Privacy Policy

1. Controller

Softwareentwicklung Stefan Träger
Lohwaldstraße 21
94113 Tiefenbach
Phone: 0151 / 22 93 60 11
Email: info@raccoon-it.de

2. Server log files

When our website is accessed, the web server automatically collects data and stores it in log files. This includes:

• IP address
• Date and time of access
• Accessed file/page
• Browser type and version
• Operating system

For security reasons (e.g. to defend against attacks), this data is stored for a maximum of 7 days and then deleted. It is not combined with other data.

3. Cookies

Our website uses technically necessary session cookies, e.g. to enable login or form sessions. These are automatically deleted at the end of the session. In addition, we set a persistent cookie to store your language selection (cq_lang, lifetime 1 year) so that the language you have chosen is retained. If you use the platform without an account, we also set a persistent cookie for your guest access (guest_token, lifetime 1 year) so that contributions you submitted as a guest are assigned to your guest access again on a later visit. Guest accesses without activity are deleted after 30 days. So that the map does not jump back to its initial view when you navigate back, your browser additionally stores the map viewport you last looked at (centre and zoom level) in sessionStorage (cq_karte_ansicht). This entry belongs to the individual browser tab, is not transmitted to us and is deleted when the tab is closed. No link to your location arises from this – what is stored is the map section, not your position. For individual convenience functions – for example so that a notice does not reappear on every visit – your browser also stores small flags in local storage (localStorage). They contain no personal data and are not transmitted to us. Beyond the cookieless audience measurement described in section 4, we do not use any analytics or tracking services. In particular, no cross-site tracking takes place and no data is passed on to third parties for analytics purposes.

4. Web analytics with Matomo

On this website we use the open-source software Matomo for the statistical analysis of visitor access. Matomo is operated exclusively on our own server (https://matomo.mycoinquest.de), so that all collected data remains with us and is not passed on to third parties.

The processing serves our legitimate interest in optimising our website pursuant to Art. 6(1)(f) GDPR.

• pages and files accessed
• time of access
• operating system, browser type and version
• referrer URL (previously visited page)
• anonymised IP address (truncated, no personal reference)

A personal reference is excluded by the anonymisation. No cookies are set. There is no profiling and no cross-site tracking.

You can object to the collection of your visits at any time:

5. External resources & interfaces

All design and program libraries used on our website (including TailwindCSS, Leaflet, canvas-confetti) are served from our own server. We do not use a content delivery network (CDN). Simply visiting our pages therefore transmits no personal data – in particular no IP addresses – to third parties.

On the detail pages of individual machines we show nearby points of interest. We retrieve the required data via Google Places and Google Place Photos (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing in the USA by Google LLC cannot be ruled out).

This request is made exclusively by our server, not from your browser. Your IP address is not transmitted to Google; the associated images are also delivered from our own server. Only the coordinates of the respective machine are transmitted. We cache the responses for 90 days in order to keep the number of requests low.

The legal basis is our legitimate interest in an informative and performant presentation of our service (Art. 6(1)(f) GDPR). Information on data processing by Google can be found at https://policies.google.com/privacy.

6. Video previews (YouTube)

On individual location detail pages we display preview images for YouTube videos by creators we work with. These preview images are delivered from our own server; no data is transmitted to YouTube or Google when the page is loaded. The video itself is not embedded. Only when you click a preview image or a channel link does YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) open in a new tab; Google is responsible for the data processing there. Further information: policies.google.com/privacy.

7. Map display with Leaflet & OpenStreetMap

To display maps we use the open-source library Leaflet, which we serve from our own server, as well as map tiles from the OpenStreetMap service (OpenStreetMap Foundation, United Kingdom). The map tiles are loaded directly from the servers of the OpenStreetMap Foundation when a map is displayed; in doing so, your IP address and technical data are transmitted there. Further information can be found in the privacy policy of the OSM Foundation.

8. Location detection & geodata (geocoding)

On pages where you can submit new machines, you have the option of automatically using your current location. For this we use the geolocation function of your browser or device.

