This policy describes which data this specific website actually processes. It does not replace a legal review. We recommend having it reviewed regularly by a qualified lawyer or data protection professional.
1. Controller
Demo
Musterstraße 1
12340 Musterstadt
Email: kontakt-1@example.invalid
2. Overview of processing activities
We process personal data only to the extent necessary to operate this web directory: to provide the website, manage user accounts and listings, moderate reviews and send emails that directly result from your use of the service, such as registration confirmations or listing-status notifications. We do not use a web analytics or tracking tool such as Google Analytics and we do not use social login. For optional online payments, we use Stripe Checkout. A connection to Stripe is established only after you deliberately start the payment process.
3. Provision of the website and server log files
When you access this website, our hosting provider automatically collects technical information in server log files, including the IP address, date and time of access, requested page, browser type and referring URL. This processing is used to ensure technical stability and security, for example to detect attacks, and is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR. Log files are deleted or anonymised after no more than 30 days.
This website is hosted by Live Testserver, Live Demo Anbieter. A data-processing agreement is in place with the hosting provider.
4. Cookies
We use only technically necessary cookies and no tracking, marketing or analytics cookies.
Session cookie: This cookie maintains your login to a business/member or administrator account while the browser session remains active or until you sign out. Protection against form manipulation (CSRF protection) is handled within the session and does not require an additional cookie.
Login cookie (“Remember me”): If you enable “Remember me” when signing in, we additionally set a persistent cookie (directory_remember). It can automatically sign you in on a later visit even after the original session has expired. It does not contain a readable username or password, only a random access token whose verification value is stored by us. It is valid for a maximum of 30 days or until you manually sign out or revoke it through your account.
Both cookies are protected with HttpOnly, Secure and SameSite=Lax attributes. They are required for operation of the website or for the convenience feature you have chosen and are used exclusively for authentication, not for tracking, marketing or analytics.
5. Registration and user account
When you create a business/member account, we process the information you provide, such as your name or company name, email address and password stored as a non-reversible hash, to provide and manage your account pursuant to Art. 6(1)(b) GDPR. You can permanently delete your member account yourself in the member area under “My account”. This removes the account, your own listings including associated uploads, and account-related convenience and extension data. Where individual billing or evidence records must continue to be retained, they are stored separately from the active member account and from deleted listings.
6. Listings in the directory
When you submit a listing, we process the information you provide, such as name/company, category, description, location, address, telephone number, email address, website and logo, for the purpose of publishing the listing in the directory after our review pursuant to Art. 6(1)(b) GDPR. Once approved, this information is publicly visible. Therefore, only provide information that you want to be made public.
For approved listings, we also collect anonymous statistical data such as timestamps for listing views and “Visit website” clicks, deduplicated once per session. We do not store IP addresses, referrer addresses or visitor profiles for these statistics. Actions by the signed-in listing owner and administrators are excluded. Listing owners see only aggregated statistics. The underlying raw timestamp data is stored for approximately 400 days and then automatically deleted. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in providing a privacy-conscious assessment of listing performance.
Owners of a listing with active Premium Plus may voluntarily add links to public social-media profiles, upload their own gallery images and submit an extended business profile. These features are processed pursuant to Art. 6(1)(b) GDPR. We do not automatically embed social-media feeds or tracking pixels. Uploaded gallery images are technically checked, resized and completely regenerated so embedded metadata such as camera details or GPS information is removed. New images and extended profile content become public only after manual review and approval. When an external action such as route planning is deliberately selected, the visitor is forwarded to the relevant third-party service; from that point onward, that provider's privacy provisions apply.
For aggregated performance information relating to Premium Plus, we may anonymously count interactions with approved action buttons, external links, social-media links and gallery images. We store only the time, listing number, interaction type and technically required identifier, without IP address, referrer or visitor profile. Individual interaction records are automatically deleted after approximately 400 days.
7. Online payment with Stripe Checkout
If you voluntarily pay for a Premium plan online, you are redirected to a payment page hosted by Stripe. Stripe processes the payment and billing information that you enter there. This website does not receive or store complete card or bank-account details.
We store only the information required to assign and document the payment, such as the listing, plan, amount, currency, payment status, Stripe session or payment identifier and relevant timestamps. For invoices, Stripe Checkout may also request the billing name, complete billing address and billing email address. After payment has been confirmed, this information is stored as an invoice snapshot for contract performance, invoicing, documentation and compliance with commercial and tax-law obligations pursuant to Art. 6(1)(b) and (c) GDPR.
Stripe communicates payment status through a signed webhook. Only this server-side verified message is treated as payment confirmation. Online payments are one-time payments; no subscription or automatic renewal is created.
8. Recommend a website
You can use the “Recommend a website” form to suggest a website without creating a user account. We process the submitted website address, the normalised domain, an optional category, an optional reason and the time of submission exclusively to review whether the website may be suitable for the directory pursuant to Art. 6(1)(f) GDPR.
