Privacy policy
This policy covers the test.hiclub.io website, the web app, the iOS and Android apps and the admin panel. The sections are labelled accordingly.
Die deutsche Fassung ist rechtlich verbindlich. This English text is a convenience translation. In case of any discrepancy, the German version prevails — read it here.
1. Controller
Pale Blue Dot GmbHAlte Kasseler Straße 52
35039 Marburg
Deutschland
Geschäftsführerin (Managing Director): Yasaman Serajian Moghaddam
Email: info@palebluedot.de
For all data-protection matters and to exercise your rights under Art. 15–21 GDPR: datenschutz@marburg.club. This address serves every club we operate — one controller, one channel.
We have not appointed a data protection officer. The thresholds in Art. 37 GDPR and § 38 BDSG are not met: fewer than 20 people are permanently engaged in automated processing, and our core activity is neither large-scale regular and systematic monitoring nor large-scale processing of special categories of personal data. The assessment forms part of our Art. 30 record of processing.
2. Supervisory authority and right to complain
The competent authority is the one at the controller's establishment. That establishment is Marburg, so for every club — whichever city you take part in — it is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI)Gustav-Stresemann-Ring 1
65189 Wiesbaden
Deutschland
Email: poststelle@datenschutz.hessen.de
https://datenschutz.hessen.de
Independently of this, Art. 77 GDPR lets you complain to the authority of your habitual residence or of the place of the alleged infringement.
3. What we do not do
No tracking, no web analytics, no advertising networks, no social media plugins, no profiling. We do not sell data and we do not combine data from different sources into a profile. There is no automated decision-making within the meaning of Art. 22 GDPR.
4. The website (test.hiclub.io)
4.1 Server logs
Every request is automatically recorded with:
- the date and time of the request,
- the full address requested, including everything after the question mark,
- the method, the HTTP status code and the number of bytes transferred,
- the referring page, if your browser sends one,
- the complete browser identification (user agent), including device model and operating-system version,
- an IP address — see the next paragraph.
Which IP address is recorded depends on the hostname. Some of our hostnames are delivered through Cloudflare's content delivery network. For those, our logs contain the address of a Cloudflare server rather than yours, and your address is processed by Cloudflare instead (section 8). For the remaining hostnames your own IP address is recorded by us. We are working to make this consistent.
We deliberately do not state a retention period in days, because there isn't one. Logs are rotated by volume rather than by time: each service keeps the current file plus a small number of older generations, and everything belonging to a service is deleted when it is restarted or replaced — which happens with every software update. Depending on traffic, that works out in practice as anything from a few days to a few weeks. Logs are not shipped anywhere else and are not combined into a profile. A time-based retention rule is being introduced and will be stated here once it takes effect.
On the servers themselves the operating system additionally keeps a system log (covering, among other things, administrative access) spanning roughly four months. It contains no visitor traffic to the website.
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is operating the service, diagnosing faults and defending against attacks.
4.2 Third-party resources on our pages
The three legal documents — this one, the legal notice and the terms of participation — load nothing from any external server. No web font, no script, no icon set, no map. You can read these pages without your browser contacting anybody else.
That is not yet true of our other pages. Our landing pages load fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com) and style and script files from the jsDelivr (cdn.jsdelivr.net) and cdnjs (cdnjs.cloudflare.com) delivery networks. Fetching those files necessarily transmits your IP address and browser identification to the provider concerned. No cookies are set and no accounts are matched in the process. The legal basis is Art. 6 (1) (f) GDPR — our interest in a consistent presentation. We are moving these files onto our own servers. Until then we name them here rather than pretend they are not there.
4.3 Storage on your device when merely visiting the website
The public information pages set no cookies and store nothing in your browser. The storage that takes place when you use the app is described in section 5.3.
5. Web app and the iOS and Android apps
The web app at app.test.hiclub.io and the native iOS and Android apps
are the same service with the same processing. They differ only where the
operating system requires its own permission (camera, location, notifications).
Where there is a difference, it is stated at that point.
