Privacy Policy

1. Controller

The imprint gives the name and postal address of the controller of this website.

2. Data processed to provide the website and to create log files

a. Which data is processed, and for what purpose?

Each access to the website's content temporarily stores data that may allow identification. The following data is collected:

• Date and time of access
• IP address
• Host name of the accessing computer
• Website from which the website was accessed
• Websites accessed through the website
• Page visited on our website
• Message whether the request succeeded
• Amount of data transferred
• Browser type and version
• Operating system

The temporary storage of the data is necessary for the course of a website visit, to deliver the website. Further storage in log files ensures the website works and keeps the IT systems secure. These purposes are also our legitimate interest in processing the data.

b. On what legal basis is this data processed?

The data is processed on the basis of Art. 6(1)(f) GDPR.

c. Are there recipients of the personal data besides the controller?

The website is hosted by netcup. netcup receives the data listed above as a processor (see section 4).

d. How long is the data stored?

The data is deleted as soon as it is no longer needed for the purpose for which it was collected. For providing the website, this is the case when the respective session ends.

The log files are kept for 48 hours. They are processed by Logz.io (www.logz.io).

3. Data for the GroLi account

A household owner signs in to GroLi with their email address. We store this email address permanently for as long as the account for the app exists.

4. External service providers

We use the following service providers as processors under Art. 28 GDPR.

a. netcup – server hosting

netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany (www.netcup.de). netcup runs the servers this website is hosted on and processes the access data listed in section 2. The processing is based on a data processing agreement under Art. 28 GDPR and our legitimate interest under Art. 6(1)(f) GDPR. netcup stores the data only as long as operating and securing the servers requires. Details are in netcup's privacy policy.

b. Infomaniak – email delivery

Infomaniak SA, 26 Avenue de la Praille, 1227 Carouge (Geneva), Switzerland (www.infomaniak.com). Infomaniak sends the emails you trigger through the forms of this website – for example activation and sign-in links and messages from the contact form. In doing so, it processes the recipient address, the subject and the content of each email. The processing is based on a data processing agreement under Art. 28 GDPR and our legitimate interest under Art. 6(1)(f) GDPR. Infomaniak stores the emails only for delivery. Details are in Infomaniak's privacy policy.

c. Friendly Captcha – protection against automated requests

Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany (www.friendlycaptcha.com). Friendly Captcha checks the solutions of the CAPTCHA tasks in the forms of this website. It processes the IP address – only as a hash – and technical details of your browser. It sets no cookies and stores no data permanently. The processing is based on a data processing agreement under Art. 28 GDPR and our legitimate interest under Art. 6(1)(f) GDPR. Details are in Friendly Captcha's privacy policy.

d. Logz.io – log processing

Logshero Ltd. (Logz.io), HaMasger St 35, Tel Aviv-Yafo, Israel (www.logz.io). Logz.io processes this website's log files (see section 2d) and keeps them for 48 hours. The processing is based on a data processing agreement under Art. 28 GDPR and our legitimate interest under Art. 6(1)(f) GDPR. Details are in Logz.io's privacy policy.

5. Your rights as a data subject

a. Right of access

Under Art. 15 GDPR, you can request information about the personal data we process about you.

b. Right to object

You have a right to object on particular grounds (see section II).

c. Right to rectification

If the data concerning you is not (or no longer) accurate, you can request its rectification under Art. 16 GDPR. If your data is incomplete, you can request its completion.

d. Right to erasure

Under Art. 17 GDPR, you can request the erasure of your personal data.

e. Right to restriction of processing

Under Art. 18 GDPR, you have the right to request the restriction of the processing of your personal data.

f. Right to lodge a complaint

If you believe that the processing of your personal data violates data protection law, you have the right under Art. 77(1) GDPR to lodge a complaint with a data protection supervisory authority of your choice. This includes the supervisory authority responsible for the controller: Der Landesbeauftragte für den Datenschutz Niedersachsen (the State Commissioner for Data Protection of Lower Saxony), www.lfd.niedersachsen.de.

g. Right to data portability

Where the conditions of Art. 20(1) GDPR are met, you have the right to have data that we process automatically on the basis of your consent or to perform a contract handed over to you or to a third party. Collecting the data to provide the website and storing the log files are strictly necessary to operate the website. They are therefore not based on consent under Art. 6(1)(a) GDPR or on a contract under Art. 6(1)(b) GDPR, but are justified under Art. 6(1)(f) GDPR. The conditions of Art. 20(1) GDPR are therefore not met in this respect.

6. Cookies

This website uses exactly one cookie. When you sign in, your browser stores a small piece of data on your device. It holds only a random code that tells the website on every page you open: “This is the signed-in user.” That way you stay signed in while you move around the site.

Other websites cannot read the cookie, and we never use it for advertising or analytics. It is technically necessary to keep your session working, so it is set under Art. 6(1)(f) GDPR. It expires 10 minutes after your last activity, at the latest one hour after you signed in. Signing out deletes it right away.