Email: info@commodity-board.com
Phone: +49 40 808 13 965
We take the protection of your personal data very seriously. In the following, we inform you about the processing of personal data when using our websites (including “Commodity Board News”, “CMBroker”, “CMB Supplier”), newsletters, digital products and other related services.
This Privacy Policy complies with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable regulations.
1. Controller
Commodity Board Europe GmbH
Pestalozzistr. 25
22305 Hamburg
Germany
Email: michael.guetlich@cmb-hamburg.com
Phone: +49 40 808 13 965
Data Protection Officer:
Michael Gütlich (reachable via the above contact details)
2. Definitions
Terms used in this Privacy Policy (e.g. “personal data”, “processing”, “controller”, “processor”, “recipient”, “consent”) follow the definitions of Art. 4 GDPR.
3. Categories of Personal Data We Process
We may process the following categories of data:
3.1 Registration and Account Data
- Name, email address, company name, address
- Phone number
- User type (buyer, supplier, broker, member)
- Login credentials (hashed)
3.2 Contract and Transaction Data
- Orders, subscriptions, payment data
- Contract history
- Offers, bids, auction participation
- Trade history (anonymised where required)
3.3 Technical Data
- IP address, device information
- Server log files
- Cookies
- Tracking IDs for usage analysis
3.4 Communication Data
- Emails, contact form entries
- Newsletter subscription data
- Marketing preferences
3.5 Data from our Trading Platforms
- Information provided by the user on CMBroker or CMB Supplier
- Offers, requests, product specifications
- Transportation & delivery data (without private information)
4. Legal Bases for Processing
We process data on the following legal bases:
- Art. 6(1)(a) GDPR – Consent
- Art. 6(1)(b) GDPR – Contract initiation/performance
- Art. 6(1)(c) GDPR – Legal obligation
- Art. 6(1)(f) GDPR – Legitimate interest (operation of websites, security, fraud prevention, analytics, marketing)
5. Processing Purposes
5.1 Providing Websites & Digital Platforms
Operation of:
- Commodity Board News
- CMBroker
- CMB Supplier
5.2 Fulfilment of orders and subscriptions
5.3 User registration & account management
5.4 Trading, auction and contract processing
For registered, authorized brokers and suppliers.
5.5 Newsletter & marketing communication
Only with explicit consent.
5.6 Data analysis & forecasting (AI)
We use partly automated processes (incl. AI models) to analyse market trends, prices, forecasts. No automated decision-making with legal effect occurs.
5.7 Security & fraud prevention
We use Sentry (Functional Software Inc.) to detect and fix technical errors. This may process technical metadata such as IP address, browser type, and error stack traces. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in service stability and security).
6. Cookies & Tracking Technologies
We use:
- Session cookies
- Third-party cookies
- Analytics tools (Google Analytics, etc.)
- reCAPTCHA
- YouTube embeds
Legal bases: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR. Consent via cookie banner: Art. 6(1)(a) GDPR.
Cookie-free reach measurement: Independently of the services above, we count visits to our pages ourselves. Only daily totals are stored: views per page, the origin of the visit (referring website or campaign parameters such as utm_source in the link), the country (only the country code, derived from the IP address), requests for pages that do not exist (404), and fetches by search engines, AI crawlers and AI assistants. Counting takes place in our content delivery network (Cloudflare, Inc., as processor). Only counts are sent to our server cmbroker.cloud, no IP address and no browser identifier.
Visitors per day: To count how many different visitors came on a given day, we compute a one-way hash from the IP address, the browser identifier (user agent) and the date using a secret key. We do not store the IP address or the browser identifier. Before storage, the hash is hashed again with a random value that is created each day and deleted afterwards. Once this random value has been deleted (at the latest after two days), the hash can no longer be traced back to you, not even with the key. The hash itself is deleted when the day is summed up, at the latest after two days. Only the number of visitors remains. We therefore cannot recognise returning visitors.