5.1 What is processed
| Data | When | Legal basis |
|---|---|---|
| Email address | On registration and at every sign-in (one-time code). The only mandatory field. Further addresses can be added and removed. | Art. 6 (1) (b) |
| Display name | Optional, set in your profile. It is shown to the staff of the business on their tablet when you request a stamp, so they can see who is at the counter. It is the one field that reaches a third party in daily use. | Art. 6 (1) (b) |
| Date of birth | Optional, in your profile. It is not collected at registration. | Art. 6 (1) (a) / (b) |
| Language, light/dark appearance | App settings. | Art. 6 (1) (b) |
| Loyalty card number | Generated per account, printable and scannable. It appears in the address of the card page and therefore also in the server logs (section 4.1). | Art. 6 (1) (b) |
| Visits, stamps, rewards, offer reservations | On every scan and every redemption. This is the substance of the programme. | Art. 6 (1) (b) |
| Precise location | Only if you grant the operating-system permission. The coordinates are appended as parameters to the requests for the home and discover screens, to sort businesses by distance. They are not stored in our database. Because they are part of the address, they do appear in the server logs — for how long, see section 4.1. | Art. 6 (1) (a) |
| Camera | Only to read QR codes. Only the decoded string leaves your device. No image is transmitted and none is stored. | Art. 6 (1) (b) |
| Technical scan records | Every check-in records which business was scanned and whether an existing session was present, for abuse detection and diagnosis. | Art. 6 (1) (f) |
| Apple Wallet pass | Only if you create one. The file contains your display name and your loyalty card number and is stored on our server. | Art. 6 (1) (b) |
| Consent record | When you accept the terms of participation we store the time, the document version and a hash of your IP address — never the address itself. A consent has to be attributable, but keeping a register of every member's IP address would be a worse privacy failure than the one it guards against. | Art. 7 (1) |
5.2 Guest accounts — read this if you scanned without signing up
You can scan a QR code at a counter without having registered first. When you do, we automatically create a guest account so that your stamp can belong to somebody. This happens with no sign-up form and no further input from you.
A guest account consists of an internal number, your stamps and visits, and a session identifier in your browser or app. No name, no email address. For guest accounts that session identifier is valid for up to 180 days — considerably longer than for signed-in accounts (30 days) — so that your stamps are not lost if you only come back weeks later.
The legal basis is Art. 6 (1) (b) GDPR: you requested the service by scanning. As a guest you have every data-subject right, including erasure — see section 10. You can turn a guest account into a full account at any time by adding an email address.
5.3 Storage on your device (§ 25 TDDDG)
The app stores the following in your browser or on your device:
| Name | Type | Lifetime | Purpose |
|---|---|---|---|
mc_jwt | Cookie | 30 days (signed in) / 180 days (guest) | Your session |
mc_jwt_guest | Local storage | as above | A second copy of the session. Safari caps the lifetime of cookies a page writes itself at 24 hours. Without this copy, guests would lose their stamps. |
mc_intro_seen | Local storage | permanent | Show the introduction only once |
mc_language | Local storage | permanent | Chosen language |
mc_theme | Local storage | permanent | Light or dark appearance |
mc_guest_email_prompt_snoozed_at | Local storage | 14 days | Avoid repeating the “secure your stamps” prompt too often |
PHPSESSID | Cookie, admin panel only | 30 days | Staff sign-in |
All of these are strictly necessary for the service you explicitly requested (§ 25 (2) no. 2 TDDDG). None is used for analysis, profiling or advertising. That is why we do not ask you for cookie consent: there is nothing here that would require it. You can remove them at any time through your browser settings or by signing out — although guest accounts then lose access to their stamps.
5.4 Sign-in by one-time code
To sign you in we send a six-digit code to your email address. The code is valid for 15 minutes and is held in our cache for that time — not under your email address but under a hash of it, so that the cache is not a directory of addresses. Delivery is via Mailgun (section 8).
5.5 Signing in with Apple or Google
Where the app offers sign-in with Apple or Google and you use it, we receive an identifier from the provider and — depending on what you choose there — your email address. To check that the token is genuine, our server fetches the provider's public signing key. Only our server's IP address is transmitted in doing so and none of your data: the verification itself happens on our side. Your device contacts the provider separately as part of the sign-in itself.
