🔒 Privacy Policy

Information pursuant to Art. 13 GDPR on the processing of personal data · ← Overview

1. Controller

Kahraman Atalay
Deisterstr. 54, 31785 Hameln, Germany
Email: beratung@kaatai.de
Full imprint: /en/impressum.html

2. Hosting

The Atlas is hosted on a server of netcup GmbH (Daimlerstr. 25, 76185 Karlsruhe, Germany), data centre in Nuremberg. A data processing agreement pursuant to Art. 28 GDPR is in place. All data remains within the EU.

3. Which data is processed?

3.1 When the page is accessed (server logs)

Each time an Atlas page is accessed, the following data is stored in the nginx web server log:

• IP address (anonymised: last octet set to 0)
• time of access
• requested URL
• referrer (previous URL, if transmitted by the browser)
• user agent (browser version)
• HTTP status code, volume of data transferred

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring operation and detecting attacks). Retention period: 14 days, then automatic deletion via logrotate.

3.2 Usage statistics (Atlas tracking)

On atlas.kaatai.de we record which indicators and functions are used, in order to improve the tool. Per event we store:

• event name (e.g. ind / cell_inspect / load), optionally the indicator key and the page visited
• tier (free / pro …) and — if signed in — the user ID
• anonymous session ID (randomly generated, stored in the browser's localStorage, valid for up to 1 year; no personal reference)
• shortened IP address (last octet removed) and the coarse region derived from it (country / region / city)

The full IP address is used only briefly in memory to determine the region and is not stored. There is no merging with advertising networks and no profiling. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the tool). Retention period: individual events max. 180 days, then only anonymised daily aggregates. You can delete the session ID at any time by clearing your browser storage.

3.3 Workspace sign-in (magic link, optional)

When you sign in with your email address (e.g. in the Atlas or the dashboard), we process:

• email address (unique, lowercased)
• time of registration, last login
• tier (free · pro · premium)
• magic-link token (valid for 15 minutes, single use)
• session token (valid for 30 days, HttpOnly cookie)
• optional: user agent of the session (for later session management)

Legal basis: Art. 6(1)(b) GDPR (contract · provision of the workspace service). Retention period: until your account is deleted (request by email to beratung@kaatai.de). Magic-link tokens are deleted after expiry, session tokens upon logout.

3.4 Workspace items (your saved configurations)

When you save cell bookmarks, twin sets, postal-code configurations or compare snapshots in the Atlas, they are stored as JSON data in a PostgreSQL database (schema atlas_app.items) on the netcup server. Content:

• label you assign and an optional note
• item type (cell bookmark / twin set / postal-code config / compare)
• tool-specific data (e.g. cell coordinates, filter constellation, district slugs)
• metadata (creation and modification time)

This data is not attributable to a person through the content itself, but is linked only via your user ID. Retention period: until deletion by you or account deletion.

3.5 Magic-link emails

Login emails are sent via SMTP through our own Docker mail server (mail.kaatai.de). Sender: noreply@kaatai.de. The recipient's email address is used exclusively for sending the email, not for advertising. There is no newsletter and no tracking pixels in the emails.

3.6 Pro requests

If you enter data in the sign-up form for Pro access (name, company, position, LinkedIn URL, purpose of use), it is transmitted by email to info@kaatai.de and stored in an audit log (/var/log/atlas/pro-requests.log). Legal basis: Art. 6(1)(b) GDPR (initiation of a contract). Retention period: 24 months.

3.7 Contact form and appointment booking

When you use the contact form, we process the data you enter (name, email address, message) in order to handle and answer your enquiry. The data is transmitted by email to beratung@kaatai.de (reply address = your email) and stored in an audit log (/var/log/atlas/contact-requests.log). Legal basis: Art. 6(1)(f) GDPR (answering the enquiry), or Art. 6(1)(b) where related to a contract. Retention period: until your enquiry has been fully handled; any retention beyond that only where legally required.

Alternatively, you can book a call directly via our booking system booking.kaatai.de. The data you enter there (name, email, preferred time) is processed solely to manage and conduct the appointment (Art. 6(1)(b) GDPR).

4. Third-party providers

4.1 OpenStreetMap / Nominatim (city search)

The address/city/postal-code search in the Atlas uses the open geocoding API Nominatim of the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, UK). Your search query is transmitted to Nominatim servers. Privacy policy: wiki.openstreetmap.org/wiki/Privacy_Policy. Transfer to the UK is based on the adequacy decision of the EU Commission.

4.2 MapLibre + OpenFreeMap (map tiles)

The base map is delivered as vector tiles by OpenFreeMap (hosted in Switzerland by a non-profit open-source project). When the maps load, tile requests are sent to their CDN (including the IP address for delivery). Privacy policy: openfreemap.org/about/.

5. Cookies and browser storage

• atlas_session (HttpOnly cookie, 30 days): set only if you sign in with a magic link. Content: random session token. Purpose: to recognise you on later visits. Can be removed via the logout button.
• localStorage (browser storage, not stored on the server): pin visibility settings (which map markers you have hidden), cell-bookmark cache, selected scale mode, anonymous tracking session ID (atlas_anon_id, up to 1 year; see 3.2). Removed when the browser cache is cleared.

No third-party cookies, no advertising cookies, no tracking cookies.

6. Your rights (Art. 15-22 GDPR)

You have the right at any time to:

• access to the data stored about you (Art. 15)
• rectification of inaccurate data or completion of incomplete data (Art. 16)
• erasure of your data (Art. 17, "right to be forgotten")
• restriction of processing (Art. 18)
• data portability in a structured, commonly used, machine-readable format (Art. 20)
• objection to processing (Art. 21)

Please send requests informally to beratung@kaatai.de. We usually respond within 7 days.

7. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. Responsible for Lower Saxony:
Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover · lfd.niedersachsen.de

8. Data protection officer

Due to the size and nature of the processing, the appointment of a data protection officer pursuant to §38 BDSG is not required. The controller can be contacted directly (see above).

9. Changes to this privacy policy

We update this policy when the processing changes (e.g. new third-party providers, new features involving data processing). The version and last change are at the end of this page.