Skip to content
RFQGuard

Privacy policy

1. General information and controller

(1) This statement explains what personal data is processed when you use this website, on what legal basis, who receives it and for how long it is kept. It covers this website only. Where you follow a link away from it, the privacy terms of the site you arrive at apply from that point on.

(2) Personal data is processed in accordance with the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The storage of, and access to, information on your terminal equipment is governed by Section 25 TDDDG.

(3) The controller within the meaning of Art. 4(7) GDPR is:

hytrade24 GmbH
Merkurstraße 52
D-67663 Kaiserslautern
Telephone: +49 631 370 926 95
E-mail: info@hytrade24.com

(4) What this website is. RFQGuard publishes alerts about fraudulent requests for quotation, and lets anyone check a part number, a supplier domain or a VAT identification number against public sources. It is built to need as little data about its visitors as possible: there are no user accounts, no newsletter, no shop, no advertising, no analytics and no social plugins; no external fonts, maps or videos are embedded; and no visitor is asked for their name or e-mail address anywhere on the site, including in the report form.

2. Server log files

(1) Purpose of processing. Each time a page is requested, the hosting provider’s web server records technical access data: the IP address of the requesting device, the date and time of the request, the resource requested, the status and volume of the response, the referring page where one is transmitted, and the browser and operating system identification. This is necessary in order to deliver the page at all, to keep the server stable, and to detect, limit and trace attacks.

(2) Legal basis. Art. 6(1)(f) GDPR.

(3) Legitimate interest. The secure, stable and technically correct operation of the website.

(4) Recipients. Our hosting provider lima-city, a service of TrafficPlex GmbH, Konsul-Smidt-Str. 90, 28217 Bremen, Germany, which processes this data on our behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. The servers are located in Germany. Log files are not passed to anybody else, except where we are obliged to disclose them.

(5) Storage period. Access data is kept only for as long as it is needed for the purposes set out above and is then deleted. It is not combined with any other source of data, and it is not used to identify individual visitors.

(6) Right of objection. You may object to this processing at any time under Art. 21(1) GDPR on grounds relating to your particular situation. Note that access data is required in order to serve a page at all, so an objection cannot be given effect while you are using the site.

3. Cookies and storage on your device

(1) This website uses no analytics, advertising, tracking or profiling cookies, sets no pixels or beacons, and builds no user profiles. Two things are stored on your device, and both are described below.

(2) The hosting platform’s bot filter. Our hosting provider operates an automated filter that distinguishes real browsers from programs imitating them, so that the site is not overwhelmed by automated requests and so that the report form can be used by people rather than by robots. It stores the outcome of that test in a cookie:

  • Name: _lcp (the provider also documents _lcp2 and _lcp3 for the same purpose)
  • Set by: the hosting platform, not by this website’s own software
  • Content: a single letter, recording that the browser passed the test. It carries no identifier and no information about you
  • Purpose: protection against automated requests, spam and attacks
  • Properties: path /, HttpOnly, SameSite=Lax
  • Duration: it is set to expire on 20 March 2034 and remains on your device until then, or until you delete it

(3) Because it carries no identifier, this cookie cannot be used to recognise, count or follow a visitor, and it is not read for any such purpose.

(4) The cookie banner. We use Real Cookie Banner, a consent management tool by devowl.io GmbH, to ask for and document consent decisions. It runs entirely on our own web space; no consent data is transmitted to the maker of the plugin or to any other third party. When you make a choice in the banner, it stores that choice on your device and records it on our server:

  • Name: cookies and local storage entries beginning real_cookie_banner
  • Content: a randomly generated identification number for the consent itself, the version of the banner you were shown, and which services you accepted or refused
  • Purpose: to remember your decision so you are not asked again, and to document it as Art. 7(1) GDPR requires
  • Duration: up to 365 days on your device

(5) What the consent record contains. Alongside your decision, the record holds the time it was given, the page you were on, the size of your browser window, and the links to this statement and to the imprint that were shown to you at the time. Storage of IP addresses in the consent record is switched off. The record identifies a consent, not a person.

