Privacy Policy

Controller

The controller under the General Data Protection Regulation (GDPR) is Bartosz Kołodziej, sole trader, Łubowo 127, 62-260 Łubowo, Polen, tax number (Poland, NIP) 7842438640 ("we", "us").

For any data protection matter, contact us at datenschutz@tripto.de. You may write to us in German, English or Polish. We have not appointed a data protection officer as we are not required to; data protection requests are handled by the controller personally.

Imprint

Key points

• You can use tripto.de without an account and without providing any personal data.
• We do not sell personal data or share it with third parties for advertising. tripto.de uses no advertising or marketing cookies.
• We do not use third-party analytics or tracking services. A cookie banner is therefore not required.
• The website server is located in Germany and the database in Frankfurt am Main. Some service providers are based in the USA — for them we rely on the safeguards described below.

Hosting and server log files

When you visit tripto.de, your browser automatically sends technical data to our server.

• Data: IP address, date and time of the request, requested URL, referrer, browser and operating system type, HTTP status code and amount of data transferred.
• Purpose: delivering the website, ensuring stability and security, troubleshooting and preventing abuse (e.g. limiting requests per IP address).
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating the website securely and reliably.
• Retention: server log files generally for no more than 30 days; IP addresses used for rate limiting are kept in memory only for a few minutes up to one hour. We keep data longer only where needed to investigate a specific security incident.
• Hosting: the website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany. Hetzner processes data as our processor under a contract pursuant to Art. 28 GDPR.

Cloudflare (DNS and images)

• The tripto.de domain is managed via Cloudflare (DNS). Attraction photos are served from our image domain img.tripto.pl, stored in Cloudflare R2 and delivered through the Cloudflare network.
• Data: when images are requested (and insofar as requests are routed through the Cloudflare network), Cloudflare processes your IP address, browser information and the requested URL — this is technically necessary for delivery.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in fast, secure and reliable delivery of the website and its images.
• Provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, as processor. Cloudflare is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses apply in addition.

User account

A free account lets you keep your saved places across devices and review attractions. You can register and sign in with email and password, with a sign-in link sent by email, or with your Google account.

We run accounts and the database with Supabase, Inc. as processor. Data is stored in the eu-central-1 region (Frankfurt am Main, Germany). Access by the provider from third countries (e.g. for support and maintenance) cannot be ruled out; the European Commission’s standard contractual clauses apply.

When signing in with Google, you use a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes your data as an independent controller under its own privacy policy; we never receive your Google password. Transfers to Google LLC (USA) are possible; Google LLC is certified under the EU-U.S. Data Privacy Framework.

To delete your account, write to datenschutz@tripto.de from the email address linked to the account. Together with the account we delete your saved places and your reviews.

• Data: email address, password (stored only as a hash), user ID, times of registration and sign-ins, technical security logs of sign-ins (including IP address) and, when signing in with Google, the data Google shares according to your settings (email address, name, profile picture URL, Google account ID).
• Purpose: creating and managing the account, sign-in, account security, sending account-related emails (e.g. email confirmation, sign-in link, password reset).
• Legal basis: Art. 6(1)(b) GDPR — performance of the account agreement (Terms of Service); security logs — Art. 6(1)(f) GDPR.
• Retention: until the account is deleted; afterwards only insofar as necessary to defend possible legal claims until the limitation period expires.
• Recipients: Supabase (database, authentication and account emails), Hetzner (hosting); when signing in with Google, also Google.

Saved places

• Without signing in: your saved places are stored only in your browser’s local storage (localStorage) and are not sent to us.
• When signed in: saved and visited places are stored in your account (places saved in the browser before are carried over) so they are available on all your devices.
• Legal basis: Art. 6(1)(b) GDPR — providing the feature you use; storage in the browser — Section 25(2) no. 2 TDDDG (strictly necessary for the feature you requested).
• Retention: until you remove a place or delete your account; browser data until you clear it in your browser.
• Recipients: Supabase (database), Hetzner (hosting).

Attraction reviews

Signed-in users can review attractions.

