Privacy Policy

1. Controller

Softwareentwicklung Stefan Träger
Lohwaldstraße 21
94113 Tiefenbach
Phone: 0151 / 22 93 60 11
Email: info@raccoon-it.de

2. Server log files

When our website is accessed, the web server automatically collects data and stores it in log files. This includes:

• IP address
• Date and time of access
• Accessed file/page
• Browser type and version
• Operating system

For security reasons (e.g. to defend against attacks), this data is stored for a maximum of 7 days and then deleted. It is not combined with other data.

3. Cookies

Our website uses technically necessary session cookies, e.g. to enable login or form sessions. These are automatically deleted at the end of the session. In addition, we set a persistent cookie to store your language selection (cq_lang, lifetime 1 year) so that the language you have chosen is retained. Beyond the cookieless audience measurement described in section 4, we do not use any analytics or tracking services. In particular, no cross-site tracking takes place and no data is passed on to third parties for analytics purposes.

4. Web analytics with Matomo

On this website we use the open-source software Matomo for the statistical analysis of visitor access. Matomo is operated exclusively on our own server (https://matomo.mycoinquest.de), so that all collected data remains with us and is not passed on to third parties.

The processing serves our legitimate interest in optimising our website pursuant to Art. 6(1)(f) GDPR.

• pages and files accessed
• time of access
• operating system, browser type and version
• referrer URL (previously visited page)
• anonymised IP address (truncated, no personal reference)

A personal reference is excluded by the anonymisation. No cookies are set. There is no profiling and no cross-site tracking.

You can object to the collection of your visits at any time:

5. External resources & interfaces

All design and program libraries used on our website (including TailwindCSS, Leaflet, canvas-confetti) are served from our own server. We do not use a content delivery network (CDN). Simply visiting our pages therefore transmits no personal data – in particular no IP addresses – to third parties.

On the detail pages of individual machines we show nearby points of interest. We retrieve the required data via Google Places and Google Place Photos (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing in the USA by Google LLC cannot be ruled out).

This request is made exclusively by our server, not from your browser. Your IP address is not transmitted to Google; the associated images are also delivered from our own server. Only the coordinates of the respective machine are transmitted. We cache the responses for 90 days in order to keep the number of requests low.

The legal basis is our legitimate interest in an informative and performant presentation of our service (Art. 6(1)(f) GDPR). Information on data processing by Google can be found at https://policies.google.com/privacy.

6. Video previews (YouTube)

On individual machine detail pages we display preview images for YouTube videos (YouTube / Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). These preview images are loaded directly from a Google server (img.youtube.com) while the page is being built; in doing so, your IP address is transmitted to Google. The video itself is not embedded – it only opens on YouTube after you click. The legal basis for displaying the preview is our legitimate interest in an informative presentation (Art. 6(1)(f) GDPR). Information on data processing by Google: policies.google.com/privacy.

7. Map display with Leaflet & OpenStreetMap

To display maps we use the open-source library Leaflet, which we serve from our own server, as well as map tiles from the OpenStreetMap service (OpenStreetMap Foundation, United Kingdom). The map tiles are loaded directly from the servers of the OpenStreetMap Foundation when a map is displayed; in doing so, your IP address and technical data are transmitted there. Further information can be found in the privacy policy of the OSM Foundation.

8. Location detection & geodata (geocoding)

On pages where you can submit new machines, you have the option of automatically using your current location. For this we use the geolocation function of your browser or device.

Location detection only takes place if you actively click “📍 Use current location” and allow your browser access. The determined coordinates are entered locally into the form and are not stored before you submit the form.

To determine the country, region and place from the coordinates, we use the Nominatim API of OpenStreetMap. If you determine the location via the “📍 Use current location” button, this request is made directly from your browser; in this case the coordinates and your IP address are transmitted to the OpenStreetMap servers. If instead you set or move the location on the map, the request runs on our server, without your IP address being transmitted to OpenStreetMap.

The legal basis for using your device's location function is your consent (Art. 6(1)(a) GDPR), which you give by actively clicking. The conversion of coordinates into an address via Nominatim is based on our legitimate interest in a correct location assignment (Art. 6(1)(f) GDPR).