(6) Legal basis. For the bot filter and for storing your consent decision: Section 25(2) no. 2 TDDDG, storage that is strictly necessary in order to provide the service you have expressly requested, together with Art. 6(1)(f) GDPR so far as personal data is processed as a consequence. For keeping the record of that decision: Art. 6(1)(c) GDPR, since Art. 7(1) GDPR requires us to be able to demonstrate it.

(7) Right of objection. You can change or withdraw your consent decision at any time through the banner’s settings, with effect for the future. You can delete cookies at any time in your browser, and set your browser to refuse them. Refusing them does not prevent you from using this website.

4. Security and defence against attacks

(1) Purpose of processing. This site publishes alerts about attempted fraud, which makes it a target. We therefore operate a security plugin, Wordfence, which examines incoming requests and blocks those that match known attack patterns, and which guards the administrator login against brute-force attempts.

(2) What is processed. For each request examined: the IP address it came from, the address requested, the transmitted headers and, where a request is treated as an attack, its content. Ordinary reading of the site produces nothing beyond what section 2 already describes.

(3) Legal basis. Art. 6(1)(f) GDPR. The legitimate interest is defending the site, its published evidence and the reports entrusted to it against attack and unauthorised access.

(4) Recipients. The plugin runs on our own server. It obtains its list of known attackers from Defiant, Inc., 1700 Westlake Ave N, Suite 200, Seattle, WA 98109, USA, the maker of Wordfence, and reports blocked attacks back to it so that the list stays current. Where that happens, the IP address of the blocked request is transmitted to the USA; see section 9.

(5) Storage period. Blocked-request records are kept on our server only for as long as they are useful for recognising a continuing attack, and are overwritten as newer ones arrive.

(6) Right of objection. You may object under Art. 21(1) GDPR on grounds relating to your particular situation. A site that publishes allegations about named businesses cannot be operated without this protection, so an objection cannot be given effect for requests that the filter treats as an attack.

5. The check (part number, domain and VAT number lookup)

(1) Purpose of processing. Where you enter a part number, a supplier domain or a VAT identification number into the check box, that term is used to search this site’s own published alerts and, where nothing is found there, to interrogate public sources about the term, so that the page can tell you what is publicly known about it.

(2) What is processed. The term you enter, and the technical access data described in section 2. The check asks you for nothing else — no name, no e-mail address, no account. Please do not enter other people’s personal data into the check box. This site documents businesses, not individuals.

(3) Legal basis. Art. 6(1)(f) GDPR. The legitimate interest is answering the question you have asked, and protecting businesses against payment fraud.

(4) Recipients. The enquiries are made by our server, not by your browser. Your IP address is therefore not disclosed to any of the services below. What reaches them is the term being checked, together with our server’s own address and the identification RFQGuard. Depending on what you entered and on what the earlier steps returned, the following may be asked:

  • Domain registries and registrars, over the RDAP protocol (including rdap.org, Verisign, Public Interest Registry, ARIN and RIPE NCC, and the directory of registries published at data.iana.org) — asked when a domain was registered, by which registrar, and what its name servers are.
  • The European Commission’s VIES service (ec.europa.eu) — asked whether a VAT identification number is valid. No registration, no key, no charge.
  • Serper (google.serper.dev), a search interface to Google — asked which websites list a part number. It is asked only where what you entered has the shape of a part code, and never for a domain or a confirmed VAT number.
  • Google Safe Browsing (safebrowsing.googleapis.com) — asked whether a domain is listed as malicious.
  • crt.sh, the public certificate transparency logs — asked when certificates were first issued for a domain.
  • The Internet Archive (web.archive.org) — asked when a website was first archived.
  • The website being checked, whose home page and legal notice are retrieved so that the details it publishes about itself can be read.