• Data: rating (1–5), review text, optional month of visit, creation and edit times, review status and link to your account.
• Purpose: publishing the review, automatic filtering of prohibited content, handling notices and removing reviews that break the rules.
• Legal basis: Art. 6(1)(b) GDPR — providing the review feature; moderation and handling notices — Art. 6(1)(f) GDPR (legitimate interest in reliable content) and Art. 6(1)(c) GDPR where the Digital Services Act (DSA) requires it.
• Publicly visible: rating, text, month of visit, date and a pseudonym such as “Traveller #1234”. We do not publish your email address or name. Please do not include personal data in the review text.
• Retention: until the review is removed (at your request or as a result of moderation) or your account is deleted.
• Recipients: website visitors (published content), Supabase, Hetzner.

Correction suggestions

Using “Suggest a correction” on an attraction page you can tell us about outdated or incorrect information.

• Data: content of the suggestion, the attraction and type of change, optionally an email address for follow-up questions, time of submission.
• Purpose: reviewing and applying the correction, contacting you if needed.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in accurate, up-to-date information.
• Retention: as long as needed to process and document the change; we delete your email address at any time on request.
• Recipients: Supabase, Hetzner.

Contact by email

When you contact us by email (kontakt@tripto.de):

• Data: your email address, your name if provided, and the information you give us in your message.
• Purpose: handling and answering your request, including notices about content and complaints.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in answering requests); Art. 6(1)(b) GDPR where your request concerns a contract; Art. 6(1)(c) GDPR where we are legally required to handle it (e.g. notices under the DSA).
• Retention: until your matter is resolved; beyond that only where the correspondence may be relevant to legal claims, until the limitation period expires.
• Recipients: our email provider.

Our own cookieless statistics

Our own server counts simple events on the website — e.g. viewing an attraction, saving a place or running a search. These events are recorded without cookies, without user identifiers and without storing IP addresses (the IP address is used only briefly in memory for rate limiting), and are not linked to your account.

Purpose: understanding which content and features are useful. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in improving the website. Nothing is stored on or read from your device for this.

Maps

For interactive maps we use the MapLibre library and map tiles from OpenFreeMap (openfreemap.org). Your browser loads the map tiles directly from OpenFreeMap servers, which receive your IP address, browser information and the map area displayed. The map cannot be shown without this. To our knowledge OpenFreeMap does not set cookies.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in displaying maps. Map data: © OpenStreetMap contributors (ODbL).

Weather data

On attraction pages we show a weather forecast from the Norwegian Meteorological Institute (MET Norway, api.met.no). Only our server makes this request, using only the (rounded) coordinates of the attraction. Your IP address or other data about you is not sent to MET Norway.

Images

Many photos come from Wikimedia Commons and are used under free licences (author and licence are credited with the photo). We store these images in our own storage (Cloudflare R2, domain img.tripto.pl) and serve them from there. Your browser generally does not load these photos from Wikimedia Foundation servers, so no data is transferred to Wikimedia in this respect.

“Near me” location feature

If you use the “Near me” feature and allow location access in your browser, we use approximate coordinates (rounded to about 10 m) to position the map and show nearby attractions. The coordinates appear in the page address, are not stored in your account and are removed from the page address before anything is sent to our statistics service.

Legal basis: Art. 6(1)(b) GDPR — a feature you explicitly request. You can revoke location access at any time in your browser settings.

Links to other websites

tripto.de contains links to external websites, e.g. official websites of attractions or route planning in Google Maps. Only when you click such a link is data (e.g. your IP address) sent to that provider, who is responsible for it. tripto.de does not use affiliate links.