Conversely, when submitting you can also enter an address; we convert it into coordinates via the same OpenStreetMap Nominatim API in order to place the map pin. This request takes place on our server; your IP address is not transmitted to OpenStreetMap in the process. The legal basis is our legitimate interest in a correct location assignment (Art. 6(1)(f) GDPR).

9. Submission form & uploads

When you submit a machine, we store the information provided (name, location, coordinates, description, category, optionally your email address). You can also upload images (title image, coin designs), which are stored on our server.

The processing is carried out exclusively for the purpose of reviewing and publishing the submitted location (Art. 6(1)(a) and (f) GDPR). Email addresses are used only for queries.

10. Marketplace & messages

Via the marketplace you can publish swap and sale offers and contact other users. In doing so, we process the content of your offers as well as the messages you exchange with other users. These messages are intended for the respective conversation partners and are stored in order to deliver and display them.

If you report an offer or a message, we process the report for review and moderation. The legal basis is the provision of the function you use (Art. 6(1)(b) GDPR) as well as our legitimate interest in a safe platform free of misuse (Art. 6(1)(f) GDPR).

11. Prize draws

If you take part in a prize draw, we process your participation data (username, assigned ticket/slot number, number of tickets and, where applicable, your winner status). If you win, we use your email address to notify you. The legal basis is the performance of the prize draw (Art. 6(1)(b) GDPR).

For traceability and a transparent presentation of the draw, an immutable record (snapshot) of the entries is created before the draw. The data required to prove the draw remains stored even after the prize draw has ended (Art. 6(1)(f) GDPR – legitimate interest in verifiability).

12. Mobile app (PWA)

Our platform is additionally available as an installable app at app.mycoinquest.de. The same processing applies there as on the website. A session cookie is used for logging in which is valid across domains between the website and the app (.mycoinquest.de) so that you remain logged in in both environments. The app caches content for offline use; this data remains on your device.

13. Publication on social media (Instagram)

If you agree in the submission form that your uploaded coin images may be published on our official Instagram channel (@mycoinquest.de), we process this data on the basis of your consent (Art. 6(1)(a) GDPR).

You can withdraw this consent at any time with future effect by contacting us by email at info@mycoinquest.de. After withdrawal, the affected content will be deleted promptly.

14. User accounts & registration

When you create a user account, we process the data you provide (username, email address, password hash) to manage your account and verify your email address. The data is stored exclusively on our server and is not passed on to third parties.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (operation and security of the website).

15. Payment processing

If you use a paid offer (e.g. the purchase or upgrade of a collector's album), we process the payment via the payment service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Within this payment process, card payment or PayPal is available depending on your selection.

When you make a payment, your payment data (e.g. name, email address, payment amount, means of payment, IP address and device-related information) is transmitted directly to Stripe. We ourselves do not receive complete payment data, in particular no card numbers.

As long as you do not use a paid offer, no data is transmitted to Stripe. All functions currently offered are free of charge.

The processing is carried out for the performance of a contract pursuant to Art. 6(1)(b) GDPR.

Further information can be found in Stripe's privacy policy: https://stripe.com/de/privacy

16. Legal bases

• Art. 6(1)(a) GDPR – consent
• Art. 6(1)(b) GDPR – performance of a contract
• Art. 6(1)(f) GDPR – legitimate interest

17. Your rights

• information about the data stored by us
• rectification of inaccurate data
• erasure of your data
• restriction of processing
• data portability
• objection to processing
• withdrawal of consent given, with future effect

You also have the right to lodge a complaint with a data protection supervisory authority.

18. Storage period

We store personal data only for as long as is necessary for the respective purposes or as long as statutory retention obligations exist.

Contract- and billing-related data is stored in accordance with tax and commercial retention periods (generally 6 or 10 years).

Comments that you delete yourself are hidden immediately and are from that moment on visible neither to other users nor to you. For technical reasons – existing likes refer to the entry – and in order to investigate cases of abuse, the record is then retained for a further 14 days. After that, the content and the author name are deleted automatically and the link to your account is removed; no personal reference remains. The legal basis for this short retention period is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

You may request the deletion of your user account at any time. To do so, simply contact info@raccoon-it.de. Content you have submitted (e.g. machines, coin images, comments) will be anonymised and detached from your account so that jointly used content – such as other users' collector's albums – is preserved. Statutory retention obligations and the data required to prove prize draws (section 11) remain unaffected.