(5) Search links offered on a miss. Where a check finds nothing, the page offers you ready-made links to Google, Bing and DuckDuckGo so that you can search for the term yourself. These are ordinary links and nothing is sent to those search engines unless you follow one; the links are marked so that your browser does not disclose the page you came from. If you do follow one, your IP address and the term reach that search engine, and its own privacy terms apply from that point.

(6) Transfers to third countries. See section 9.

(7) Storage period. Answers are cached on our own server against the term, not against you: a cached registry record, search result or advisory is shared by everybody who looks up the same term, and holds nothing whatever about the person whose request caused it to be fetched. Cache lifetimes run from fifteen minutes to several days, depending on how quickly the source’s answer can change.

(8) Rate limiting. So that the check cannot be used to run up cost at our expense, a counter is kept per visitor per hour. Its key is a one-way hash of your IP address combined with a secret unique to this installation; the IP address itself is never written down in readable form, and the hash cannot be turned back into an address by anyone who does not hold that secret. Each hourly counter is discarded when its hour ends.

6. The report form

(1) Purpose of processing. What you submit through the report form is processed in order to assess whether a request for quotation is fraudulent and, where it is, to publish an alert about it.

(2) What is asked — and what is not. The form asks for the part number you were asked to quote, the supplier or buyer domain, a free-text description of what happened, and the original e-mail, supplied either as a saved file or as its technical header text pasted into the form. It does not ask for your name, your e-mail address, your telephone number, your company or any other identifying detail, and there is no account to create. You can report a fraud without telling us who you are.

(3) Providing this data is entirely voluntary. You are under no statutory or contractual obligation to report anything to us, and there is no contract between us that requires it. If you choose not to submit a report, or to leave parts of it out, you suffer no disadvantage of any kind; the only consequence is that we may be unable to assess the case.

(4) What you may be supplying without meaning to. An e-mail’s technical header block, and an e-mail saved as a file, normally contain the addresses of everyone the message passed through — which usually includes your own address and your mail server’s internal addresses. Where that is so, you are supplying that data to us by sending it. Remove anything you do not wish us to hold before you send it, and do not include your customers’ personal data.

(5) The file you attach is never written to our disk. Where you attach a saved message, it is read in memory during the request, the technical header text is extracted from it, and the file itself is discarded when the request ends. Only the extracted text is stored.

(6) Legal basis. Art. 6(1)(f) GDPR. The legitimate interest is the assessment and public documentation of attempted fraud against businesses.

(7) Recipients. The report is stored in this website’s database at the hosting provider named in section 2(4), and a notification is sent by e-mail to the address at hytrade24 GmbH that watches the report queue. It is not passed to anybody else. Where a report becomes an alert, what is published from it is governed by section 7.

(8) Storage period. A report is kept while it is being assessed. Where it leads to a published alert, the report and its evidence are kept for as long as that alert remains published, because they are what substantiates it. Where it does not lead to an alert, it is deleted once the assessment has been concluded.

(9) Abuse prevention. The form carries a field hidden from people and visible to form-filling robots, and records the time at which it was served. In addition, a submission marker is held for ten minutes per visitor, keyed by the same one-way hash described in section 5(8); the IP address itself is never stored in clear text.

7. Publication of alerts, and data concerning third parties

(1) Purpose of processing. This site publishes alerts so that businesses receiving a request for quotation can find out, before they ship goods or pay an invoice, what is publicly known about the party that sent it.

(2) What is published. Supplier and buyer domains, part numbers, registry data about a domain (its creation date, registrar and name servers), what public sources say about it, and role-based company e-mail addresses such as info@ or sales@ where these form part of the evidence. Personal data of identifiable natural persons is not published. E-mail addresses that identify a person are masked wherever the site prints them, and the programming interfaces that could otherwise have returned them are closed to anyone not signed in with editorial rights.

(3) Where this data comes from. It reaches us from two kinds of source: reports sent to us by the businesses that were approached, and publicly accessible sources — domain registries, the VIES register, certificate transparency logs, web archives, search results and the checked website’s own pages. Nothing in an alert is obtained from the party it concerns.

