Privacy policy

1. Controller

Email: Show email address

2. Hosting, email and server logs

MyCampView, the sending of emails and the self-hosted Matomo installation run on infrastructure provided by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. netcup processes the data as a processor as part of the technical provision of these services.

When the website is accessed, technically necessary server log data may be processed. This includes, in particular, the IP address, date and time, page or file accessed, request, HTTP status code, referrer, user agent and browser information. Processing serves to provide the service securely, reliably and without errors and to prevent misuse. The legal basis is Article 6(1)(f) GDPR.

According to netcup’s documentation, website access logs are retained by the web hosting service used for no more than 14 days.

3. Registration and user account

For a MyCampView account, we process in particular the username, email address, securely stored password, profile information, profile picture, account settings, contributions and their association with the user account. Signed-in users can also save destinations, pitches and accommodation as favourites; these are associated with the user account. Processing is necessary to provide and manage the account and its related features. The legal basis is Article 6(1)(b) GDPR; security and misuse-prevention measures are additionally based on Article 6(1)(f) GDPR.

If you voluntarily upload a profile picture, it is associated with your user account and used to display your profile.

4. Guest contributions and email verification

Contributions can also be made without a permanent user account. For this purpose, we process the email address provided, submission and confirmation status, and the required verification information. By default, the confirmation link is valid for 24 hours.

The email address is used to confirm the guest contribution, provide status information relating to the contribution and allow contributions to be securely transferred to a user account later. It is not displayed publicly.

5. Community contributions, stays and suggestions

Users can contribute experiences relating to destinations, areas and specific pitches and accommodation. This may include processing the destination, area, pitch or accommodation, the month or period of the stay, ratings, experiences, features, notes, free text and photos. Contributions may be moderated before or after publication.

MyCampView includes campsites, holiday parks, motorhome sites, specific pitches, mobile homes, chalets, holiday homes and other specific accommodation.

For suggestions of missing destinations, we process the location, contact and additional information entered and, for signed-in users, its association with the user account. The data is used to review and potentially add the destination. Where acceptance of the terms of use is required for a contribution, we also retain the time and version of that acceptance as evidence. The legal basis for contributions and suggestions is Article 6(1)(b) GDPR; moderation, quality assurance and misuse prevention are additionally based on Article 6(1)(f) GDPR.

6. Photo uploads and image processing

When a photo is uploaded, we process the image file and technically necessary image information such as the file name, file type, file size and dimensions. Where present in the image metadata, the date and time the photo was taken, GPS coordinates and image orientation may also be read. The photos are technically processed and stored and may be displayed publicly after moderation.

Recognisable faces, vehicle registration plates or other sensitive areas of an image may be manually obscured before publication. Publicly available community photos also receive a MyCampView watermark that contains no personal data about the uploader.

7. Cloudflare R2 and Turnstile

Cloudflare R2

Community photos are stored and provided using Cloudflare R2. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. The R2 jurisdiction in the Cloudflare account used is set to the European Union (EU).

Cloudflare Turnstile

Cloudflare Turnstile protects registration, final submission of guest contributions and the public contact form against spam, bots and misuse. During the security check, the IP address, browser and device information, time and interaction data in particular may be transmitted to Cloudflare.

The legal basis for this security processing is Article 6(1)(f) GDPR. Our legitimate interest is to protect the platform, its users and the email and upload infrastructure against automated misuse.

Transfers to third countries

Cloudflare is a US provider and operates a global infrastructure. Despite the EU jurisdiction selected for R2, processing or access outside the European Economic Area cannot be completely ruled out. According to Cloudflare, transfers to the USA are based on certification under the EU-US Data Privacy Framework; standard contractual clauses and additional safeguards are also used, or are used for other transfers. Further information is provided in Cloudflare’s privacy policy.

8. Location search and external map links

The “Search near me” feature uses your location only after you have granted permission in the browser and transmits it to MyCampView for the radius search. Granting permission is voluntary and can be withdrawn in the browser settings. The legal basis is Article 6(1)(a) GDPR.

