Privacy policy

This is a translation for convenience. In case of doubt, the German version at /de/datenschutz governs.

1. What this policy covers — and what it does not

It covers this site, rebounz.de, where I introduce Rebounz and where you can write to me.

It does not cover the businesses' own pages. Anyone starting a loyalty card at a café or a gym does so under that business's own address (name.rebounz.de). The business is the controller for that data; I only process it on their instructions (section 7). Their privacy policy is published at their address.

2. Controller

Timm Ditz
Kryspi – IT & Fitness
Buchenweg 9
72379 Hechingen
Germany

Phone: +49 151 29629443
Email: hello@rebounz.de

3. Hosting

This site and the services behind it run on servers operated by

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen

in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. No transfer to a third country takes place.

Legal basis: Art. 6(1)(f) GDPR — my legitimate interest in providing the service securely and reliably.

4. Server log files

On each request the server records technical details sent by your browser: IP address, time, requested address, response status, amount of data transferred, referrer and browser identification. They serve operation and troubleshooting, in particular defence against abusive access.

Legal basis: Art. 6(1)(f) GDPR. The log files are limited in size and roll over: older entries are continuously overwritten. There is no archive, no analysis and no merging with other data.

To limit the number of requests per unit of time, the IP address is cached briefly. Without that limit the contact form would be open to any automated submission.

5. The contact form

Whoever writes to me through the form enters four things: name, business, email address and message. I store them so that I can reply, and for nothing else. They are not passed on to third parties; the message is emailed to my own mailbox.

Legal basis: Art. 6(1)(b) GDPR where the enquiry aims at a contract, otherwise Art. 6(1)(f) GDPR.

I delete the enquiry once it is settled and no retention obligation stands in the way, at the latest one year after the last exchange. Anyone who wants it gone earlier only has to write me a line.

You may also write to me directly instead. The same applies to that message.

6. Cookies and local storage

This site sets no cookies and stores nothing in your browser. There is therefore nothing to consent to, and no banner.

If someone later signs in with a business, that sign-in needs a technically necessary cookie. It is required under § 25(2) no. 2 TDDDG and is set under the business's address, not here.

7. My role regarding guest data

A business decides which loyalty cards exist and who receives them. It is therefore the controller within the meaning of the GDPR. I provide the technology and process that data solely on its instructions — as a processor pursuant to Art. 28 GDPR.

The corresponding agreement is Annex 1 to my terms and conditions. It also names the sub-processors.

8. Legal bases at a glance

Art. 6(1)(a) GDPR — consent
Art. 6(1)(b) GDPR — contract or pre-contractual measure
Art. 6(1)(c) GDPR — legal obligation
Art. 6(1)(f) GDPR — legitimate interest
§ 25(2) no. 2 TDDDG — technically necessary storage

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw consent at any time with effect for the future.

A line to hello@rebounz.de is enough. It costs nothing, and I do not need a reason.

Independently of that, you have the right to lodge a complaint with a supervisory authority. The authority responsible for me is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

10. Encryption

All pages are served exclusively over HTTPS. There is no unencrypted connection.

11. No automated decisions, no advertising

There is no automated decision-making, including profiling. I run no analytics on this site, no advertising, and embed no third-party services — no fonts from other servers, no maps, no videos.