Privacy

1. Controller

2. Hosting and server log files

When you visit this website the web server collects technically necessary data (e.g. date, time, page called, browser type, IP address). Processing is required to provide the website (Art. 6 (1) (f) GDPR). IP addresses are not stored longer than needed for operation and security.

3. Cookies

We use technically necessary cookies for the session (forms, login, admin login, language). Optionally we store your cookie choice. Non-essential storage only takes place with consent (Art. 6 (1) (a) GDPR). You can delete cookies in your browser and change your choice via the Cookies link in the footer.

4. Found reports by finders

If you submit the found form as a finder, we process name, place found, optional GPS location (coordinates and accuracy), phone and/or email and optional notes. The legal basis is your consent (Art. 6 (1) (a) GDPR) and our legitimate interest in enabling a return (Art. 6 (1) (f) GDPR). Name, place found, phone, email and notes are emailed to the owner. Without consent, nothing is sent.

5. Contact and withdrawal form

We process details from the contact or withdrawal form to answer your request (Art. 6 (1) (b) and (f) GDPR). Required fields are marked.

6. Visitor counter

The footer shows a visit count. Counting happens once per session until the browser is closed. Detailed visit data (IP, approximate location, browser) is stored only if you accept optional cookies.

7. Storage period

We store found reports for as long as the item is actively managed and a return or traceability is required, then we delete them unless statutory retention rules apply. Contact requests are stored for handling the enquiry. Account data (name, email, password hash, items, purchase requests) is stored while the account exists. After deletion we remove it unless statutory retention rules apply.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on Art. 6 (1) (f) GDPR. You may withdraw consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection authority.

9. No third-party front-end content

Fonts, images and scripts are delivered from this server. No tracking pixels or advertising networks are embedded.

10. User account

When you register we process your name, email address and a password (stored only as a hash, never in plain text). The legal basis is the contract for providing the QR stickers (Art. 6 (1) (b) GDPR). You confirm the email address via a link. Depending on the setting, the account is activated immediately afterwards or only after a manual review.

11. Extra packs and PayPal

For items beyond the free allowance you can request an extra pack. We store the time, size, amount and status of the request in your account. Payment is made via a link to PayPal (paypal.me). You then leave our website. We do not embed PayPal scripts or other external resources. PayPal processes the payment under its own terms. We unlock further items after the payment has reached us and we have confirmed the request. The legal basis is the contract (Art. 6 (1) (b) GDPR).