Privacy policy

Welcome to heatdive. This policy applies to the website heatdive.com and to the heatdive app, insofar as it uses the same account and the same interface.

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the member states and other data protection provisions is:

Elsen Media GmbH
Sülldorfer Landstraße 228
22589 Hamburg
Germany

Registered office: Hamburg
Register court: Amtsgericht Hamburg (Hamburg Local Court)
Managing director: Mario Elsen
Email: mail@heatdive.com
Phone: +49 40 74397325

1. Scope of processing personal data

We collect and use personal data only insofar as this is necessary to provide a functioning website and app, a legal provision permits it or you have given your consent. heatdive uses no advertising tools. We measure reach only with your consent, with Matomo on our own server (see 4.12).

2. Legal bases

• Art. 6 (1) (a) GDPR, where we ask for your consent.
• Art. 6 (1) (b) GDPR, where processing is necessary to perform a contract with you, for example for your user account.
• Art. 6 (1) (c) GDPR, where we are subject to a legal obligation.
• Art. 6 (1) (f) GDPR to protect our legitimate interests, for example in the secure and reliable operation of the website and app.
• Art. 9 (2) (a) GDPR for health data, exclusively with your explicit consent (see 4.4).

3. Deletion and storage period

Personal data is deleted as soon as the purpose of storage no longer applies. Data may be stored beyond that if European or national legislators have provided for this in provisions to which we are subject. Data is also deleted when a storage period prescribed there expires, unless further storage is necessary to conclude or perform a contract. The specific periods are stated for each processing activity.

4. Collection and use of data

4.1 Hosting and log files

The website and the interface of the app run on servers of our hosting provider ALL-INKL.COM - Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. It processes the data on our behalf and on our instructions under a data processing agreement (Art. 28 GDPR).

When you access heatdive, our web server temporarily records the following data in so-called server log files for system security:

• the IP address of the requesting device
• date and time of access
• the URL or resource requested and the HTTP status code
• the page from which you visit us
• the amount of data transferred
• browser type, browser version and operating system

This data is stored to ensure that the website and app work and remain secure, and to prevent abuse. It is not evaluated for marketing purposes. The legal basis is Art. 6 (1) (f) GDPR. The data is deleted, or anonymised by shortening the IP address, after seven days at the latest. Collection is strictly necessary for operation; there is therefore no option to object.

4.2 Contact by email

You can reach us at the email address provided. The personal data transmitted with the email is then stored. The legal basis is Art. 6 (1) (f) GDPR; if the contact aims at concluding a contract, Art. 6 (1) (b) GDPR applies in addition. The data is deleted once the conversation has ended, that is, once the matter has been conclusively resolved, unless statutory retention obligations apply.

You can object to this storage at any time, for example by email to mail@heatdive.com. The conversation can then not be continued.

4.3 User account on the website and in the app

You can create a user account. For this we process:

• name, username and email address
• your password, exclusively as an irreversible hash
• date and time of registration, of the confirmation of your email address and of your consents
• optionally a profile picture and details you add to your profile yourself

To confirm your email address, reset your password or change your email address or password, we send you a six-digit code. It is stored only as a hash, is valid for a limited time and is deleted automatically after it expires. The app signs in with time-limited access tokens; every password change invalidates all tokens issued before.

A new email address takes effect only after you confirm it with the code we send to it; we also inform your previous address. Your profile page is private unless you make it public in the settings. Your email address is not shown there.

You can download the data stored in your account as a file at any time under Settings, Export (Art. 20 GDPR).

The legal basis is Art. 6 (1) (b) GDPR. The data is stored for as long as your account exists. You can delete your account at any time, on the website under Settings or in the app; the account and all data linked to it are then removed immediately and permanently, without being kept in a recycle bin. An email to mail@heatdive.com is also sufficient.

4.4 Health data

Some app features work with information that counts as health data under Art. 9 GDPR, for example your resting heart rate. We collect and store such information only after you have given your explicit consent (Art. 9 (2) (a) GDPR). For each consent we store its type, version, time and whether it was given in the app or on the web, so that we can demonstrate it.

You can withdraw your consent at any time with effect for the future. When you withdraw it, we delete the health data concerned immediately. The lawfulness of processing carried out before the withdrawal remains unaffected. We do not pass health data on to third parties and do not use it for advertising.

4.5 Reports about places

You can report a missing place or suggest a change to a place. For this we process:

• your details about the place and your comment
• your name, your email address and the language of the page
• the time at which you acknowledged this privacy policy, and its version
• an irreversible check value of your IP address (hash) to limit abuse and repeated reports; we do not store the IP address itself for this
• for signed-in users, the link to the account

We use your name and email address only for questions about this report and, if we decide to do so in the individual case, to tell you the result of the review. We are notified internally by email about every report. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in current and correct information about places.

90 days after we have decided on the report, we delete the name, email address, IP check value and link to the account. The report itself is kept without personal reference as a record of where the place information came from. While a report is open, the details remain stored for questions. If you delete your account, we remove the personal reference from your reports immediately.

4.6 Map (Mapbox)

For the map we use the Mapbox service of Mapbox, Inc., 740 15th Street NW, 5th Floor, Washington, DC 20005, USA. When the map is displayed, your browser loads map tiles, fonts and styles from Mapbox servers. In the process, your IP address, the visible map section, technical information about your browser and device, and map usage events are transmitted to Mapbox. Parts of the map data come from OpenStreetMap.

