Privacy Policy

1. Controller

Simon Spengler
bikepacking-partner
Graspoint 24
89362 Offingen
Germany
E-Mail: spengler.digital@gmail.com

2. Collection and storage of personal data

We process the following categories of personal data to provide the platform (legal basis: Art. 6(1)(b) GDPR, performance of a contract):

Registration data: username, email address, password (stored encrypted)
Profile details (optional): age, gender, spoken languages, home country, profile picture
Posts (bikepacking tours), comments, and private messages to other users
IP addresses and technical server log data to ensure system security (legal basis: Art. 6(1)(f) GDPR, legitimate interest)
Data submitted via the contact form

3. Hosting and technical service providers

This website is hosted by Hostinger International Ltd. (61 Lordou Vironos Street, 6023 Larnaca, Cyprus). All data collected through the platform is processed on this provider's servers. A data processing agreement under Art. 28 GDPR is in place with Hostinger.

User data (including profile and post data) is stored in a MongoDB Atlas database (operated by MongoDB, Inc., USA). Where this involves a transfer of data to third countries (outside the EU/EEA), this takes place on the basis of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

Profile pictures and post images uploaded by users are stored and delivered via the Cloudinary service (Cloudinary Ltd.). This may also involve processing outside the EU/EEA; such transfers are based on EU Standard Contractual Clauses or an equivalent safeguard mechanism under Art. 46 GDPR.

For sending system and account notifications (e.g. registration confirmation, password reset, new-message notifications) we use the email service mail.manitu.de (manitu GmbH, Welvertstraße 2, 66606 St. Wendel, Germany).

4. Cookies

This website uses only technically necessary cookies (e.g. a session cookie for login, CSRF protection) required to operate the platform. These cookies fall under § 25(2) No. 2 TTDSG and do not require separate consent.

For any non-essential cookies and services (see section 5), we obtain your express consent via a cookie consent banner before they are used, pursuant to § 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR. These services are only loaded after you have given consent. You can withdraw your consent at any time with future effect via the cookie settings link in the footer.

5. Google Analytics, Google Tag Manager and Google AdSense

Subject to your consent, we use Google Analytics (via Google Tag Manager, gtag.js) and Google AdSense, services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics is used to analyze usage in anonymized form; Google AdSense is used to display advertising. Both services may set cookies and transmit data (including a shortened IP address and usage behavior) to Google servers, in some cases in the USA.

The legal basis for using these services is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with § 25(1) TTDSG, given via the cookie banner. Without this consent, the services listed above are not loaded. Further information on Google's data processing is available in Google's Privacy Policy.

6. Contact form

Data entered in the contact form (name, email address or phone number, message) is used solely to process your request and is not shared with third parties. The legal basis is Art. 6(1)(b) or (f) GDPR.

7. User accounts and private messages

During registration, the data listed in section 2 is processed and stored. This data is used solely to operate the platform, in particular to display your profile to other users and to facilitate matching with travel partners.

Private messages sent through the platform are stored so that you and the relevant conversation partner can access the message history. The content of private messages is not analyzed for advertising purposes.

8. Data security

This website uses SSL/TLS encryption to secure the transmission of data between your browser and our servers. Passwords are stored exclusively in encrypted (hashed) form.

9. Retention period

Personal data is deleted once it is no longer required for the purposes described above, in particular upon deletion of your user account. Statutory retention obligations remain unaffected.

10. Your rights

Right to access stored data (Art. 15 GDPR)
Right to rectification of inaccurate data (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent already given, with future effect (Art. 7(3) GDPR)
Right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

11. Contact