Privacy policy

Who is responsible

Responsible for this website, the sign-in pages at app.rondiloop.com and the early-access list (controller under Art. 4 (7) GDPR):

Tobias Schäfer (BuildIT Consulting) Raiffeisenstraße 40 67133 Maxdorf Germany hello@rondiloop.com

Visiting this website

When you open a page, our servers process your IP address, the date and time, the page you asked for, the page you came from and your browser’s user agent. That is needed to deliver the page and to keep the service secure, which is also our legitimate interest. Legal basis: Art. 6 (1) (f) GDPR.

Our servers are in Germany; we rent them from MegaServers.de (Andreas Fahl, Münster). Access logs are deleted after 7 days.

We back up the database once a day. The backups are stored with OVH (OVH SAS, France) in a data centre in the EU and deleted after 14 days.

To block abuse of the forms, your IP address is used as a counter key for at most one hour. It is never stored with anything you enter. Legal basis: Art. 6 (1) (f) GDPR, our interest in a service free of spam and abuse.

If an error occurs, we store technical details of the request (the page address and browser headers, without cookies) in our own error tracking (Bugsink) on our servers, so we can fix it. Error reports are deleted after 30 days. Legal basis: Art. 6 (1) (f) GDPR, our interest in a service that works.

Statistics with Plausible

To see which pages are read and where visitors come from, we use Plausible Analytics. We run it ourselves on our own servers; the data goes to no one else. Plausible sets no cookies and stores nothing in your browser.

When you open a page, Plausible records the page address (without parameters), the page you came from, your browser, operating system, device type and the country derived from your IP address. To count visits, Plausible hashes your IP address and user agent with a key that changes every day and is then deleted. The IP address itself isn’t stored, and visits on different days can’t be linked.

We only see totals, never individual visitors. Legal basis: Art. 6 (1) (f) GDPR, our interest in improving the website without following visitors around.

Cookies

This website sets no cookies.

On the sign-in pages at app.rondiloop.com we set two strictly necessary cookies: one for the session and one that protects against forged requests (CSRF). They expire after 120 minutes without activity. If you choose “Remember me”, a third one is added that lasts until you sign out, at most 400 days. Signing in isn’t possible without them. Legal basis: § 25 (2) no. 2 TDDDG and Art. 6 (1) (f) GDPR.

Early-access list

If you sign up, we store your email address, the product URL if you entered one, the language of the page, and when you signed up, confirmed and got our emails. We don’t store your IP address with it.

We use it only to tell you about the launch of RondiLoop and about early access. Legal basis: your consent, Art. 6 (1) (a) GDPR.

Double opt-in: we first send you an email with a confirmation link. If you don’t confirm within 7 days, your entry is deleted automatically.

You can withdraw your consent at any time with the link in our emails, or by writing to hello@rondiloop.com. We then delete your entry. Otherwise we delete it 30 days after we sent you the launch email.

Emails

We send emails through Brevo (Sendinblue SAS, France), which processes your address and the email on our behalf under a data processing agreement (Art. 28 GDPR). Brevo logs the delivery of each email with your address. Through an invisible image and redirected links it also notes whether an email was opened or a link in it clicked; we have set this to anonymised, so opens and clicks are kept without your address. We don’t use them to assess you. Legal basis: Art. 6 (1) (f) GDPR, our interest in emails that arrive.

Recipients

Your data reaches only the service providers named above: our server provider, OVH for the backups and Brevo for emails, each bound by a data processing agreement (Art. 28 GDPR). Statistics and error reports stay on our own servers. We don’t sell your data or pass it on to anyone else.

Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a machine-readable format (Art. 20),
• withdraw your consent at any time, with effect for the future (Art. 7 (3)).

Write to hello@rondiloop.com for any of these.

Right to object

Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop, unless we can show compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims. A short email to hello@rondiloop.com is enough.

Whether you have to provide data, and automated decisions

You don’t have to give us any data. Without the technical details sent when you open a page we can’t deliver it, though, and without an email address we can’t send you early-access emails. There is no automated decision-making or profiling (Art. 22 GDPR).

You can also complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.