The map loads only after you click “Load map”. Until then, no connection to Mapbox is made. Your choice is stored for one year in the cookie heatdive_map. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time with effect for the future:

Stop loading the map

A transfer to the USA cannot be ruled out. It is based on the EU-US Data Privacy Framework insofar as the provider is certified under it, and otherwise on the standard contractual clauses of the European Commission. More information: mapbox.com/legal/privacy.

4.7 Place search and location

When you search the map for a city, postcode or address, your browser sends the search term to our server. Our server forwards only the search term, not your IP address, to the Nominatim service of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, to convert it into coordinates. An adequacy decision of the European Commission exists for the United Kingdom. We use the same service to convert the addresses of reported places into coordinates.

The “Use my location” feature requests your location only after you allow it in your browser. The location is used only in your browser to centre the map and is neither transmitted to our server nor stored. You can revoke the permission at any time in your browser settings.

4.8 Cookies and local storage

heatdive uses technically necessary cookies and, only with your consent, one cookie for the map and the cookies for reach measurement:

• heatdive_cookie_consent: stores your choice in the cookie notice, for one year.
• heatdive_map: stores that you want the map to load (see 4.6), for one year. Once the map loads, Mapbox stores technical settings in the local storage of your browser.
• heatdive_session: keeps your session, for example your sign-in and the selected language.
• _pk_id, _pk_ses, _pk_ref: Matomo, only with consent to the group Statistics (see 4.12); 13 months, 30 minutes and 6 months.
• XSRF-TOKEN: protects forms against requests from other sites.
• remember_web_…: only if you choose “Remember me” when signing in; valid until you sign out.

In the signed-in area, your browser also stores locally whether you have chosen the light or dark display. This information does not leave your device. For the necessary cookies, the legal basis is § 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR; for the map cookie and the cookies for reach measurement, your consent. You can change your choice at any time via “Cookie settings” at the bottom of every page. You can delete or block cookies in your browser at any time; some features, such as signing in, are then not available.

4.9 Sending emails

We send emails such as confirmation codes, password notices and messages about reports through the mail servers of our hosting provider ALL-INKL.COM - Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, which acts on our behalf and on our instructions (Art. 28 GDPR). The recipient address, content and time of sending are processed.

4.10 Fonts

The fonts used on heatdive are loaded from our own server. No connection to third-party servers, such as Google's, is made for this.

4.11 The heatdive app

The app stores your sessions and settings on your device. Without an account, they never leave it. With an account, the app synchronises them with your account over an encrypted connection; for this, the processing described in 4.3 and 4.4 applies. Places and evidence articles are loaded from our server without personal data. If the app offers to read data from Apple Health, it does so only after you allow it in iOS and give your consent under 4.4; you can withdraw the permission at any time in the iOS settings. The app contains no advertising or analytics tools from third parties.

4.12 Reach measurement (Matomo)

If you consent to the group “Statistics” in the cookie notice, we use the open-source software Matomo to measure which pages are read. Matomo runs on a server of Elsen Media GmbH itself (stats.elsenmedia.com); the data is not passed on to third parties and is not combined with other data. Processed are your IP address, date and time, the page you visit and the page you came from, as well as browser, operating system, screen resolution and language. For this, Matomo sets the cookies _pk_id (13 months), _pk_ses (30 minutes) and _pk_ref (6 months).

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Without consent, Matomo does not load. You can withdraw it at any time with effect for the future via “Cookie settings” at the bottom of every page.

5. Recipients

We pass on personal data only as described in this policy, where there is a legal obligation or where you have given your consent. Our hosting and email provider ALL-INKL.COM - Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany is contractually bound to confidentiality and to compliance with the GDPR. We do not sell data.

6. Rights of the data subject

If we process your personal data, you are a data subject within the meaning of the GDPR and have the following rights against us:

• under Art. 15 GDPR, access to your personal data processed by us, in particular the purposes of processing, the categories of data, the recipients, the planned storage period, the source of your data if it was not collected from you, and the existence of automated decision-making including profiling;
• under Art. 16 GDPR, the prompt rectification of inaccurate data or completion of your data stored with us;
• under Art. 17 GDPR, the erasure of your data stored with us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• under Art. 18 GDPR, the restriction of the processing of your data;
• under Art. 20 GDPR, to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller;
• under Art. 7 (3) GDPR, to withdraw a consent at any time. We will then no longer continue the processing based on that consent in the future;
• under Art. 77 GDPR, to lodge a complaint with a supervisory authority. As a rule, you can contact the authority of your usual place of residence, your place of work or our registered office; for us, this is the Hamburg Commissioner for Data Protection and Freedom of Information.

Right to object: Under Art. 21 GDPR, you can object at any time to the processing of your data based on Art. 6 (1) (f) GDPR on grounds relating to your particular situation. If the objection concerns direct marketing, you have a general right to object without giving reasons.

For all of these rights, an email to mail@heatdive.com is sufficient.

7. SSL and TLS encryption

To protect your data in transit between your browser or the app and our server, we use state-of-the-art encryption via HTTPS. We send emails over an encrypted connection.

8. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always meets current legal requirements or to reflect changes to our services, for example when introducing new features on the website or in the app. The new version available at this address then applies to your next visit.

9. Questions about data protection

For any questions about data protection at heatdive, you can reach us at any time at mail@heatdive.com.

If there are discrepancies between the English and the German version of this policy, the German version prevails.