Orders and payments

When you buy map posters and audio guides, we process:

• Order data: e-mail address, product and settings, language, time of order and consent statements, to perform the contract (Art. 6(1)(b) GDPR). We send order and access e-mails via Resend.
• Payment: payments are handled through Stripe Managed Payments. The merchant of record for the payment is Sold through Link, LLC (USA), a Stripe group company (“Link”); payments are processed by Stripe group companies (in the EU, Stripe Technology Europe, Ltd., Ireland). Link and Stripe receive your payment and billing details as independent controllers, including for payment processing, fraud prevention, calculating and remitting VAT and sending receipts; data may be transferred to the USA (privacy notices of Link and Stripe: link.com/privacy, stripe.com/privacy). We receive the payment status, amount and — if you provide them — name, billing address and VAT ID.
• Invoicing and tax records: billing data is kept for the statutory retention periods (Art. 6(1)(c) GDPR); other order data for as long as needed to provide access and handle complaints.
• Audio guides: to enforce the device limit we store a hash of a random device ID and the browser type; progress and offline files stay in your browser.

Cookies and browser storage

As strictly necessary we only set: the Supabase sign-in cookie (after sign-in) and — when not signed in — your saved places in local storage. The legal basis is Section 25(2) no. 2 TDDDG; no consent is required for these. We do not use cookies that require consent (e.g. for analytics or advertising). The full list with retention periods is in the Cookie Policy.

Cookie Policy

Recipients and processors

We use the following service providers. Processors are contractually bound to our instructions under Art. 28 GDPR:

Beyond that, we disclose data only to authorities, courts or other bodies where we are legally required to.

• Hetzner Online GmbH, Gunzenhausen — servers and hosting; data centres in Germany.
• Supabase, Inc. — database, authentication and account emails; data stored in Frankfurt am Main (eu-central-1); standard contractual clauses for any access from third countries.
• Cloudflare, Inc. — DNS and storage and delivery of images (R2); USA, EU-U.S. Data Privacy Framework and standard contractual clauses.
• Google Ireland Limited — Sign in with Google (as independent controller); possible transfers to Google LLC, USA (EU-U.S. Data Privacy Framework).
• OpenFreeMap — map tiles loaded by your browser.
• our email provider — receiving and sending emails to and from our contact address.

Transfers to third countries

Where data is transferred to countries outside the European Economic Area (in particular the USA), this happens only on the basis of Chapter V GDPR: an adequacy decision of the European Commission — for the USA, the EU-U.S. Data Privacy Framework decision for certified companies (including Google LLC and Cloudflare, Inc.) — or the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

You can request a copy of the relevant safeguards at datenschutz@tripto.de.

Your rights

Under the GDPR you have the right to:

To exercise your rights, simply write to datenschutz@tripto.de. We reply without undue delay and within one month at the latest; in justified cases this may be extended by two further months (Art. 12(3) GDPR). To confirm your identity we may ask, for example, for a message from the email address linked to your account.

• access the data we process and obtain a copy (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability for data you provided that we process automatically based on consent or contract (Art. 20 GDPR),
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR)

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object at any time, on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR (Art. 77 GDPR), in particular in the Member State of your habitual residence — in Germany, the data protection authority of your federal state.

As our only establishment is in Poland, our lead supervisory authority is the President of the Polish Personal Data Protection Office: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

Obligation to provide data

Providing personal data is neither a statutory nor a contractual requirement. Without an email address, however, you cannot create an account, and without an account you cannot post reviews. Technical data such as your IP address is processed automatically when you visit the website because it is needed for delivery.

No automated decision-making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Automatic safeguards (e.g. spam and link filters for reviews, rate limits) only hold back obviously prohibited or excessive input.

Children

The website can be used without age restriction. Accounts are intended for people aged 16 and over; younger people may use them only with the consent of a parent or guardian. If we learn that we process a child’s data without such consent, we will delete it — please let us know at datenschutz@tripto.de.

Data security

We apply appropriate technical and organisational measures, including encrypted transmission (TLS/HTTPS), storing passwords only as hashes, row-level access restrictions in the database, rate limiting and data minimisation. If a personal data breach nevertheless occurs that is likely to result in a high risk to your rights, we will notify you in accordance with Art. 34 GDPR.

Changes to this privacy policy

We update this privacy policy when website features, service providers or the law change. The version published on this page with the stated update date applies. If new processing requires consent, we will ask for it separately.