Privacy policy
This policy describes what data the Brötchenapp and this website process, what for, and for how long. Neither uses ads, tracking or cookies.
1. Controller
Simon GalleFritz-Haber-Str. 1E
06217 Merseburg
Germany
Email: info@siga.solutions
2. This website
The website sets no cookies, stores nothing on your device and loads nothing from other servers, fonts included. The pages for invite links and for getting the app choose their language from your browser’s language setting; that happens in your browser only.
To deliver a page, the server necessarily processes your device’s IP address. It does not store it: the web server keeps no access log, and its error messages contain neither IP addresses nor the pages requested.
Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in providing the website.
3. The app and your account
For your account, the server stores three kinds of data:
- your account data: email address, username and password, the password only as a hash,
- what you enter and create in the app, for example your groups and your choice of rolls,
- your sign-ins, without the IP address and without anything about your device.
The other members of a group see your username and what you enter for that group, not your email address. Some things stay on your phone only, for example who is in on which day. You can ask for a complete list of the data stored about you at any time (section 9).
The data is kept for as long as your account exists. A sign-in ends when it has not been used for 60 days, and after 365 days at the latest; the server deletes ended sign-ins every night. It deletes invites in the night after they expire.
Legal basis: Art. 6(1)(b) GDPR, because the app cannot be used without this data.
4. What the server logs
The operations log records what happens while the server runs, errors included. Failed sign-ins and refused requests appear in it with the IP address, a failed sign-in also with a shortened email address such as “s***@example.org”. The same messages also go to the log files of pm2, the program that runs the app on the server. Both are deleted after 31 days at the latest.
The change log records who registered, signed in or out, changed a group or deleted their account, with the user ID instead of the email address and without the IP address. A new file starts every month, and each month’s file is deleted after twelve more months.
After ten failed sign-ins or password confirmations within ten minutes, the server blocks the IP address for an hour.
Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in protecting accounts and the server from attacks.
5. Backups
The server backs up the database every night and before every new version of the app. These backups stay on the server and are deleted after 16 days at the most.
In addition, Hetzner (see section 6) backs up the whole server every day and keeps the last seven of these backups. Whatever was deleted on the server can therefore remain in them for up to seven more days.
6. Hosting
The website and the app’s server run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data centre in Nuremberg. Hetzner acts as a processor under Art. 28 GDPR; a data processing agreement is in place.
7. When you write
If you write to info@siga.solutions, your message and your address are processed to answer you, and deleted once your request is dealt with. The mailbox is also hosted by Hetzner Online GmbH, under the same data processing agreement.
Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in answering requests.
8. Deleting your account
How to have your account deleted, and what that deletes, is on the page Delete your account.
9. Your rights
You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on Art. 6(1)(f) (Art. 21). To exercise them, write to info@siga.solutions.
You can also complain to a data protection supervisory authority (Art. 77 GDPR). The one responsible is:
Landesbeauftragte für den Datenschutz Sachsen-AnhaltOtto-von-Guericke-Straße 34a
39104 Magdeburg, Germany
datenschutz.sachsen-anhalt.de