easygeodata

Privacy policy

Courtesy translation. The German version is the legally binding one.

Controller

Moritz Lucas
Seehauser Straße 24, 28879 Grasberg, Germany
E-mail: info@easygeodata.de

Basics

This portal is an information and download service. Without signing in, it sets no cookies; only users who sign in with an account receive a technically necessary session cookie (see User account). No third-party analytics or advertising services are embedded; personal data is neither passed on to third parties nor processed for advertising purposes. All scripts (Leaflet) are served by this server itself; no external CDNs are used.

Server log files and usage statistics

When you access the site, the web server (nginx, operated on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany) automatically processes technically necessary data: IP address, date and time of access, requested resource, amount of data transferred, referrer and user agent. These log data are additionally evaluated statistically on the server (self-hosted software, no third parties, no cookies) in order to understand how the service is used — e.g. access figures and requested downloads — and to improve it. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure, stable and needs-based operation). The log files are deleted automatically on a regular schedule (logrotate, 14 days) and are not merged with other data sources; statistical evaluations without direct personal reference may be retained beyond that.

Download quota without an account

So that individual requests do not overload the server for everyone else, downloads without signing in are subject to a monthly quota per IP address. For this purpose the server counts the downloaded data volume per IP address and calendar month: a database table stores exclusively the IP address, the month and the sum of the download sizes in bytes — no file names, times or any other information. Only the current month is evaluated. Whether a download was started from this website is recognised by the server from the information the browser sends with every request (Fetch metadata or referrer); this information is not stored separately for this purpose. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a fair distribution of server capacity and in protection against abusive bulk retrieval).

User account

For larger downloads and access via the application programming interface (API) you can use a free user account. There is no password: you enter your e-mail address and receive an e-mail with a sign-in link and a code. The account is created with your first sign-in. The following is stored:

Downloads: For our operating statistics we record, for every download via the application programming interface, when it took place, what kind of data it was (e.g. state package, district or tile), which file or area and how large. We likewise record requested tile and link lists (area and product) as well as downloads that were refused, with the reason (e.g. too large or quota used up). Without signing in this happens without any personal reference, i.e. without the IP address. With an account we also store the account number in order to evaluate usage and quotas and to detect abuse (Art. 6 (1) (f) GDPR); we delete this link after 90 days, after which only the anonymous statistics remain.

Requests for more quota: If you request more quota on the account page, we store your name, your institution and the desired quota if given, your reasons and the time with your account. The request is also sent to us by e-mail (via the e-mail service named below) so that we can process it and reply to you. The data is deleted together with the account.

Sign-in e-mails: For every sign-in link requested we store the e-mail address, link and code only as a hash, the time, the page you return to after signing in, and the IP address of the request. Link and code are valid for 15 minutes and can be used once; the entries are deleted after two days at the latest. The IP address serves solely to slow down the mass sending of sign-in e-mails to other people's addresses. On your first sign-in, the IP address is additionally stored together with the time to limit the mass creation of accounts — separately from the account and for no longer than two days.

We send the e-mails via the Transactional Email service of Scaleway SAS (Paris, France; processing within the EU), with whom a data processing agreement under Art. 28 GDPR is in place. For this, the provider receives your e-mail address and the content of the e-mail.

The purpose is to provide larger downloads and API access and to protect against abuse. The legal basis is Art. 6 (1) (b) GDPR (user relationship) and, for the abuse protection, Art. 6 (1) (f) GDPR (legitimate interest in protection against abuse). The e-mail address is used only for signing in and for messages about your account; there is no newsletter, and the address is not passed on.

The account data is stored until you delete the account. You can do this yourself at any time on the account page (or arrange it by e-mail to the address given above); the download counter and API keys are deleted along with it.

Cookies: When you sign in, the server sets two cookies. egd_sitzung contains only the internal number of your account, an expiry date and a signature and cannot be read by scripts in the browser (HttpOnly). egd_konto contains only the value "1" and tells the page to show your address at the top right. Both are transmitted only over encrypted connections, expire after 30 days and are deleted when you sign out. Without signing in, they are not set. They are technically necessary to keep you signed in (Section 25 (2) no. 2 TDDDG, the German Telecommunications Digital Services Data Protection Act); no consent is required for them.

