This site does not track you. No analytics package, no advertising network, no wall to click through on the way in.
That would make for a very short privacy policy, except that some pages here load material from other companies, and those companies see something when they do. European law wants that written out. So would anyone who reads carefully.
Who Is Responsible
Marcus Hochstadt
Tischbergerstr. 1
76887 Bad Bergzabern
Germany
marcus@mygermancity.com
Responsible party (Verantwortlicher) under Art. 4 No. 7 GDPR, the European data protection regulation known in German as the Datenschutz-Grundverordnung. One person, no company, no staff, which is also why there is no data protection officer here. German law requires one only above a size this site will never reach.
What Happens When You Open A Page
Your browser has to tell my server a few things in order to get a page back. Hostinger, the company hosting this site, writes them into an access log: the time, your IP address, the page you asked for, the user agent string your browser sends, the country the request came from, the size of the response, and how many milliseconds it took.
Those logs sit on a server in Frankfurt and are deleted after seven days. Backups are held in France. Nothing in them is combined with anything else, and nothing is used to build a picture of you.
Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is keeping a website running and being able to tell a reader from a scraper—and there are a great many scrapers.
How Pages Reach You
Pages travel through Hostinger’s content delivery network, which keeps copies on machines around the world and hands you the nearest one. If you are reading this in Ohio or Queensland, the copy almost certainly came from your own continent rather than from Frankfurt. The same network optimizes images and runs a firewall that inspects incoming requests, so it handles IP addresses as well.
Hostinger acts as a processor under Art. 28 GDPR, on the terms published at hostinger.com/legal/dpa. Legal basis: Art. 6(1)(f) GDPR, for speed and for keeping attacks off the site.
Material Loaded From Other Companies
Some pages pull in things that do not sit on my server. When such a page loads, your browser connects to the other company directly, and that company sees your IP address, your user agent, and which page of this site you have open. It happens while the page is loading, before you click anything.
Worth saying plainly, because it is the part of this site least under my control.
Booking and insurance panels. On holiday rental and travel insurance pages, a panel from the partner is embedded in the page. Those partners run their own cookie notice inside the panel, and nothing is stored on your device until you accept it there. The connection itself is made when the page loads. The partners are Belvilla for holiday rentals and HanseMerkur for travel insurance, both reached through the affiliate network Awin.
Webcam images. The live pictures on webcam pages come straight off the servers of the people running the cameras. I do not copy them onto my own server. I point at them, and link back as a thank-you, which means your browser talks to those servers directly.
Maps. Map pages use Leaflet, an open-source mapping library delivered from unpkg.com in the United States, and map tiles from OpenStreetMap in the United Kingdom. Both connections open as soon as the map appears.
PayPal. Only on the donation page, and nowhere else. Open that page and PayPal’s script loads. Stay off it and PayPal never hears from you.
Legal basis for all of these: Art. 6(1)(f) GDPR. The interest is in showing you a camera image that is actually live, a map that actually works, and a booking panel that actually books. This is being rebuilt so that nothing loads until you ask for it. Until that is finished, the paragraphs above describe what happens.
The Contact Form
The form on the contact page asks for your name, your email address, and your message. Nothing else, no hidden fields, and nothing at all is written into this site’s database. The message goes straight to my mailbox.
That mailbox runs on Google Workspace, so Google LLC in the United States does the storing. Google is certified under the EU-US Data Privacy Framework, the arrangement the European Commission recognizes for transfers of personal data to American companies.
I keep messages while the conversation is still useful and delete them when it stops being useful. Want yours gone sooner? Say so, and it goes.
Legal basis: Art. 6(1)(f) GDPR, for answering somebody who wrote to me. If your message concerns a partnership or another business matter, Art. 6(1)(b) applies instead. Using the form is entirely voluntary, and a plain email lands in exactly the same place.
Comments On The Fan Corner
One page here takes comments: the fan corner. WordPress stores what you write together with the name and email address you enter, a website address if you supply one, your IP address, your user agent, and the timestamp. That stays in the database for as long as the comment is published.
Avatar images are switched off, so nothing about you is sent to Gravatar or any other avatar service.
If you tick the box that remembers your details for next time, WordPress sets a cookie on your device to do exactly that. Leave it alone and no cookie is set.
Legal basis: Art. 6(1)(a) GDPR for the comment you chose to leave, and Art. 6(1)(f) for the IP address, which is kept in case a comment ever turns into a legal matter.
Cookies
There is no cookie banner on this site because there is almost nothing to consent to.
WordPress sets a cookie only when you ask it to, by ticking that box under a comment. On my side of things, that is the entire list.
Inside the embedded panels described further up, the partners handle their own cookies and display their own notice. Those cookies belong to them, are set under their rules, and their privacy policies govern them. Storing or reading anything on your device is regulated here by § 25 Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), the German act on privacy in digital services.
Data Leaving The European Union
Three routes, all named above. Google LLC in the United States, for the contact mailbox. unpkg.com, also American, for the mapping library. And the delivery network, which hands you a page from wherever you happen to be sitting.
Transfers to Google rest on the EU-US Data Privacy Framework. That decision has survived a court challenge and remains in force, and it is the sort of thing that can change. If it does, this page changes with it.
What You Can Ask Me For
Under the GDPR you have the right to:
- a copy of whatever data I hold about you (Art. 15)
- correction of anything that is wrong (Art. 16)
- deletion (Art. 17)
- restriction of processing (Art. 18)
- your data handed over in a portable format (Art. 20)
You can also object to any processing that rests on legitimate interest (Art. 21), and withdraw consent you have given, which takes effect from that point forward (Art. 7(3)).
All of it goes to the address at the top of this page. There is no form and no procedure. Write, say what you want, and it happens.
And if you think I have handled something badly, you can complain to a supervisory authority. Mine is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz in Mainz, because Rheinland-Pfalz is the state I live in. If you are in the EU, the authority where you live works too.
What Is Not Happening Here
No analytics package. No advertising network. No newsletter and no mailing list to end up on. No fonts pulled from Google or anybody else, since the type you are reading was already on your device. The site search runs inside WordPress and goes nowhere. And no profiling or automated decision-making of the kind Art. 22 GDPR is about.
The imprint says who runs this site, the terms of use cover copyright and what I can promise about the content, and the disclosure page explains which links here can earn a commission.
This page describes how the site works right now, not how I would prefer it to work. Those embedded panels are moving behind a click, so that nothing reaches another company until you decide it should. When that is done, this page gets rewritten to say so.