(4) Information to the parties named. Art. 14 GDPR requires us to inform a person whose data we obtained elsewhere. Where a domain is registered behind a privacy service or a role address, we have no means of reaching anyone behind it, and identifying them would require effort out of all proportion to the purpose, so we rely on Art. 14(5)(b) GDPR and publish this statement instead. Every alert names the address below for objections and corrections, which is how a party named in one learns what we hold and can have it put right.

(5) No alert is published automatically. Every alert is read and released by a person before it becomes public.

(6) Archived copies. Because fraudulent websites are taken down once they have served their purpose, we may ask the Internet Archive to record a copy of a site an alert concerns, so that the evidence survives. This is done by an editor when an alert is prepared, never by a visitor’s check, and the copy is then held by the Internet Archive under its own terms.

(7) Legal basis. Art. 6(1)(f) GDPR — the legitimate interest of businesses in being warned against financial loss — read together with the freedom of expression and information (Art. 11 of the Charter of Fundamental Rights, Art. 5(1) of the German Basic Law; see Art. 85 and Art. 17(3)(a) GDPR).

(8) Storage period. For as long as the warning retains value for the businesses it is addressed to, and no longer.

(9) Right of objection and correction. Anyone named in an alert may object at any time under Art. 21(1) GDPR on grounds relating to their particular situation, and may ask for a correction by writing to info@hytrade24.com — the address behind the “Request a correction” link at the foot of every page and every alert. Every such request is checked, and anything that turns out to be wrong is corrected or removed.

8. Donations through external providers

(1) Donations are handled through Ko-fi, PayPal and Stripe. These appear on this site as ordinary links: no button, script, pixel or frame belonging to those providers is embedded in any page here, so nothing is transmitted to them while you are merely reading the site.

(2) Following a donation link takes you off this website, and from that point the privacy terms of the provider you have arrived at apply. No payment data is collected, transmitted or processed on this website, and we receive no payment details from the provider.

(3) Legal basis for placing the links: Art. 6(1)(f) GDPR — the legitimate interest in financing the operation of the site.

9. Recipients in third countries

(1) Two kinds of processing described above can send data outside the European Economic Area, in particular to the United States: the enquiries to public sources listed in section 5(4), and the reporting of blocked attacks described in section 4(4).

(2) What is transferred by a check is the term being checked, together with our server’s own address. No visitor’s IP address, and no other visitor data, is transmitted to the services listed in section 5(4). In most cases the term is a company domain, a part number or a VAT number and is not personal data at all.

(3) Where an adequacy decision applies. Several of these recipients are certified under the EU–US Data Privacy Framework, for which the European Commission has adopted an adequacy decision under Art. 45(1) GDPR. A transfer to a certified recipient needs no further safeguard.

(4) Where it does not. For the security plugin’s attacker list, the transfer is governed by the standard contractual clauses adopted by the European Commission under Art. 46(2)(c) GDPR, which form part of that provider’s data processing terms. You may obtain a copy of these clauses by writing to info@hytrade24.com.

(5) Individual enquiries to public registers. Some of the sources in section 5(4) are public registers and archives that answer a single enquiry without any contractual relationship existing between us. Where such an enquiry contains personal data at all, we rely on Art. 49(1)(e) GDPR, the transfer being necessary for the establishment, exercise and defence of legal claims arising from attempted fraud. These enquiries are occasional, concern one term at a time, and never include data about the visitor who prompted them.

10. Contact by e-mail

(1) Purpose of processing. Where you write to us, the address you write from and the content of your message are processed in order to deal with your enquiry.

(2) Legal basis. Art. 6(1)(b) GDPR where your enquiry concerns a contract or steps taken prior to one; otherwise Art. 6(1)(f) GDPR, the legitimate interest being to answer enquiries addressed to us.