Links to OpenStreetMap or Google Maps are accessed only when you actively click them. From that point onwards, the respective provider processes the request under its own responsibility.

9. Reports and moderation

Problematic photos, stays and other publicly visible content can be reported. In particular, we process the affected content, reason for the report, explanation, contact details or user association, processing status, decision and reasons. Guest reports are verified using a time-limited confirmation link.

The data is used to review, document and process the report and, where appropriate, to inform the parties involved. It is not displayed publicly. The legal basis is Article 6(1)(f) GDPR and, where necessary, Article 6(1)(c) GDPR.

10. Contact form and email

In the public contact form, we process your name, email address and message. We use this information to deal with the enquiry and for any necessary follow-up questions. Messages are sent using the email infrastructure operated by netcup.

The legal basis is Article 6(1)(b) GDPR for enquiries relating to a contract and otherwise Article 6(1)(f) GDPR. The information is retained only for as long as necessary to deal with the enquiry and to comply with statutory evidence or retention obligations.

11. Technically necessary cookies

When you sign in and use your account, WordPress uses technically necessary authentication, security and settings cookies. In particular, they keep you signed in and ensure that protected features are associated with the correct user.

For signed-out visitors using the contribution feature, the contribution wizard sets the campview_draft_session cookie. It associates a started contribution with the current browser and expires after 24 hours.

Matomo is configured separately without tracking cookies. The legal basis for technically necessary cookies is section 25(2)(2) TDDDG in conjunction with Article 6(1)(b) or (f) GDPR.

12. Self-hosted web analytics with Matomo

MyCampView uses a self-hosted Matomo installation on the netcup infrastructure referred to above. Analytics data is not transmitted to Google Analytics or to an external Matomo Cloud account.

Tracking without Matomo cookies is enforced. IP addresses are anonymised by masking two bytes; visits are also processed using the anonymised IP address. Query parameters are removed from external referrer URLs. CampView does not transmit a Matomo user ID.

In particular, the statistical analysis covers page views, time, a data-minimised referrer, campaign parameters, device type, browser, operating system, interactions and link clicks. This is used to understand how MyCampView is used, identify technical problems, improve features and measure reach. The legal basis is Article 6(1)(f) GDPR.

Detailed raw data is deleted after 180 days. Aggregated statistics may be retained for longer in order to analyse long-term trends.

13. Account deletion and anonymisation

A user account can be permanently deleted in the account area. Personal account data and favourites are removed. The user can also decide whether stays and photos should be deleted.

Published community content that is not deleted may be retained in anonymised form. After anonymisation, there is no longer any public connection with the deleted account.

14. Retention periods

• Web server access logs at netcup: no more than 14 days.
• Detailed Matomo raw data: 180 days; aggregated statistics may be retained for longer.
• User account and personal account data: generally until the account is deleted.
• Favourites: until manually removed or the account is deleted.
• Regular contribution drafts: typically 24 hours; completion and status information for up to seven days.
• Guest verification links: valid for 24 hours by default; status and contribution data is retained beyond this period in accordance with the purposes of the contribution and evidence.
• Community contributions: until deletion; anonymised published content may be retained beyond this point.

Where no fixed period is specified, we retain data only for as long as necessary for the respective purpose, or for as long as statutory retention obligations and necessary legal evidence exist.

15. Recipients and processors

• netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany: hosting, server operation, email infrastructure and hosting of the self-hosted Matomo instance.
• Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA: R2 image storage and Turnstile security checks.

Within MyCampView, access is limited to people who require it for administration, moderation or technical support. Other recipients are added only where required by law or necessary for the establishment, exercise or defence of legal claims.

16. Encrypted transmission

MyCampView uses HTTPS/TLS to protect data from unauthorised interception and alteration during transmission between the browser and the website.

17. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before consent was withdrawn.

You can use the contact details above to exercise your rights.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. For the controller in North Rhine-Westphalia, the relevant authority in particular is:

www.ldi.nrw.de

19. Changes to this privacy policy

We update this privacy policy when features, service providers, configurations or legal requirements change. The version published on this page at the relevant time applies.