Skip to content
De Bromfietsbeurs
Draft

Privacy and cookies

We handle your data with care. Here you can read, in plain language, which data we use, what for, and what your rights are.

This is a translation of the Dutch privacy statement, provided for your convenience. If the two versions differ, the Dutch text prevails. You can read it by choosing NL in the language menu.

Last updated: October 2026.

Who are we?

De Bromfietsbeurs is an online marketplace for mopeds, scooters, motorcycles, parts and accessories. We are responsible for processing your personal data as described in this statement (under the GDPR this is called the “controller”). De Bromfietsbeurs is run by R. van Milligen in Spakenburg, the Netherlands. You can reach us at info@debromfietsbeurs.nl.

Which data do we use?

  • Account: your name, email address, (encrypted) password, town if you fill it in, and whether you have turned on two-step verification.
  • Listings: everything you put in a listing, such as text, price, photos and the town. For the town we store a rounded location (not an address) so we can show distances. A registration number is not required; if you fill it in, only you and the administrator can see it.
  • Messages and bids: the messages and photos you send through the site, and your bids. Other visitors only see your first name with a bid.
  • Garage, saved searches and favourites: what you fill in or save there yourself.
  • Reports and contact: reports you make or that concern you, and messages sent via the contact form.
  • Usage: how often a listing has been viewed (only a number, not who looked), and when you were last active (in rough steps such as “this week”).
  • Security: after a failed login attempt we store an unreadable fingerprint (hash) of your IP address and email address, to stop bots and password guessing. We delete it after one day.

What do we use it for?

  • To make the marketplace work: your account, listings, messages, bids and notifications.
  • To keep the site safe: checking listings, handling reports and preventing abuse.
  • To send you emails that belong to your account, such as confirmation, forgotten password or account deletion.

The GDPR calls this the “legal basis”: the reason why we are allowed to use your data.

  • Performance of the contract: your account, listings, messages, bids, favourites, garage and saved searches. Without this data the marketplace cannot work.
  • Legitimate interest: keeping the site safe, such as checking listings, handling reports, limiting login attempts and preventing abuse, and answering your questions via the contact form.
  • Legal obligation: when the police or another authority requests data on the basis of the law, for example in a case of fraud.

We never sell your data, do not use it for advertising and do not build profiles of you. No decisions about you are made by a computer alone: listings and reports are assessed by a person.

Who can see your data?

  • Other users see your name on your listings and in messages, your first name with a bid, and on your profile card: since when you have been a member, whether your email address is confirmed, how many listings you have online and your garage. Your email address is never visible.
  • The administrator can view listings and reports. The administrator only reads a conversation if it has been reported, in order to assess the report.

Who do we work with?

We use a few services from other companies. Agreements about your data have been (or are being) made with them.

  • Supabase – database, login and photo storage. Our data is stored on servers in Frankfurt (Germany, EU).
  • Brevo – sending the site's emails.
  • ImprovMX – forwarding email sent to info@debromfietsbeurs.nl.
  • PDOK (Dutch Land Registry) – looking up a town; only the place name is sent.
  • Open-Meteo – the weather on My account; only the rounded location of your town is sent, no name or other details.
  • Google (Gmail) – email you send to info@debromfietsbeurs.nl arrives in our Gmail inbox.
  • Vercel – hosting the site. The site runs on servers in Frankfurt (Germany, EU).
  • Cloudflare Turnstile – the robot check when logging in, signing up, resetting a password and deleting an account. To do this, Cloudflare looks at technical details of your browser and your IP address; no advertising cookies are set and you do not have to click on pictures.

These parties may only use your data to provide their service to us. Some of them are (also) based in the United States (Supabase, Vercel, Cloudflare, ImprovMX and Google). Data that leaves the European Union is protected by the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long do we keep your data?

  • For as long as your account exists. If you delete your account, we erase your profile, listings, photos, messages, bids, garage, saved searches and favourites.
  • From a deleted account we only keep an anonymous record (the month you signed up, the number of listings and, if given, the reason for leaving), without name or email address.
  • We also keep reports about a user if that user leaves, so we can prevent abuse.
  • We keep contact messages and resolved reports for no more than two years.
  • Fingerprints of failed login attempts are deleted after one day.

Cookies and storage in your browser

We only use strictly necessary cookies: to keep you logged in and to remember the language you have chosen. We do not use cookies for advertising or tracking, and no third-party analytics services.

In addition, we store a few things only in your own browser, such as the listings you recently viewed and when you last looked at your notifications. This data never reaches us. You can clear it via your browser settings.

Your rights

You have the following rights. You can arrange most of it yourself on My account:

  • Access and portability: want to know which data we hold about you, or receive it in a file? Send an email to info@debromfietsbeurs.nl from the email address of your account. That way we know the request really comes from you. You will receive an answer within one month.
  • Rectification: you change your name and town under Profile, your listings under My listings.
  • Erasure: you delete your account and everything that belongs to it yourself via My account.
  • Objection and restriction: do you disagree with a use of your data, or would you like us to pause while we look into something? Email us.

For requests you cannot handle yourself, email info@debromfietsbeurs.nl. We respond within one month. Do you disagree with how we handle your data? Then you can file a complaint with the Dutch Data Protection Authority, Autoriteit Persoonsgegevens.

Age

You can create an account from the age of 16. If you are under 18, talk to your parents or guardian before you buy or sell anything.

Security

Your password is stored encrypted, connections are secured, and the database only shows each user their own data. Photos in messages are private. You can add extra protection to your account with two-step verification. The administrator account is always protected with two-step verification.

If something does go wrong and personal data could fall into the wrong hands (a data breach), we report it to the Dutch Data Protection Authority within 72 hours. If this puts you at high risk, we will also let you know as soon as possible.

Changes

If we change this statement, you will see it here by the date at the top. For major changes we will let you know. Questions? Contact us.