Template prepared for a German operator. Replace items in [square brackets] and have the text reviewed by a data-protection lawyer before going live.
1. Who is responsible
The controller within the meaning of the General Data Protection Regulation (GDPR) is [Company name], [address], Heidelberg, Germany, e-mail: privacy@singleparentsclub.de (see Imprint).
[If appointed: Data protection officer: name, contact.]
2. Overview
We process personal data only as far as necessary to provide a secure website and our membership services. We do not sell personal data. We do not use advertising trackers. Optional statistics or marketing tools are only ever activated with your consent.
3. Visiting the website
When you open our website, our hosting provider automatically processes technical data such as IP address, date and time, page requested, browser and operating system (server log files). This is necessary to deliver the website securely and to defend against attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, stable website). Log files are deleted after 30 days at the latest.
Hosting: Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. We have concluded a data processing agreement. Transfers to the USA are based on the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses.
4. Member account
To create an account we process your e-mail address, password (stored only as a salted hash), first name, date of birth, language and the time of your consent to our terms. In your profile you may add city, country, number of children, interests, what you are looking for, a short text and a photo. With the Your Time calendar you can store the days you are free; these are visible only to you.
Purpose: providing the membership, matching experiences, safety of the community. Legal basis: Art. 6 (1) (b) GDPR (contract). Your date of birth is used to confirm that you are of age (Art. 6 (1) (b) and (c) GDPR).
If you tell us you are open to a romantic connection, this may allow conclusions about your private life. We process this only because you choose to provide it, on the basis of your explicit consent (Art. 9 (2) (a) GDPR), which you can withdraw at any time by changing your profile.
Data storage and authentication: Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, with servers in Frankfurt am Main, Germany (AWS eu-central-1). We have concluded a data processing agreement including EU Standard Contractual Clauses.
Profile photos are stored in a private storage area that only you can access. Before upload, photos are resized in your browser, which removes embedded location (GPS) data.
Your data is stored for as long as you have an account. When you delete your account, your profile, photos, calendar and saved experiences are deleted immediately; backups are overwritten within 30 days. Statutory retention obligations (e.g. invoices, 10 years) remain unaffected.
5. Identity verification
Before your first trip we verify your identity through a certified verification provider ([provider name and address, e.g. IDnow GmbH, Munich]). The provider processes a photo of your identity document and a selfie video, including biometric data, on our behalf and returns only the result to us. Legal basis: your explicit consent (Art. 9 (2) (a) GDPR) and our legitimate interest in the safety of members (Art. 6 (1) (f) GDPR). The provider deletes the images after [period].
6. Protection against bots (Cloudflare Turnstile)
Sign-up, log-in, password reset and our forms use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, to distinguish people from automated programs. Turnstile processes technical information such as IP address and browser characteristics; it does not set advertising cookies. Legal basis: Art. 6 (1) (f) GDPR (protection against abuse, spam and account takeover); the access to your device is strictly necessary for this service (§ 25 (2) no. 2 TDDDG). Transfers to the USA are based on the EU-US Data Privacy Framework.
7. Leaked-password check
When you choose a password, your browser checks whether it appears in known data leaks using the "Pwned Passwords" service (Have I Been Pwned). Only the first five characters of a cryptographic hash of the password are transmitted; the password itself never leaves your device and cannot be reconstructed. Legal basis: Art. 6 (1) (f) GDPR (account security).
8. Contact and partner forms
If you contact us or apply as a partner, we process the details you enter to answer your request. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR. To prevent abuse we store a one-way hashed (non-reversible) version of your IP address for up to 48 hours. Messages are deleted when they are no longer needed, at the latest after 2 years, unless legal retention obligations apply.
9. E-mails
We send e-mails that are necessary for your account (confirmation, password reset, security notices). News about trips and cities is sent only if you have opted in; you can unsubscribe at any time in your account or via the link in every e-mail. Legal basis: Art. 6 (1) (b) and (a) GDPR.
10. Cookies and local storage
We only use storage in your browser that is strictly necessary (log-in session, security check, language, your consent choice). Details: Cookie policy.
11. Fonts, images and videos
Fonts are hosted on our own server; no connection to Google is made. Some photos and films are loaded from Unsplash (Unsplash Inc., USA) and Mixkit (Envato Pty Ltd, Australia), which receive your IP address when the media is loaded. Legal basis: Art. 6 (1) (f) GDPR (attractive presentation). [Optional: host all media yourself, see SETUP.md, and delete this paragraph.]
12. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. Many of these rights you can exercise directly in your account (edit profile, download data, delete account). Otherwise write to privacy@singleparentsclub.de.
You also have the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart.
13. Security
We use technical and organisational measures appropriate to the risk, including TLS encryption, strict access rules at database level, two-factor authentication, rate limiting and regular updates.
14. Minors
Our services are only for adults aged 18 or over. We ask members not to share names, photos or other details of their children.
15. Changes
We will update this policy when our services or the law change. The current version is always available on this page.