Privacy Policy

Last updated: 5 July 2026 Website: https://colcur.com Operator (data controller): Expanse UG (haftungsbeschränkt) & Co. KG, Bavariastr. 15, 80336 München, Germany Privacy contact: privacy@colcur.com

This Privacy Policy explains what personal data we process when you visit colcur.com, why, on what legal basis, who we share it with, how long we keep it, and the rights and choices you have. It is written to meet the EU General Data Protection Regulation (GDPR), the German Telecommunications-Telemedia Data Protection Act (TTDSG), and US state privacy laws including the California Consumer Privacy Act as amended by the CPRA (together, "CCPA").

Our full legal disclosure is in our Imprint.

1. Who we are

colcur.com is operated by Expanse UG (haftungsbeschränkt) & Co. KG ("colcur", "we", "us"), a company based in Munich, Germany. We are the "controller" of your personal data under the GDPR and the "business" under the CCPA.

Our servers and primary infrastructure are hosted in Germany / the European Union. Some of the third-party tools described below are operated by companies in the United States; where that involves a transfer of personal data, we rely on the safeguards described in Section 9.

colcur.com is a search engine over certified-coin (slab) listings on eBay. We help you find and understand listings; you transact on eBay. We are not a marketplace and do not process payments.

2. How our privacy approach depends on where you are

We tailor our data practices to your region, which we infer from your IP address country (provided to us by our CDN, Cloudflare — we do not store your IP address for this purpose beyond the request):

• European Economic Area, United Kingdom, and Switzerland — consent first. No analytics or advertising cookies or similar technologies load until you accept them in our consent banner. Only strictly necessary and functional cookies (Section 4) are set beforehand.
• United States and the rest of the world — opt-out. Analytics and advertising technologies load by default, and you can opt out at any time using the "Your Privacy Choices" control in our footer or by sending a Global Privacy Control (GPC) browser signal, which we honor automatically.

3. Categories of personal data we process

• Online identifiers and device data: a first-party random identifier we generate (see Section 5), cookie identifiers, browser type, operating system, screen size, and — only transiently, to route your request and infer your region — your IP address.
• Usage data: pages viewed, searches run, result cards seen, links clicked (including outbound clicks to eBay), referring website, and approximate interaction behavior (including, where enabled with your consent, session replays and heatmaps).
• Approximate location: country-level location inferred from your IP address.
• Contact data: your email address, if you ask us to notify you about a saved search or listing, or if you create an account.
• Communications: the content of any message you send us.

We do not intentionally collect special-category / sensitive personal data, and we do not knowingly collect data from children (Section 12).

4. Cookies and similar technologies

We use cookies and similar browser-storage technologies. The strictly necessary and functional ones below are set without consent because they are required to operate the site or to record your own privacy choices; all analytics/advertising technologies are governed by Section 2.

You can also block or delete cookies in your browser settings; some site functions may then work less well.

5. First-party measurement (colcur_cid)

To measure how visitors move through our own pages and out to eBay listings, we set a first-party functional identifier named colcur_cid (plus a short-lived session_id). These are server-generated random values — they are not derived from your device, browser fingerprint, name, or IP address, and we do not build a fingerprint.

• Purpose: measuring our own funnel — page views, searches, result views, outbound clicks, and saved searches — and attributing affiliate conversions.
• Pseudonymous: the identifier is a random value that is not linked to your name or email and is not sold.
• Region rules apply: for consent-first regions this measurement runs only after you accept our banner; for opt-out regions you can turn it off via "Your Privacy Choices" or GPC.

6. Analytics and advertising tools

Subject to the region rules in Section 2, we use the following third-party tools. Each sets its own cookies/identifiers and acts as an independent controller or our processor for the data it collects.

• Google Analytics 4 (Google Ireland Ltd. / Google LLC) — traffic and usage analytics. Opt out via the Google Analytics Opt-out Browser Add-on.
• Microsoft Clarity (Microsoft Corporation) — heatmaps, scroll tracking, and session replays that help us improve usability. Clarity applies automatic masking to reduce capture of text you type. More information.
• Microsoft Advertising / UET (Microsoft Corporation) — measures conversions from our Microsoft (Bing) ad campaigns so we can understand which ads bring useful visitors.
• Reddit Pixel & Reddit Conversions API (Reddit, Inc.) — measures conversions from our Reddit ad campaigns. In addition to the browser pixel, we may share a limited set of conversion events with Reddit server-side via the Conversions API; identifiers shared this way (e.g. email address or IP address) are hashed (SHA-256) before transmission, and the browser user-agent is sent as-is. The same consent (EEA/UK/CH) and opt-out (US) rules as the other advertising tools apply.

The Microsoft Advertising and Reddit tools may involve sharing online identifiers with those platforms for cross-context behavioral advertising. See Section 10 (US rights) for how to opt out, and Section 2 for the EEA/UK/CH consent requirement.

