The legal basis is Art. 6(1)(f) GDPR.

Retention: we automatically delete rejected requests 6 months after they were received. Accepted requests stay stored for as long as the shop that resulted from them exists, or until the operator deletes them; requests that have not been decided yet stay stored until a decision is made. Statutory retention duties remain unaffected. You can ask for deletion of your data at any time.

7. Account and sign-in

Accounts are created and used in the shops; the notice of the respective shop applies to that data. If you are signed in when you submit a shop request, we link the request to your account so that we can match it. If the account is deleted, the request stays without that link until we have answered it.

8. Recipients

Recipients of your data are the operator of the platform, the hosting provider that supplies the servers, and the e-mail service provider through which the notification and confirmation are sent. Data is not passed on for advertising.

9. Your rights

You have the right to

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• receive your data in a common format (Art. 20 GDPR),
• object to processing based on a legitimate interest (Art. 21 GDPR), and
• withdraw consent with effect for the future (Art. 7(3) GDPR).

An informal message to rnvl10@icloud.com is enough for any of these.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement.

Competent supervisory authority: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow

11. No automated decision-making

There is no decision based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

12. Changes, date and language versions

We update this notice when the platform or the law changes. The version available here applies. This notice exists in German, Russian, English and Ukrainian; in case of discrepancies the German version prevails.