5.6 Notifications
If you allow push notifications we store the device token Apple or Google issues for that purpose. You can withdraw the permission in your operating system at any time.
6. Participating businesses
When you request a stamp at a counter, the staff see on the business's tablet your display name (if you have set one), your current stamp count in that business's programme, and the fact that you are requesting a visit right now. Through the admin panel a business can view the visits and redemptions that occurred at its own premises.
To that extent the business is a controller in its own right for what it does with this information in its own business. What it processes within our programme is governed by the participation agreement. Businesses do not receive lists of our members, no email addresses, and no data about visits to other businesses.
7. Admin panel (staff and partner businesses only)
Staff and partner businesses sign in at panel.test.hiclub.io. We
process the username, a password hash and the PHPSESSID session
identifier. Unlike these legal documents, the panel's pages load style and
script files from jsDelivr and unpkg. The forms with a map
view additionally fetch map tiles and address lookups from
OpenStreetMap (nominatim.openstreetmap.org, overpass-api.de), and the
event detail view embeds a Google Maps frame. The IP address of the
person using the panel is transmitted to the provider concerned. These
integrations are also being moved onto our own servers. The legal basis is
Art. 6 (1) (f) GDPR.
8. Recipients and processors
| Recipient | For what | Where |
|---|---|---|
| Hetzner Online GmbH | Running the servers and the database | Germany |
| Cloudflare | DNS for all of our hostnames and content delivery for
some of them (section 4.1). Cloudflare additionally instructs your
browser, on the hostnames concerned, to report network errors to
a.nel.cloudflare.com (Network Error Logging). That is a
provider default rather than a setting of ours; we are switching it off,
and name it here until we have. |
EU/USA, under standard contractual clauses |
| Mailgun (Sinch) | Sending the sign-in emails. We deliberately use the service's EU endpoint. Your email address and the content of the message are transmitted. | EU |
| Participating businesses | Display name and the fact of a visit, on the tablet at the counter (section 6) | Germany |
| Apple, Google | App distribution through the app stores and delivery of push notifications | under the providers' terms |
We have Art. 28 GDPR agreements with every processor. Any transfer to a third country takes place only on the basis of the European Commission's standard contractual clauses.
9. Retention
| Data | Period |
|---|---|
| Account, profile, email addresses | Until you delete it. Automatically after 24 months with no sign-in and no visit. |
| Guest accounts never linked to an email address | 12 months after the last visit |
| Visits and stamps | Anonymised after 24 months: the visit remains as a statistic for the business, the link to you does not |
| Redeemed rewards | 36 months, then anonymised — the regular limitation period under § 195 BGB for disputes about a reward |
| Technical scan records | 90 days |
| Sign-in codes | 15 minutes |
| Apple Wallet passes | With the account. Orphaned files after 30 days |
| Server logs | See section 4.1 — by volume, not by time |
| Consent records | For the life of the account and beyond, for as long as they are needed as evidence |
10. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Any consent you have given can be withdrawn at any time with effect for the future (Art. 7 (3)).
Two of these you do not have to ask us for — they are built into the app. Under Profile → Account you will find:
- Download my data — your profile, email addresses, card, consents, stamps, visits, redemptions and reservations as a single file.
- Delete account — immediately, without asking us.
Deletion does exactly this:
Your account, your profile, your email addresses, your loyalty card and your current stamp balance are deleted. Visits already made and rewards already redeemed are retained as anonymised statistics for the participating businesses and can no longer be linked to you.
The reason for the split: a café issued a certain number of stamps, and your right to disappear is not a right to change that café's books retroactively. After anonymisation those records name nobody.
For everything else write to datenschutz@marburg.club. We answer within one month (Art. 12 (3) GDPR).
11. Is providing data required?
An email address is required to hold a permanent account — without one we cannot send you a sign-in code. Everything else is voluntary. The app works fully without location access; only sorting by distance is unavailable.
12. Security
All traffic is encrypted (TLS). Staff passwords are stored only as hashes. Tablet device keys are hashed before storage. Email addresses in our cache and IP addresses in consent records are stored only as an HMAC, never in the clear.
13. Changes to this policy
We update this policy when the processing changes. The version published here, with the date given below, is the applicable one. We will point out material changes in the app.