7. Email, saved searches, and accounts

If you use a "save this search / notify me" feature, or create an account, we process your email address and the details of what you asked to follow, so we can send you the notifications you requested and operate the service. We do not use your email for unrelated marketing without your consent, and every notification includes an unsubscribe link. We use a transactional email provider to deliver these messages.

8. Affiliate links (eBay Partner Network)

colcur.com participates in the eBay Partner Network. When you click certain links and then buy on eBay, we may earn a commission at no extra cost to you. To attribute the commission, outbound links carry a tracking parameter, and eBay may set its own cookies under its own privacy policy. These commissions support the site and do not influence the information we present.

9. Legal bases (GDPR)

• Consent — Art. 6(1)(a) GDPR (and § 25(1) TTDSG for storage/access): all analytics and advertising technologies for visitors in the EEA, UK, and Switzerland; email notifications you opt into.
• Performance of a service you request — Art. 6(1)(b) GDPR: operating an account and sending saved-search notifications you asked for.
• Legitimate interests — Art. 6(1)(f) GDPR: operating and securing the site, preventing abuse, inferring your region to apply the correct privacy regime, and — outside the EEA/UK/CH — measuring and improving our service and advertising on an opt-out basis. You may object to processing based on legitimate interests (Section 11).

You can withdraw consent at any time with future effect (Section 13); this does not affect processing that already took place.

10. Who we share data with (recipients / subprocessors)

We do not sell your personal data for money. We disclose data to the following categories of recipients, only as needed for the purposes above:

• Analytics & advertising providers: Google, Microsoft, and Reddit.
• Infrastructure & delivery: Cloudflare (CDN, security, region signal), Hetzner (hosting, EU), and our transactional email provider.
• Affiliate network: eBay Partner Network / eBay.
• Authorities or advisors where required by law or to establish, exercise, or defend legal claims.

11. International data transfers

Some recipients (Google, Microsoft, Reddit, Cloudflare) are based in or process data in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V GDPR — the EU-US Data Privacy Framework (for certified recipients) and/or the European Commission's Standard Contractual Clauses, together with supplementary measures where needed. You can request more detail via privacy@colcur.com.

12. How long we keep data

• colcur_cid: up to 1 year; session_id: about 30 minutes of inactivity.
• Third-party analytics/advertising cookies: for the durations in Section 4, then per each provider's retention.
• Email / saved searches: until you unsubscribe, delete the item, or close your account, plus a short buffer for backups.
• Server logs: kept for a limited period for security and troubleshooting.

We keep data no longer than necessary for the purposes above or as required by law.

13. Your rights in the EEA, UK, and Switzerland (GDPR)

You have the right to: access your data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; and object to processing based on legitimate interests or to direct marketing. Where processing is based on consent, you may withdraw it at any time — reopen the cookie banner via "Your Privacy Choices" in the footer, or clear the ga_consent cookie.

To exercise any right, contact privacy@colcur.com. You also have the right to lodge a complaint with a supervisory authority — for us, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) — or with the authority where you live or work.

14. Your rights in the United States (CCPA/CPRA and similar state laws)

If you are a US resident, you have the right to know what personal information we collect and how we use and disclose it, to access and delete it, to correct it, and to be free from discrimination for exercising these rights.

• Categories collected: identifiers (including online identifiers), internet/network activity, approximate (country-level) geolocation, and — if you provide it — contact information. Sources: you, and your device/browser as you use the site. Business purposes: operating, measuring, securing, and improving the site and our advertising.
• "Sale" / "Sharing": we do not sell personal information for money. We do "share" online identifiers with advertising platforms for cross-context behavioral advertising (Section 6). You can opt out of this at any time.
• How to opt out: use "Your Privacy Choices" in our footer, or send a Global Privacy Control signal from your browser — we treat both as a valid opt-out. Opting out disables the third-party analytics and advertising technologies for you.
• Sensitive personal information: we do not use or disclose sensitive personal information for purposes that require an opt-out right.
• No financial incentives, and we do not knowingly sell or share the personal information of consumers under 16.

To exercise access, deletion, or correction rights, email privacy@colcur.com; we will verify your request as required by law. You may use an authorized agent.

15. Managing your choices

• Reopen the consent banner / change consent: use "Your Privacy Choices" in the footer.
• US opt-out: "Your Privacy Choices" or a GPC browser signal.
• Browser controls: block or delete cookies in your browser settings.
• Provider opt-outs: see the links in Section 6.

16. Children

colcur.com is intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact privacy@colcur.com and we will delete it.

17. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. No online service can be completely secure, but we work to keep your data safe and to limit what we collect.

18. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the site after an update means you accept the revised policy.

19. Contact

Expanse UG (haftungsbeschränkt) & Co. KG Bavariastr. 15, 80336 München, Germany Privacy: privacy@colcur.com

For our full legal disclosure, see the Imprint.