19. Hosting

Our website is operated by an external hosting service provider. All data collected on our website is processed on its servers.

A data processing agreement pursuant to Art. 28 GDPR exists with the hosting provider.

20. Partner recommendations (advertisements)

On individual machine detail pages we display local partner recommendations as labelled advertisements. When an advertising partner submits a recommendation, we process the data provided for it (business name, description, public contact details, address as well as internal contact and billing data of the contact person) in order to review, approve and display the advertisement. The legal basis is the performance of the advertising contract (Art. 6(1)(b) GDPR) and our legitimate interest in functioning marketing (Art. 6(1)(f) GDPR).

To determine the location, the address provided is converted into coordinates via the OpenStreetMap Nominatim map service upon submission; this happens on our server, and your IP address is not transmitted to the service.

To measure advertisement performance, we count clicks on the website and route buttons in aggregated form. This counting serves the statistical evaluation of advertisement performance (Art. 6(1)(f) GDPR) and is not assigned to any individual website visitor.

Enquiry as an advertising partner. On machine detail pages where the advertising slot is vacant, you can request the access link to the partner form yourself. In doing so we process the business name you provide and your email address in order to send you this link once. The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). The email is sent solely upon your explicit request; we do not send you any advertising beyond that.

In addition, for each such enquiry we store the IP address and the time in order to prevent misuse of the form for sending bulk emails. The legal basis is our legitimate interest in the security of our systems and in protecting third parties from unwanted messages (Art. 6(1)(f) GDPR).

Storage period. The access link is valid for 30 days. If you request a link without subsequently submitting a recommendation, we automatically delete the data stored for the enquiry (business name, email address, IP address) once this period has expired. We delete the log data used to prevent misuse after 30 days at the latest. If you do submit a recommendation, the storage period for the partner data is governed by the advertising contract and the statutory retention periods (in particular up to 10 years under commercial and tax law).

21. GetYourGuide (experiences & tickets, affiliate)

On machine detail pages we offer a clearly labelled advertising section featuring trips and tickets from GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany.

Only after your click. The section is initially shown as a placeholder only. No data is transmitted to GetYourGuide unless you click the button to load the offers. The legal basis for the subsequent loading is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG), which you give by clicking. Without that click, no connection to GetYourGuide takes place.

What data is transferred. When you click the button, the widget is loaded from GetYourGuide servers. This transmits your IP address, technical details about your browser and device, and the page you are visiting to GetYourGuide; GetYourGuide may set cookies or use comparable technologies. The location relevance of the offers shown derives from the public page content (town and region of the machine) – we do not transmit location data from your device.

Purpose and commission. If you book through these offers, we receive a commission. GetYourGuide uses its own identifiers to attribute it. Our interest in refinancing this free service is based on Art. 6(1)(f) GDPR insofar as processing goes beyond the integration you consented to.

Third-country transfer. Processing outside the EU/EEA cannot be ruled out. For details of GetYourGuide’s data processing and your rights towards them, please see the provider’s privacy policy at getyourguide.com/privacy-policy.

Withdrawal. Your consent applies to the respective page view only. If you reload the page without pressing the button again, the widget will not load.

22. Contact form

You can send us a message via our contact form. In doing so, we process the name you provide, your email address, an optional subject and the content of your message in order to deal with your request and reply to you. The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We use your email address exclusively to handle this request; we do not send you any advertising on that basis.

Conversation instead of single message. Messages from the same email address are combined into a continuous conversation so that earlier requests can be taken into account when handling a new one. When we reply, you receive an email containing a link that lets you view the conversation and reply directly. This link contains a random identifier, is valid for 30 days and is replaced with every new reply from us. It grants access to the associated conversation and should therefore not be passed on.

In addition, we store the IP address and the time of each incoming message in order to prevent misuse of the form (spam, automated bulk messages). The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).

Storage period. We delete the IP address after 30 days at the latest. Completed conversations are deleted 12 months after the last message, unless statutory retention periods require otherwise.