Read depth and loading time (only with consent): If you have allowed "Analytics" in the consent dialog, a small script sends to our server, when you leave a page, which page it was, how far you scrolled, how long the page was visible and how fast it loaded (Core Web Vitals). The script sets no cookie, stores nothing on your device and sends no identifier. This, too, only becomes daily totals. Legal basis: your consent, Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time via "Cookie settings" in the footer.
Links to cmbroker.cloud: When you click a link to our platform cmbroker.cloud, we add campaign parameters naming the article page you came from. This shows us which articles lead to registrations or enquiries. The parameters contain no information about you.
Legal basis for the remaining reach measurement: Art. 6(1)(f) GDPR. Our legitimate interest is to measure and improve the reach of our service. You may object to this processing under Art. 21 GDPR. The easiest way is to enable Global Privacy Control or "Do Not Track" in your browser: we then compute no hash, determine no country and accept no data from the script; your visit only counts as a page view. You can also object informally using the contact details above.
7. Data Transfer to Third Parties
7.1 Transfer to Strategic Partners
We may transfer business contact data of our registered users (name, business email address, company name, position) to selected strategic partners for the purpose of:
- providing extended market intelligence,
- offering co-branded market insights or data services,
- enabling sector-relevant information distribution,
- improving the relevance of Commodity Board services.
Legal basis: Your consent under Art. 6(1)(a) GDPR, obtained during registration or newsletter signup.
Users may withdraw consent at any time (Art. 7(3) GDPR).
7.2 Co-Branded Communication
If you register for newsletters or market updates, we may send co-branded communication including information from selected partners. Your address remains with Commodity Board unless explicitly authorised otherwise.
Legal basis:
- Art. 6(1)(a) GDPR (Newsletter consent)
- Art. 6(1)(f) GDPR (co-branded information in existing newsletters)
7.3 Processors
We use service providers for:
- hosting (Fly.io, Inc., servers in Frankfurt am Main)
- content delivery network and reach counting (Cloudflare, Inc.)
- newsletter systems
- analytics
- payment processing
- communication channels (WhatsApp Business API)
All are bound by Art. 28 GDPR DPA contracts.
8. International Data Transfers
Transfers outside the EU only occur:
- with adequacy decisions
- or Standard Contractual Clauses (SCC)
- or explicit consent
Cloudflare, Inc. and Fly.io, Inc. are based in the USA. Transfers are based on the EU-US Data Privacy Framework (adequacy decision of 10 July 2023), under which both are certified, and additionally on Standard Contractual Clauses.
9. Storage Duration
Data is stored:
- as long as necessary for the purpose
- or until legal obligations end
- or until the user revokes consent
10. User Rights
(Art. 15–21 GDPR)
Right to:
- access
- rectification
- deletion
- restriction
- data portability
- objection
- withdrawal of consent
- lodge a complaint
11. Newsletter Opt-In
Explicit double opt-in required. Unsubscribing is possible anytime.
12. Deletion of Accounts
On request or in case of violation.
13. Data Security
SSL encryption, role-based access (RBAC), internal policies.
14. YouTube API Services
Our editorial team publishes videos on our own YouTube channels "CMB News Europe" and "CMB News Deutschland". For this we use the YouTube API Services. By watching our videos on YouTube or embedded on this website, you are also subject to the YouTube Terms of Service and the Google Privacy Policy.
Our publishing system connects only to our own YouTube channels, authorised by our own staff through Google sign-in (OAuth 2.0). Via the YouTube API Services we upload videos, captions and thumbnails and read the basic information (name and ID) of our own channels. We do not access, collect, store or share data of YouTube viewers or of other YouTube accounts.
We store the access tokens for our channels in encrypted form; when a channel is disconnected we revoke them at Google and delete them. Video IDs and links of our uploads are kept as long as the videos are published. Access granted to our application can be revoked at any time via the Google account security settings. For questions or deletion requests, contact us using the details in section 1.
15. Changes to the Privacy Policy
We reserve the right to update this policy; users will be informed.