Location detection only takes place if you actively click “📍 Use current location” and allow your browser access. The determined coordinates are entered locally into the form and are not stored before you submit the form.

To determine the country, region and place from the coordinates, we use the Nominatim API of OpenStreetMap. If you determine the location via the “📍 Use current location” button, this request is made directly from your browser; in this case the coordinates and your IP address are transmitted to the OpenStreetMap servers. If instead you set or move the location on the map, the request runs on our server, without your IP address being transmitted to OpenStreetMap.

The legal basis for using your device's location function is your consent (Art. 6(1)(a) GDPR), which you give by actively clicking. The conversion of coordinates into an address via Nominatim is based on our legitimate interest in a correct location assignment (Art. 6(1)(f) GDPR).

Conversely, when submitting you can also enter an address; we convert it into coordinates via the same OpenStreetMap Nominatim API in order to place the map pin. This request takes place on our server; your IP address is not transmitted to OpenStreetMap in the process. The legal basis is our legitimate interest in a correct location assignment (Art. 6(1)(f) GDPR).

9. Submission form & uploads

When you submit a machine, we store the information provided (name, location, coordinates, description, category, optionally your email address). You can also upload images (title image, coin designs), which are stored on our server.

The processing is carried out exclusively for the purpose of reviewing and publishing the submitted location (Art. 6(1)(a) and (f) GDPR). Email addresses are used only for queries.

10. Marketplace & messages

Via the marketplace you can publish swap and sale offers and contact other users. In doing so, we process the content of your offers as well as the messages you exchange with other users. These messages are intended for the respective conversation partners and are stored in order to deliver and display them. If there is an unread message for you, we notify you once by email at the address stored in your account.

If you report an offer or a message, we process the report for review and moderation. The legal basis is the provision of the function you use (Art. 6(1)(b) GDPR) as well as our legitimate interest in a safe platform free of misuse (Art. 6(1)(f) GDPR).

11. Collection data, favourites and specimens

If you mark a collectible as “I have this” or add a favourite, we store that assignment with your user account. You may additionally record voluntary details about an individual piece – such as security strip type, hologram type, serial number and your own note.

These details are visible to you alone and are not published. They are entirely optional: adding an item to your collection works without them. The legal basis is the provision of the function you are using (Art. 6(1)(b) GDPR).

You can remove individual entries yourself at any time. If you delete your user account, collection data, favourites and specimen details are deleted with it.

12. Prize draws

If you take part in a prize draw, we process your participation data (username, assigned ticket/slot number, number of tickets and, where applicable, your winner status). If you win, we use your email address to notify you. The legal basis is the performance of the prize draw (Art. 6(1)(b) GDPR).

For traceability and a transparent presentation of the draw, an immutable record (snapshot) of the entries is created before the draw. The data required to prove the draw remains stored even after the prize draw has ended (Art. 6(1)(f) GDPR – legitimate interest in verifiability).

Community challenges

For the country-based community challenges we additionally process the contributions counted during the challenge period (type of action, catalogue entry concerned, time of submission, approval status and the points regularly awarded for it). Your challenge score and ranking are calculated from this. There is no separate sign-up; participation arises from using the platform. The legal basis is the performance of the participation relationship (Art. 6(1)(b) GDPR). If you finish in a winning place, we notify you by email.

Username, ranking and score are shown in the publicly visible leaderboard and in the permanently published final result. The final result remains stored after the challenge has ended (Art. 6(1)(f) GDPR – legitimate interest in the verifiability of the competition result). Details are set out in the terms of participation for challenges.

13. Mobile app (PWA)

Our platform is additionally available as an installable app at app.mycoinquest.de. The same processing applies there as on the website. For logging in, the app uses the same session cookie as our website (www.mycoinquest.de) so that you remain logged in in both environments. The app caches content for offline use; this data remains on your device.

14. Publication on social media (Instagram)

If you agree in the submission form that your uploaded coin images may be published on our official Instagram channel (@mycoinquest.de), we process this data on the basis of your consent (Art. 6(1)(a) GDPR).

