Privacy Policy

Controller within the meaning of the GDPR is: DJ Forte (owner: Dennis Forte) Forsteck 2, 23623 Ahrensbök Email: info@locationscout.online

On registration: email address, display name, first and last name (internal, never public), password (stored as a bcrypt hash).

For reviews: review text, star ratings, optionally occasion and number of guests, IP address as SHA-256 hash (never in plain text), user-agent hash.

For inquiries: the data entered in the inquiry form (e.g. date, number of guests, message), IP address as SHA-256 hash.

Automatically: server log files with IP hash, timestamp, and requested path. In addition, self-hosted, cookieless audience measurement (see section 8) — without third-party analytics tools and without cross-site tracking.

For owners: company name, contact details, verification documents where applicable (stored encrypted, only for moderation).

We process your data for the following purposes:

• Operation and provision of the Platform (contract performance)
• Verification of reviews (legitimate interest: quality assurance, BGH compliance)
• Content moderation (legitimate interest: protection against abuse)
• Responding to inquiries (contract performance / legitimate interest)
• Transactional emails (confirmations, status updates)
• Security and abuse prevention

Processing takes place on the basis of Art. 6 GDPR:

• Art. 6(1)(b): contract performance (account management, submitting reviews)
• Art. 6(1)(c): legal obligation (BGH requirements for review platforms)
• Art. 6(1)(f): legitimate interests (security, abuse prevention, quality assurance)

We only store your data for as long as is necessary for the respective purpose:

• Account data: until account deletion + 30 days (soft delete)
• Reviews: until deletion by user or admin + 30 days (soft delete). IP hash and review content are retained for 3 years for BGH-compliant traceability.
• Verification documents: 90 days after review, then automatically deleted
• Server logs: 14 days
• Inquiries: 2 years

We do not pass your data on to third parties, with the following exceptions:

• Email delivery: via our own mail server at our hosting provider Dogado (servers located in Germany); we do not use external email service providers.
• File storage & backups: Uploaded files are stored on our web server at Dogado GmbH, Hindenburgstraße 5, 44137 Dortmund, Germany. Daily backups (database and uploaded files) are additionally stored — transferred encrypted — at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (data centre Nuremberg, Germany; data processing agreement per Art. 28 GDPR).
• AI moderation: Review texts and uploaded photos are transmitted to the Claude API of Anthropic PBC (USA) for automated content checks. This is a third-country transfer, safeguarded via the EU-US Data Privacy Framework and EU standard contractual clauses. Only the content to be checked (text or image) is transmitted, without names or contact data. Legal basis: our legitimate interest in a safe, lawful platform (Art. 6(1)(f) GDPR).
• Payment (owner premium): Payments for premium subscriptions are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Stripe receives the data required for payment (name, email, payment details); card and account data are processed exclusively by Stripe and never reach our servers. Transfers to Stripe, Inc. (USA) may occur and are safeguarded via the EU-US Data Privacy Framework and standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR.
• Authorities: in the event of a legal obligation
• Hosting & server operation: Dogado GmbH, Hindenburgstraße 5, 44137 Dortmund. Server location Germany. Processing on our behalf under Art. 28 GDPR. Hosts web server, database and file storage.
• Invoicing: For premium subscription invoices we use lexoffice (Haufe-Lexware GmbH & Co. KG, Munzinger Str. 9, 79111 Freiburg, Germany). Name and invoice data are transmitted. Legal basis: Art. 6(1)(b) and (c) GDPR (statutory retention: 10 years).
• Map display: Venue detail pages can display an OpenStreetMap map. It loads only after you click “Load map”; your IP address is then transmitted to the OpenStreetMap Foundation (United Kingdom; EU adequacy decision). Legal basis: your consent (Art. 6(1)(a) GDPR), given by the click.

Publicly displayed data: your display name and review content are publicly visible. Your real name, your email address, and your IP hash are never publicly accessible.

You have the following rights under the GDPR:

• Access (Art. 15): which data we store about you
• Rectification (Art. 16): correction of inaccurate data
• Erasure (Art. 17): deletion of your data ("right to be forgotten")
• Restriction (Art. 18): restriction of processing
• Data portability (Art. 20): export of your data in a machine-readable format
• Objection (Art. 21): objection to processing based on legitimate interests
• Complaint (Art. 77): with the competent data protection authority

To exercise your rights: info@locationscout.online

The competent supervisory authority is the Independent Centre for Data Protection of Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany — mail@datenschutzzentrum.de, datenschutzzentrum.de.

Locationscout does not use tracking cookies, third-party analytics tools (e.g. Google Analytics) or social media pixels. To measure visitor numbers we use self-hosted, cookieless audience measurement: when a page is loaded, the requested path, referrer domain, device type, language and time are stored on our own server. No cookies are set and no identifiers are stored in your browser (§ 25 TDDDG does not apply). Your IP address is not stored; it is only transiently combined with a random value that rotates daily and is deleted after 36 hours to form a short-lived hash — recognition beyond a single day or attribution to a person is therefore impossible. The legal basis is our legitimate interest in statistical analysis of usage (Art. 6(1)(f) GDPR); “Do Not Track” and Global Privacy Control are honored.

We only use technically necessary cookies:

• Session cookie (HttpOnly, SameSite=Strict): for login. Deleted on logout.
• CSRF token: protection against cross-site request forgery.
• Theme preference: stores light/dark mode setting locally in the browser.
• NEXT_LOCALE: stores your language preference (German/English), lifetime 1 year, SameSite=Lax.

These cookies do not require consent pursuant to § 25 para. 2 no. 2 TTDSG.

For data protection questions:
info@locationscout.online