Privacy Policy

Information pursuant to Art. 13 GDPR on the processing of personal data · ← Overview

1. Controller

Kahraman Atalay
Deisterstr. 54, 31785 Hameln, Germany
Email: beratung@kaatai.de
Full imprint: /en/impressum.html

2. Hosting

The Atlas and the Boxmethode are hosted on a server of netcup GmbH (Daimlerstr. 25, 76185 Karlsruhe, Germany), data centre in Nuremberg. A data processing agreement pursuant to Art. 28 GDPR is in place. All data remains within the EU.

3. Which data is processed?

3.1 When the page is accessed (server logs)

Each time a page of the Atlas or the Boxmethode is accessed, the following data is stored in the nginx web server log:

• IP address, shortened: for IPv4 the last part is 0, for IPv6 only the first 48 bits are kept
• approximate location (country, state, city), determined from the IP address at the moment of access; the IP address itself is stored only in shortened form
• time of access
• requested URL
• referrer (previous URL, if transmitted by the browser)
• user agent (browser version)
• HTTP status code, volume of data transferred

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring operation, detecting attacks and evaluating which regions the Atlas and the Boxmethode are used from). The server determines the location itself from a location database (GeoLite2 by MaxMind) stored on our server; nothing is transmitted to MaxMind. Security software on the server checks every request to detect attacks and block attacking addresses; it receives the complete IP address for this purpose, which is not written to the log. Retention period: 14 days, then automatic deletion via logrotate.

3.2 Usage statistics (Atlas only)

On atlas.kaatai.de we record which indicators and functions are used, in order to improve the tool. Per event we store:

• event name (e.g. ind / cell_inspect / load), optionally the indicator key and the page visited
• tier (free / pro …) and — if signed in — the user ID
• anonymous session ID (randomly generated, stored in the browser's localStorage, valid for up to 1 year; no personal reference)
• shortened IP address (last octet removed) and the coarse region derived from it (country / region / city)

The full IP address is used only briefly in memory to determine the region and is not stored. There is no merging with advertising networks and no profiling. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the tool). Retention period: individual events max. 180 days, then only anonymised daily aggregates. You can delete the session ID at any time by clearing your browser storage.

The Boxmethode does not collect usage statistics.

3.3 Shared account (magic link, optional)

When you sign in with your email address (in the Atlas, the dashboard or the Boxmethode), we process:

• email address (unique, lowercased)
• time of registration, last login
• tier (free · pro · premium)
• the service through which you first signed in (Atlas or Boxmethode)
• magic-link token (valid for 15 minutes, single use), together with the page you return to after clicking and the IP address of the request
• session token (valid for 30 days, HttpOnly cookie)
• optional: user agent of the session (for later session management)
• on first sign-in, the details from the sign-up form: first and last name (required) and, voluntarily, company, position, LinkedIn profile and what you plan to use the service for. The form is the same on the Atlas and the Boxmethode. We store these details in your account. You can change name, company, position and LinkedIn profile in your profile and voluntarily add a phone number, postal address and company address with VAT ID.

Legal basis: Art. 6(1)(b) GDPR (contract · provision of the workspace service). Retention period: until your account is deleted (request by email to beratung@kaatai.de). Magic-link tokens with return page and IP address are deleted 7 days after expiry, session tokens upon logout or 7 days after expiry.

When a new account is created, we receive a notification at info@kaatai.de with your email address, the time, the service used and the details you entered in the sign-up form. Legal basis: Art. 6(1)(f) GDPR (overview of new accounts and detection of abuse).

3.4 Saved content (Atlas items and box projects)

When you save something to the workspace in the Atlas, these entries are stored as JSON data in a PostgreSQL database (schema atlas_app.items) on the netcup server. You can save:

• map views: 1 km grid, 10 km district map, federal-state and district maps in 3D, Reichstag elections 1920 to 1933 and moves between districts
• selections: grid cells, districts, districts or constituencies of a federal state, municipalities of a district
• filter combinations across several indicators
• cell bookmarks, twin sets, postal-code configurations and district comparisons

Each entry contains:

• label you assign and an optional note
• the kind of entry (one of those listed above)
• tool-specific data (e.g. indicator, map extent, cell coordinates, district or municipality codes, filters)
• metadata (creation and modification time)

This data is not attributable to a person through the content itself, but is linked only via your user ID.

On the Boxmethode you can save box projects in the same database. A box project contains the name, the research question, the period, the area, the selected boxes, your hypothesis and notes. Question, hypothesis and notes are free text: whatever you enter there is stored as you write it. Please do not enter data about other people there that you are not allowed to share. Box projects are visible only to you.

On the Boxmethode you can also save map views. A view contains its name, the topic, the map address (date, extent, pitch, layers, period) and your settings for which entries always appear, appear only within the period, or never appear. Views are also visible only to you.

Retention period: until deletion by you or account deletion; deleting the account deletes all saved content.

3.5 Magic-link emails

Login emails are sent via SMTP through our own Docker mail server (mail.kaatai.de). Sender: noreply@kaatai.de. The recipient's email address is used exclusively for sending the email, not for advertising. There is no newsletter and no tracking pixels in the emails.