You can withdraw this consent at any time with future effect by contacting us by email at info@mycoinquest.de. After withdrawal, the affected content will be deleted promptly.

15. User accounts & registration

When you create a user account, we process the data you provide (username, email address, password hash) to manage your account and verify your email address. You may voluntarily upload a profile picture. It is stored on our server and displayed together with your username, for example with your swap offers and in winner lists. It is removed when your account is deleted. The data is stored exclusively on our server and is not passed on to third parties.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (operation and security of the website).

Days of activity. While you are signed in, we record on which calendar days you used the platform – one entry per day with the date, without the time and without the pages you viewed. We also store the time of your last sign-in. This information is only evaluated in aggregate, for example how many users used the platform on a given day or in the last 30 days. We delete days of activity automatically after 400 days, and in any case – together with the sign-in time – when your account is finally deleted. Nothing of this is recorded without an account. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in understanding how the platform is used and developing it in line with demand.

16. Legal bases

• Art. 6(1)(a) GDPR – consent
• Art. 6(1)(b) GDPR – performance of a contract
• Art. 6(1)(f) GDPR – legitimate interest

17. Your rights

• information about the data stored by us
• rectification of inaccurate data
• erasure of your data
• restriction of processing
• data portability
• objection to processing
• withdrawal of consent given, with future effect
• Right to download your information

You can download the data we store about you yourself at any time – when signed in, under “Download my data” in your profile. You will receive a file in a common, machine-readable format (JSON).

You also have the right to lodge a complaint with a data protection supervisory authority.

18. Storage period

We store personal data only for as long as is necessary for the respective purposes or as long as statutory retention obligations exist.

Contract- and billing-related data is stored in accordance with tax and commercial retention periods (generally 6 or 10 years).

Comments that you delete yourself are hidden immediately and are from that moment on visible neither to other users nor to you. For technical reasons – existing likes refer to the entry – and in order to investigate cases of abuse, the record is then retained for a further 14 days. After that, the content and the author name are deleted automatically and the link to your account is removed; no personal reference remains. The legal basis for this short retention period is our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

You can delete your user account yourself at any time – on the website in your profile, in the app under “More”, in each case via “Delete account”. The account is first deactivated for 30 days; during this period you can cancel the deletion by logging in again. Content you have submitted (e.g. machines, coin images, comments) will be anonymised and detached from your account so that jointly used content – such as other users' collector's albums – is preserved. Statutory retention obligations and the data required to prove prize draws (section 12) remain unaffected.

19. Hosting

Our website is operated by an external hosting service provider. All data collected on our website is processed on its servers.

A data processing agreement pursuant to Art. 28 GDPR exists with the hosting provider.

20. Partner recommendations (advertisements)

On individual machine detail pages we display local partner recommendations as labelled advertisements. When an advertising partner submits a recommendation, we process the data provided for it (business name, description, public contact details, address as well as internal contact and billing data of the contact person) in order to review, approve and display the advertisement. The legal basis is the performance of the advertising contract (Art. 6(1)(b) GDPR) and our legitimate interest in functioning marketing (Art. 6(1)(f) GDPR).

To determine the location, the address provided is converted into coordinates via the OpenStreetMap Nominatim map service upon submission; this happens on our server, and your IP address is not transmitted to the service.

To measure advertisement performance, we count clicks on the website and route buttons in aggregated form. This counting serves the statistical evaluation of advertisement performance (Art. 6(1)(f) GDPR) and is not assigned to any individual website visitor.

Enquiry as an advertising partner. On machine detail pages where the advertising slot is vacant, you can request the access link to the partner form yourself. In doing so we process the business name you provide and your email address in order to send you this link once. The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). The email is sent solely upon your explicit request; we do not send you any advertising beyond that.

In addition, for each such enquiry we store the IP address and the time in order to prevent misuse of the form for sending bulk emails. The legal basis is our legitimate interest in the security of our systems and in protecting third parties from unwanted messages (Art. 6(1)(f) GDPR).

