Privacy policy
1. Data controller
lebwerte.com
Address: [Ulice a číslo, PSČ Město, Česká republika]
Company ID: [IČO, pokud jste podnikatel – jinak nechte prázdné]
Send an e-mail
For anything related to personal data, contact us by e-mail. We have not appointed a data protection officer, as this is not required for our scale of processing. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, because the service is also used by people in the European Union, under the General Data Protection Regulation (GDPR). Switzerland benefits from a European Commission adequacy decision.
2. What we process, why and for how long
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| A published event or day: place, city, meeting details, map point and address, time, repetition, activity type, organiser’s nickname, note | Showing the event to others, running the service | Performance of a contract, i.e. the terms of use (Art. 6(1)(b)) | Until deleted by the organiser, at most 365 days after the last date (repeating events: 365 days after the last sign-up or change) |
| A sign-up: nickname, event date, time of sign-up | Showing who is coming | Contract (Art. 6(1)(b)) | Until cancelled, at most 30 days after the event |
| Management code and device key | Letting you delete your own content | Contract (Art. 6(1)(b)) | Together with the content; we store only a hash, not the code or key itself |
| Content reports: reason, description, your contact if given | Handling notices under the Digital Services Act | Legal obligation (Art. 6(1)(c)); contact: legitimate interest (Art. 6(1)(f)) | 365 days after resolution |
| IP fingerprint (pseudonymised with a secret key and different every day; the IP address itself is not stored) | Protection against spam and abuse (rate limiting) | Legitimate interest in security (Art. 6(1)(f)) | At most 3 days |
| Server logs kept by the hosting provider (IP address, time, page, browser) | Server security and operation | Legitimate interest (Art. 6(1)(f)) | Per hosting settings, usually up to 30 days |
| Backups of all the above service data | Protecting data against loss, recovery after failures | Legitimate interest (Art. 6(1)(f)) | Daily backups 60 days, monthly backups 12 months, manual backups 90 days |
| Change log (journal): a copy of every write, i.e. of events, sign-ups and reports | Data recovery after a failure | Legitimate interest (Art. 6(1)(f)) | 60 days |
| E-mail if you write to us | Answering your question or request | Legitimate interest (Art. 6(1)(f)) | While handling it and 1 year after |
Providing data is voluntary, but without a nickname and event details you cannot publish an event or sign up.
Published content (events, days, nicknames of attendees) is visible to everyone. Please don’t include your full name, phone, e-mail or home address, and don’t publish data about other people.
Deleted content disappears from the site immediately and is permanently removed within 30 days. It may persist in backups and the change log for their retention periods (see the table); these are used only to recover data after a failure.
3. What stays only in your browser
We use no cookies. In your browser’s storage (localStorage) we keep only what you need for convenience and to manage your own content: chosen language and layer, last nickname used, your sign-ups and keys to events you created, and whether you allowed the map. This is not sent to us (except a key when you delete your own content). Clearing site data in your browser removes it.
Your location. If you tap “Use my location” or “Nearest to me”, your browser asks for permission and gives the location only to this page. We use it only in your browser (to sort events or place the point). It reaches our server only if you publish it yourself as an event’s meeting point.
The site’s administration uses one strictly necessary session cookie, only for the logged-in operator.
4. Recipients and third-party services
- Hosting provider [Název hostingu, např. WEDOS Internet, a.s., Hluboká nad Vltavou] processes data as our processor under a contract and only on our instructions.
- The operator’s e-mail provider: receives e-mails you send us, notifications about reported content and, if enabled, automatic backups.
- OpenStreetMap Foundation (United Kingdom): map tiles and address lookup from a map point. The map loads when the page is shown; the address is looked up when an organiser marks a place. OpenStreetMap then sees your IP address and browser data, and for address lookup the point’s coordinates. Legal basis: our legitimate interest in showing where events take place (Art. 6(1)(f) GDPR); you can object or block the map tiles in your browser. The UK benefits from a European Commission adequacy decision. See the OSMF privacy policy.
- komoot GmbH (Germany), Photon service: suggestions for streets and places once you type at least three characters into the search. The service receives the typed text and your IP address; we use the results only to sort events by distance and do not store them. Legal basis: our legitimate interest in offering search by address (Art. 6(1)(f) GDPR). See photon.komoot.io.
- Links to map apps (Google Maps, Mapy.cz, Apple Maps) and share buttons (Facebook, WhatsApp, Telegram, X, LinkedIn) open third-party services only when you click; their operators are responsible for processing there.
- Fonts and code libraries are hosted on our own server, so no other connections are made for them.
- We disclose data to public authorities only where the law requires it.
We do not sell data, use it for advertising or profiling, or make automated decisions about you.
5. Your rights
You have the right of access, rectification, erasure, restriction, portability and to object to processing based on legitimate interest. Send requests by e-mail. As there are no accounts, please describe the event or nickname (place, date, time) or give the management code. We reply without undue delay and within one month at the latest.
You may also lodge a complaint with a supervisory authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), in the EU with the authority in the country where you live or work.
6. Children
The service is intended for people aged 15 and over. Younger children take part with a parent, who may sign them up under a nickname that doesn’t identify the child.
7. Security
Connections to the site are encrypted (HTTPS). Codes and keys are stored only as hashes and attempts to guess a code are limited; we don’t store IP addresses at all. Data is backed up regularly and the administration is password-protected.
8. Changes
We may update this policy. The current version is always on this page with its effective date.