A suggestion is never published automatically. During later manual review, an administrator can deliberately retrieve publicly available website information such as page titles, descriptions, location information, image candidates, favicons or structured data to assist with review. This information is not published automatically. Abuse protection uses a separate IP-based rate-limiting mechanism; the IP address is not stored together with the suggestion. Closed recommendations are archived and are automatically deleted after 180 days unless they have been converted into a directory listing and are still required for traceability.
9. Reviews
When you submit a review, we process the name provided, the rating and the comment for display after editorial review pursuant to Art. 6(1)(f) GDPR, our legitimate interest in maintaining a spam-free directory. The IP address may be processed temporarily for abuse prevention.
10. Email communication
We send emails only when they are directly related to your use of the service, for example registration confirmation, listing-status notifications, notifications about new reviews or password-reset messages pursuant to Art. 6(1)(b) GDPR. We do not send a newsletter or advertising emails.
11. Contacting us
If you contact us by email, for example at kontakt-1@example.invalid, we process the information you provide in order to handle and respond to your request pursuant to Art. 6(1)(b) or (f) GDPR.
12. Online licence verification of the software
Where this installation uses a licence that can be verified online, the software may send an encrypted HTTPS request at defined intervals to the licence service provided by the software manufacturer. Only technical licence and installation data required for activation, entitlement verification, abuse prevention and update entitlement is transmitted, such as the domain, installation ID, client public key, product version, build and schema version, and licence and revision identifiers. Directory content, passwords, payment data and private keys are not transmitted.
Before production use, the website operator must ensure that the actual manufacturer or recipient, legal basis, processing or contractual relationship and relevant retention period are correctly reflected in this Privacy Policy.
13. Retention periods
We store personal data only for as long as necessary for the purposes described above or for as long as statutory retention obligations apply. Submitted listings and reviews are stored for as long as required for the directory or until deletion is requested, subject to overriding retention obligations.
Payment, booking and invoice data, including the billing address confirmed through Stripe, is retained for as long as necessary for contract performance, possible refunds or chargebacks and compliance with statutory commercial and tax retention requirements. Invoices and cancellation documents therefore remain unchanged even if listing or account information is changed later.
Additional fixed automatic deletion periods apply to technical logs and security data. Failed login attempts and IP-based form-attempt counters are deleted after 30 days, password-reset links after no more than 7 days or immediately after use, unconfirmed reviews after 96 hours, and individual view, click, visitor-statistics and Premium Plus interaction records after approximately 400 days.
14. Your rights
Under the GDPR, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object (Art. 21). You also have the right to lodge a complaint with a competent data protection supervisory authority. To exercise your rights, use the contact details provided in the Legal notice.
15. Favourites and personal saved list
When this feature is enabled, signed-in users can save listings and events as private favourites pursuant to Art. 6(1)(b) GDPR. A favourite is associated only with the respective user account and is used only to display that user's personal saved list. Favourites are never publicly visible. You can remove them at any time. If the user account or relevant listing is permanently deleted, the associated favourites are also automatically deleted. Disabling the feature does not delete existing favourite data.
16. Premium booking, Stripe and contract evidence
If you order a paid Premium service, we process the account, listing, plan, price, term and payment-status data required to perform the contract pursuant to Art. 6(1)(b) GDPR. Payment itself is processed through Stripe Checkout. Payment and billing details are entered directly with Stripe; we receive only the information required for payment status, invoicing, refunds and evidence. The versions of the Terms & Conditions, withdrawal information and Privacy Policy applicable at the time of the order, together with your declaration concerning the optional early start of performance, are stored as a contract snapshot.
17. Electronic withdrawal function
For the electronic withdrawal function, we process your name, email address, the contract/payment reference you provide, your withdrawal statement, the time received, processing status and a technical acknowledgement reference. Where an unambiguous match is possible, the record is linked to the relevant Premium payment. The legal basis is Art. 6(1)(b) and (c) GDPR. The data is used to receive, acknowledge, process and document the withdrawal and is retained in accordance with statutory evidence and retention obligations.
18. OpenStreetMap maps and Nominatim geocoding
If the optional “Maps & Location” add-on is enabled, interactive OpenStreetMap maps on public pages are loaded only after your deliberate activation. When map tiles are requested, your browser connects to services of the OpenStreetMap Foundation or its technical delivery infrastructure. In particular, the IP address, browser/device type, operating system, referrer, date/time and requested resource may be processed. When the map is deliberately started, the Leaflet files required for display are also loaded from unpkg.com; that external delivery service likewise receives technically necessary connection data such as the IP address. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a user-initiated map display. The map and the required external resources are deliberately loaded only after a click in order to avoid unnecessary third-party connections.
To convert an address stored by a listing owner into geographic coordinates, the Nominatim service of the OpenStreetMap project may be called server-side. The address query required for geocoding is transmitted together with the technically necessary connection data of the server. Nominatim is not intended for confidential or particularly sensitive information. Further information on processing by the OpenStreetMap Foundation can be found in its current privacy policy.