Storage period. The access link is valid for 30 days. If you request a link without subsequently submitting a recommendation, we automatically delete the data stored for the enquiry (business name, email address, IP address) once this period has expired. We delete the log data used to prevent misuse after 30 days at the latest. If you do submit a recommendation, the storage period for the partner data is governed by the advertising contract and the statutory retention periods (in particular up to 10 years under commercial and tax law).

21. GetYourGuide (experiences & tickets, affiliate)

On machine detail pages we offer a clearly labelled advertising section featuring trips and tickets from GetYourGuide Deutschland GmbH, Sonnenburger Straße 73, 10437 Berlin, Germany.

Only after your click. The section is initially shown as a placeholder only. No data is transmitted to GetYourGuide unless you click the button to load the offers. The legal basis for the subsequent loading is your consent (Art. 6(1)(a) GDPR, Sec. 25(1) TDDDG), which you give by clicking. Without that click, no connection to GetYourGuide takes place.

What data is transferred. When you click the button, the widget is loaded from GetYourGuide servers. This transmits your IP address, technical details about your browser and device, and the page you are visiting to GetYourGuide; GetYourGuide may set cookies or use comparable technologies. The location relevance of the offers shown derives from the public page content (town and region of the machine) – we do not transmit location data from your device.

Purpose and commission. If you book through these offers, we receive a commission. GetYourGuide uses its own identifiers to attribute it. Our interest in refinancing this free service is based on Art. 6(1)(f) GDPR insofar as processing goes beyond the integration you consented to.

Third-country transfer. Processing outside the EU/EEA cannot be ruled out. For details of GetYourGuide’s data processing and your rights towards them, please see the provider’s privacy policy at getyourguide.com/privacy-policy.

Withdrawal. Your consent applies to the respective page view only. If you reload the page without pressing the button again, the widget will not load.

22. Contact form

You can send us a message via our contact form. In doing so, we process the name you provide, your email address, an optional subject and the content of your message in order to deal with your request and reply to you. The legal basis is the performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR) and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We use your email address exclusively to handle this request; we do not send you any advertising on that basis.

Conversation instead of single message. Messages from the same email address are combined into a continuous conversation so that earlier requests can be taken into account when handling a new one. When we reply, you receive an email containing a link that lets you view the conversation and reply directly. This link contains a random identifier, is valid for 30 days and is replaced with every new reply from us. It grants access to the associated conversation and should therefore not be passed on.

In addition, we store the IP address and the time of each incoming message in order to prevent misuse of the form (spam, automated bulk messages). The legal basis is our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).

Storage period. We delete the IP address after 30 days at the latest. Completed conversations are deleted 12 months after the last message, unless statutory retention periods require otherwise.

23. Operator accounts & manufacturer details

Operator accounts. Operators of machines and points of sale may receive a user account with extended rights from us so that they can maintain the locations assigned to them themselves. For this purpose we process the details belonging to the business (company name, website, contact e-mail address, telephone number and address). The legal basis is the performance of the agreement on location maintenance (Art. 6(1)(b) GDPR) and our legitimate interest in reliable location data (Art. 6(1)(f) GDPR).

Publication. These details are displayed publicly on the detail pages of the assigned locations so that visitors can contact the operator. Only business contact details are intended for this. If they are to contain information about a natural person (such as the name of a contact person or a personal telephone number), publication only takes place with the express consent of the person concerned (Art. 6(1)(a) GDPR). This consent may be withdrawn at any time with effect for the future; we will then remove the details without delay.

Storage period. We store the operator details for as long as the location is being maintained. If the cooperation ends, we remove the contact details from the location pages; the location data itself (place, opening hours, designs) remains part of the community directory.

Manufacturer details. When submitting a machine you can select the manufacturer from a list. If a manufacturer is missing, you can select “Other” and suggest a name. This suggestion is not published; we review it and add it to the list where appropriate, and until then the submission remains in moderation. The legal basis is our legitimate interest in the accuracy and consistency of the directory data (Art. 6(1)(f) GDPR). We delete the suggested text once it has been processed.