Suggestions (feedback chat)

Using the "Feedback" button at the bottom right you can send us suggestions. We store your text, the page you write from, the language of the page, the size of your browser window (helps us reproduce display problems), the time and an identifier of your browser session so that follow-up messages stay together. We store your e-mail address only if you give it voluntarily for follow-up questions; if you are signed in, the number of your account is stored instead so that we can reply to you. No IP address is stored; to slow down mass submissions the server counts suggestions per network only briefly in memory. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in improving the site) and, for a voluntarily given address, your consent (Art. 6 (1) (a) GDPR). Entries are deleted at the latest one year after receipt, or earlier on request (e-mail to the address given above).

Downloads (object storage)

Ready-made files (state packages, tiles of the elevation models) are stored in the S3 object storage of Hetzner Online GmbH. After checking the access tier and quota, the server redirects to a time-limited, signed download link through which the file comes directly from the object storage (alkis.nbg1.your-objectstorage.com). In doing so Hetzner processes the IP address of the requester as technically necessary connection information (Art. 6 (1) (f) GDPR). Hetzner operates its data centres in Germany.

Official base map of Germany (basemap.de / BKG)

As the base map, map tiles from basemap.de are loaded, a service of the German Federal Agency for Cartography and Geodesy (BKG), Richard-Strauss-Allee 11, 60598 Frankfurt am Main (sgx.geodatenzentrum.de). When the tiles are loaded, the BKG necessarily receives the IP address of your device and the tile coordinates of the displayed area. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in displaying an official base map). Further information: privacy notice of the BKG.

World map (Eurostat GISCO)

basemap.de covers Germany only. For the surrounding countries, OpenStreetMap map tiles (English-labelled on this English version of the map) are loaded via the GISCO tile service of the European Commission (Eurostat, gisco-services.ec.europa.eu). When the tiles are loaded, the service necessarily receives the IP address of your device and the tile coordinates of the displayed area (processing within the EU). The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a seamless base map). Further information: privacy policy of the European Commission.

Official base maps of neighbouring countries

If the centre of the map lies in France, Austria, the Netherlands, Switzerland or Luxembourg, the official base map of that country is loaded directly from the tile service of the responsible agency: IGN (data.geopf.fr), basemap.at (mapsneu.wien.gv.at), Kadaster/PDOK (service.pdok.nl), swisstopo (wmts.geo.admin.ch) or ACT Luxembourg (wmts1.geoportail.lu). When the tiles are loaded, the service necessarily receives the IP address of your device and the tile coordinates of the displayed area. Processing takes place within the EU or in Switzerland, for which an adequacy decision of the European Commission exists. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in an official, seamless base map). To start the map in your own country, the map only reads your browser's time zone locally; it is not transmitted.

Satellite base map (Esri, optional)

If you select the base map "Satellite imagery" in the panel instead of basemap.de, map tiles are loaded from Esri Inc., 380 New York Street, Redlands, CA 92373, USA (server.arcgisonline.com). Esri then necessarily receives the IP address of your device and the tile coordinates of the displayed area; this involves a transfer of data to a third country (USA). The legal basis is Art. 6 (1) (a) GDPR (consent by actively selecting this base map) — without this selection no connection to Esri servers is established. Further information: privacy notice of Esri.

Scientific products (DLR, optional)

If you switch on the layer "Scientific product" in the panel, the map loads map tiles and, when you click on the map, the value at that location directly from the EOC Geoservice of the German Aerospace Center (DLR), Linder Höhe, 51147 Köln, Germany (geoservice.dlr.de). DLR then necessarily receives the IP address of your device and the coordinates of the displayed area or of the clicked point. Processing takes place in Germany. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in displaying the selected thematic layer) — without switching on the layer no connection to DLR servers is established. Further information: privacy notice of DLR.

Your rights

You have the right vis-à-vis the controller to information about the personal data processed (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Lower Saxony.

← Back to the map