(3) Storage period. Until the matter your message concerns has been dealt with in full, unless commercial or tax law requires the correspondence to be retained for longer.

11. Rights of the data subject

Where your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against the controller named in section 1.

1. Right of access

You may request confirmation as to whether personal data concerning you is being processed and, where it is, information about: the purposes of the processing; the categories of data concerned; the recipients or categories of recipient to whom it has been or will be disclosed; the envisaged storage period or the criteria used to determine it; the existence of the rights to rectification, erasure, restriction of processing and objection; the right to lodge a complaint with a supervisory authority; all available information as to the origin of the data where it was not collected from you; and the existence of automated decision-making including profiling, together with meaningful information about the logic involved. Where data is transferred to a third country, you may ask to be informed of the appropriate safeguards under Art. 46 GDPR.

2. Right to rectification

You may require the rectification without undue delay of inaccurate personal data concerning you, and the completion of incomplete data.

3. Right to restriction of processing

You may require processing to be restricted where you contest the accuracy of the data, for a period enabling its accuracy to be verified; where the processing is unlawful and you oppose erasure and request restriction instead; where we no longer need the data but you require it for the establishment, exercise or defence of legal claims; or where you have objected under Art. 21(1) GDPR and it has not yet been established whether our legitimate grounds override yours. Restricted data may, apart from storage, be processed only with your consent or for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest.

4. Right to erasure

a) Obligation to erase. You may require the erasure of personal data concerning you without undue delay where the data is no longer necessary for the purposes for which it was collected; where you withdraw a consent on which the processing was based and there is no other legal ground; where you object under Art. 21(1) GDPR and there are no overriding legitimate grounds, or you object under Art. 21(2) GDPR; where the data has been processed unlawfully; where erasure is required to comply with a legal obligation; or where the data was collected in relation to information society services offered to a child.

b) Information to third parties. Where we have made the data public and are obliged to erase it, we will take reasonable steps, including technical measures, to inform other controllers processing it that you have requested the erasure of any links to, or copies of, that data.

c) Exceptions. The right to erasure does not apply so far as processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation or the performance of a task carried out in the public interest; for reasons of public interest in the area of public health; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, where erasure would render the objectives of that processing impossible or seriously impair them; or for the establishment, exercise or defence of legal claims.

5. Right to be informed

Where you have exercised the right to rectification, erasure or restriction of processing, we will communicate that rectification, erasure or restriction to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort. You may ask to be informed of those recipients.

6. Right to data portability

You may receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and transmit it to another controller without hindrance, where the processing is based on consent or on a contract and is carried out by automated means. You may require the data to be transmitted directly from one controller to another where this is technically feasible. This must not adversely affect the rights and freedoms of others.

7. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. We will then no longer process that data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where data is processed for direct marketing purposes, you may object at any time and it will no longer be processed for those purposes; no such processing takes place on this website. You may exercise the right to object by any means, including by an automated procedure using technical specifications.

8. Right to withdraw consent

Where processing is based on your consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal. You can reach your consent decision for this website at any time through the cookie banner’s settings.

9. Automated decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where the decision is necessary for entering into or performing a contract, is authorised by Union or Member State law with suitable safeguards, or is based on your explicit consent.

The check described in section 5 produces its findings automatically, and the findings concern businesses, domains and public records. No decision concerning a person is taken automatically on this website, no visitor is profiled, and no alert is published without a person having read and released it.

10. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR. The supervisory authority will inform you of the progress and outcome of your complaint, including the possibility of a judicial remedy under Art. 78 GDPR.

The supervisory authority competent for the controller named in section 1 is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz

12. Changes to this statement

We keep this statement up to date as the site changes. The version below is the one currently in force; where a change materially affects how your data is processed, it takes effect only from the date stated.

Version of 23 September 2026

Responsible for data processing

hytrade24 GmbH
Merkurstraße 52
D-67663 Kaiserslautern
Telephone: +49 631 370 926 95
E-mail: info@hytrade24.com