Privacy Policy – Siebenecken.app
Data Controller
Tourismusverband Sieben e.V.
Kreishausstraße 2–4
32312 Lübbecke
Represented by:
Chairperson: Kai Abruszat
Vice-Chairpersons: Dr. Henning Vieker and Marko Steiner
Managing Director: Clarissa Schablowski
Court of Registration: Bad Oeynhausen Local Court
Association Registration Number: 1741
Tax ID Number: 331/5851/0652
Phone: (0 57 41) 276-430
Email: tourismusverband@luebbecke.de
Website: www.muehlenkreis.de/Die-westfälischen-Sieben
Data Processors and Technical Service Providers
SCORTEX Technologies – Seeger & Krämer GbR
Desteler Straße 43
32351 Stemwede
Phone: 05745 910 900 0
Email: info@scortex.de
Website: scortex.de
Hetzner Online GmbH (Hosting Provider)
Industriestraße 25
91710 Gunzenhausen
Germany
Purposes and Legal Bases of Data Processing
The Progressive Web App Siebenecken.app processes personal data for the purposes described below and on the basis of the legal grounds specified in accordance with Art. 6 GDPR.
Hosting and Server Logs
Processing: The web server automatically collects information each time Siebenecken.app is accessed, including IP address, date and time of access, browser type, operating system, and referring page.
Purpose: To ensure the technical infrastructure, system security, and error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical availability and security).
Processors: Hetzner Online GmbH (servers in Germany) and SCORTEX Technologies.
Retention period: Server logs are automatically deleted 90 days after collection.
Cookies and local storage
Processing: Siebenecken.app uses browser cookies and local storage to save user settings and app status.
Purpose: To ensure functionality and improve user-friendliness.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest) for technically necessary storage.
Storage duration and type:
- Cookie “NEXT_LOCALE”: User language setting – 30 days
- Cookie “settings”: Font size setting – 365 days
- Cookie “popupDismissed”: Status of the welcome overlay – session cookie (deleted when the browser is closed)
- localStorage “progress”: Progress in chapters and tours – stored until manually deleted by the user
- Service Worker and Cache API: Caching of app resources for offline use – stored until the browser cache is manually cleared
Web Analytics with Umami
Processing: Siebenecken.app uses a self-hosted Umami analytics platform on its own servers in Germany. The following data is collected: page views, time spent on site, browser type, operating system, and approximate geographic location (country/city).
Purpose: Analysis of Siebenecken.app usage to optimize the app and the user experience.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in usage analysis).
Recipients: SCORTEX Technologies (technical administration of the analytics platform). Data is not shared with third parties.
Retention period: Analytics data is automatically deleted 24 months after collection.
sessionStorage: The session key “__sk” (UUID) is stored exclusively for the duration of the current browser session and is not transmitted to servers.
Map Services
OpenStreetMap Foundation
Processing: When using map functions in Siebenecken.app, the user’s IP address is transmitted to the OpenStreetMap Foundation. Map tiles are loaded directly from OpenStreetMap servers.
Purpose: Provision of map data and map functionality.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing map services).
Retention period: Map data is not stored locally in the app; data is loaded externally each time the app is accessed.
Mapbox Inc.
Processing: Map tiles from Mapbox are loaded for the timeline map and the treasure hunt feature. In doing so, the user’s IP address is transmitted to Mapbox Inc. in the United States.
Purpose: Provision of specialized map functions.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Recipient: Mapbox Inc., USA.
Data transfer to the USA: Mapbox Inc. is certified under the EU-US Data Privacy Framework. In addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR apply.
Retention period: Map data is not stored locally; it is loaded externally each time the map is accessed.
GPS and Location Data
Processing: Siebenecken.app collects GPS location data exclusively for the check-in feature to verify the user’s proximity to a point of interest (within 500 meters).
Purpose: Activation of the check-in feature to interact with locations within the app.
Legal basis: Art. 6(1)(a) GDPR (explicit consent of the user via the operating system permission).
Storage: GPS data is not transmitted to the server and is not stored. Processing takes place exclusively locally on the user’s device.
User Consent: Location sharing requires the user’s active consent via the operating system permission (iOS or Android).
Audio Guides
Processing: Audio files for audio guides are provided exclusively by Siebenecken.app’s own servers (files.[domain]). No external audio services are used.
Purpose: Provision of audio guide content.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in content provision).
Storage: Audio files are temporarily stored in the user’s app cache.
YouTube Embedding (if applicable)
Processing: If YouTube videos are embedded in Siebenecken.app, the embedding is done via youtube-nocookie.com (enhanced privacy mode). No cookies are set by YouTube before the video is activated.
Purpose: Provision of multimedia content.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
Recipient: Google Ireland Limited.
Data transfer: A connection to YouTube is established only when the video is clicked. In doing so, the IP address and device information are transmitted to Google. The Google Privacy Policy applies.
Rights of Data Subjects
Users have the following rights vis-à-vis the controller:
- Right of access (Art. 15 GDPR): Users may request information about which personal data is being processed regarding them.
- Right to rectification (Art. 16 GDPR): Incorrect data may be corrected.
- Right to erasure (Art. 17 GDPR): Under certain conditions, users may request the erasure of their data.
- Right to restriction of processing (Art. 18 GDPR): Processing may be restricted.
- Right to data portability (Art. 20 GDPR): Users may receive their data in a structured, commonly used, and machine-readable format.
- Right to object (Art. 21 GDPR): Users may object to the processing of their data, particularly for the purposes of direct marketing or profiling.
To exercise these rights, users may contact the controller:
Right to lodge a complaint
Users have the right to lodge a complaint with the competent supervisory authority if they believe their rights have been violated.
Competent supervisory authority for the Tourismusverband Sieben e.V. in Lübbecke (North Rhine-Westphalia):
State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia
Kavalleriestraße 8–10
40213 Düsseldorf
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de