3.6 Pro requests

If you enter data in the sign-up form for Pro access (name, company, position, LinkedIn URL, purpose of use), it is transmitted together with the IP address of the request by email to info@kaatai.de and stored in an audit log (/var/log/atlas/pro-requests.log). Legal basis: Art. 6(1)(b) GDPR (initiation of a contract). Retention period: 24 months.

3.7 Contact form and appointment booking

When you use the contact form, we process the data you enter (name, email address, message) in order to handle and answer your enquiry. The data is transmitted by email to beratung@kaatai.de (reply address = your email) and stored in an audit log (/var/log/atlas/contact-requests.log). Legal basis: Art. 6(1)(f) GDPR (answering the enquiry), or Art. 6(1)(b) where related to a contract. Retention period: until your enquiry has been fully handled; any retention beyond that only where legally required.

Alternatively, you can book a call directly via our booking system booking.kaatai.de. The data you enter there (name, email, preferred time) is processed solely to manage and conduct the appointment (Art. 6(1)(b) GDPR).

4. Third-party providers

4.1 Maps, satellite image, aerial images and place search from our own server

The base map, fonts, satellite image, aerial images and the place and postal-code search are delivered by our own server (netcup, see section 2). When you open a map or search, your browser does not transmit any data to third parties. For the satellite image (EOX IT Services GmbH, Sentinel-2 cloudless 2016) and the aerial images (surveying administrations of the Länder) our server fetches the required tiles itself and caches them; no data about you is transmitted in the process.

The same applies to the Boxmethode: base map, fonts and satellite image come from our own server. References to Wikidata and Wikipedia are plain links.

4.2 Our social media profiles

We run channels on YouTube, TikTok, Instagram and Facebook and link to them in the footer of this website. These are plain links. As long as you do not click them, no data is transmitted to the platforms — no content is embedded, and no tracking pixels or provider buttons are included.

If you visit one of our channels, the respective platform processes your data under its own responsibility: among other things your IP address, device and browser data, usage behaviour and, if you are logged in there, the link to your account. We have no influence on the nature or extent of this processing. The providers also process data in the USA; such transfers are based on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework or on standard contractual clauses.

For our Facebook and Instagram pages, Meta provides us with anonymised statistics ("Insights": reach, interactions, rough age and regional distribution). We cannot identify individuals from them. For these statistics we are joint controllers with Meta (Art. 26 GDPR); the allocation of duties is set out in the Page Insights Addendum. Primary responsibility under data protection law lies with Meta.

The legal basis for our presence and for communication there is our legitimate interest in public representation and in exchange with prospective users (Art. 6(1)(f) GDPR). If you message us via one of the platforms, we process your message in order to handle your enquiry.

You can exercise your rights most effectively directly with the platform — that is where the data is held and where access to it exists. You are welcome to contact us as well at any time: beratung@kaatai.de. If you wish to avoid processing by the platforms, simply use the Atlas and the Boxmethode directly on these websites — all features are available without a social media account.

• YouTube — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland · policies.google.com/privacy
• TikTok — TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland · tiktok.com/legal/page/eea/privacy-policy/de
• Instagram and Facebook — Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland · facebook.com/privacy/policy · help.instagram.com/519522125107875

5. Cookies and browser storage

• atlas_session (HttpOnly cookie, 30 days): set only if you sign in with a magic link. Content: random session token. Purpose: to recognise you on later visits. The cookie applies to all addresses under kaatai.de so that one sign-in works for the Atlas and the Boxmethode at the same time; it is evaluated only by the sign-in service of the Atlas and the Boxmethode. Can be removed via the logout button; logging out on either site logs you out of both.
• localStorage (browser storage, not stored on the server): pin visibility settings (which map markers you have hidden), cell-bookmark cache, selected scale mode, anonymous tracking session ID (atlas_anon_id, up to 1 year; see 3.2); on the Boxmethode: expanded and collapsed panels, sections and groups, the light or dark colour scheme, whether you have seen the tour, and your own settings for which entries of a project always appear, appear only within the period, or never appear; when you are signed in, on the Atlas and the Boxmethode, the list of entries saved in your account (atlas1kmCachedItems) so that the workspace can show them without a new request. Removed when the browser cache is cleared.
• sessionStorage (browser storage, not stored on the server): on the Boxmethode, whether you have seen the intro in this session. Removed when the browser tab is closed.

No third-party cookies, no advertising cookies, no tracking cookies.

6. Your rights (Art. 15-22 GDPR)

You have the right at any time to:

• access to the data stored about you (Art. 15)
• rectification of inaccurate data or completion of incomplete data (Art. 16)
• erasure of your data (Art. 17, "right to be forgotten")
• restriction of processing (Art. 18)
• data portability in a structured, commonly used, machine-readable format (Art. 20)
• objection to processing (Art. 21)

Please send requests informally to beratung@kaatai.de. We usually respond within 7 days.

7. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. Responsible for Lower Saxony:
Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover · lfd.niedersachsen.de

8. Data protection officer

Due to the size and nature of the processing, the appointment of a data protection officer pursuant to §38 BDSG is not required. The controller can be contacted directly (see above).

9. Changes to this privacy policy

We update this policy when the processing changes (e.g. new third-party providers, new features involving data processing). The version and last change are at the end of this page.