01 In short
We collect what we need in order to answer you, to take an order, to keep a page you bought online and, when you ask us to, to tell you that your city has opened. Nothing more.
We run no advertising trackers, we set no analytics cookies, we build no profiles, and we sell nothing to anybody. The web fonts these pages use are served from our own server, so opening a page discloses your address to no third party and there is nothing here for a consent banner to ask about.
02 The controller
The controller for the processing described here, within the meaning of Article 4(7) GDPR, is:
Olumax
- contact@olumax.com
03 Data protection officer
We are not required to appoint a data protection officer under Article 37 GDPR or section 38 of the German Federal Data Protection Act, and we have not appointed one voluntarily. Please address any question about data protection to the controller above; it will be dealt with there.
04 What we process, why, and on what basis
Each of the following describes one purpose, the data it needs, the legal basis under Article 6(1) GDPR, and how long the data is kept.
Visiting these pages
Each request our server answers is written to a log file with the requesting IP address, the date and time, the page requested, the amount of data transferred, the referring page and the browser identification.
This is what lets us deliver the pages at all, find a fault after it happens, and recognise an attack. The legal basis is Article 6(1)(f) GDPR, and our legitimate interest is the secure, stable and traceable operation of this website. The data is never merged with other data and is never used to identify you personally.
- Kept for
- 7 days, then deleted
Cookies and similar technologies
These pages set only what is strictly necessary to provide the service you asked for. Storing and reading it is therefore permitted without your consent under section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, and the processing that follows rests on Article 6(1)(f) GDPR with our legitimate interest in a website that works.
There are no advertising cookies, no analytics cookies, no tracking pixels and no third party content that could set either. That is why you are not asked for consent: there is nothing here that would need it.
- A session cookie, set only once you sign in, which keeps you signed in and is deleted when the session ends.
- A security token that prevents a form on this site from being submitted from another one.
- The language you chose, kept for a year, so the site keeps speaking it on your next visit.
The availability check
Checking whether a keyword is still free sends the city and the keyword to our server, which answers from the register. No personal data is involved, nothing is stored, and no keyword you check is recorded anywhere.
The contact form
We process the name, email address and message you send, together with the company, telephone number, website, city and keyword if you choose to give them. We use it to answer your enquiry and to deal with whatever follows from it.
The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a contract or the steps leading to one, and otherwise Article 6(1)(f) GDPR with our legitimate interest in answering the people who write to us. Giving the data is neither required by law nor by contract, but without a name, an address to reply to and a message we cannot answer you.
- Kept for
- Until your enquiry is settled, and at most 24 months
News by email
If you tick the optional box on the contact form, we use your email address to send you occasional news about new cities and keywords. The legal basis is your consent under Article 6(1)(a) GDPR, and we record the fact and the time of that consent so we can show it was given.
You may withdraw your consent at any time with effect for the future, by writing to the address above or by using the unsubscribe link in any message. Withdrawing it does not affect the lawfulness of anything sent before. Your enquiry is dealt with either way; the box is genuinely optional.
- Kept for
- Until you withdraw your consent
Being told when your city opens
If your city is not yet listed in the availability check, you can leave your email address together with the name of the city and, if you like, a keyword. We use them only to write to you when keywords can be reserved in that city. The legal basis is your consent under Article 6(1)(a) GDPR, and we record the time of that consent so we can show it was given.
You may withdraw your consent at any time with effect for the future by writing to the address above, and we then delete the request. Withdrawing it does not affect the lawfulness of anything sent before. We do not use the address for news or advertising.
- Kept for
- Until you withdraw your consent, and at most 24 months after your request
Your customer account
To open an account we process your name, email address and password, held only as a cryptographic hash that cannot be reversed. To take an order we process your billing details, the pages you bought and the invoices for them.
The legal basis is Article 6(1)(b) GDPR, because this is what performing the contract with you requires. For the billing records the basis is additionally Article 6(1)(c) GDPR, because commercial and tax law require us to keep them.
- Account data
- For as long as the account exists
- Invoices and booking records
- 10 years, under section 147 of the German Fiscal Code
- Commercial correspondence
- 6 years, under section 257 of the German Commercial Code
Payment
Paying by PayPal takes place on PayPal's own pages. Your card and account details are entered there and never reach us. We store the payment reference, the amount, the currency and the state of the payment, which is what lets us match a payment to an order and prove it was made.
PayPal (Europe) S.a r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg decides on its own processing and is a separate controller for it. What it does with your data is described in its own privacy statement.
The legal basis for our part is Article 6(1)(b) GDPR for performing the contract and Article 6(1)(c) GDPR for the accounting records.
The support desk
Opening a conversation means proving your email address with a one time code. We process that address, the code, the device you confirmed it on and the messages you exchange with us.
The legal basis is Article 6(1)(b) GDPR where the conversation concerns your contract, and otherwise Article 6(1)(f) GDPR with our legitimate interest in supporting the people who use the product.
- Kept for
- 3 years from the end of the conversation, matching the ordinary limitation period
Enquiries sent to a published customer page
A page bought here carries an enquiry form, and what a visitor sends through it is delivered to the business that owns the page and kept in that business's account. For that data the customer is the controller and we act as their processor under Article 28 GDPR, on a written agreement.
If you sent such an enquiry and want to know what is held or want it deleted, the business you wrote to decides that. We will pass your request to them, and you can also ask us directly using the contact details above.
05 Who receives your data
We do not sell data, we do not pass it to advertisers or data brokers, and we do not use it to build profiles. It reaches only the following, and only so far as each of them needs it:
- Our hosting provider, which operates the servers these pages and your data run on. It acts only on our instructions under a data processing agreement in accordance with Article 28 GDPR.
- Our email provider, which delivers the messages we send you, on the same terms.
- PayPal, where you choose to pay with it. PayPal decides on that processing itself and is a controller in its own right, not our processor.
- Our tax adviser and the tax authorities, for the records that commercial and tax law require us to keep.
- Courts and public authorities, where we are legally obliged to disclose or where disclosure is necessary to establish or defend legal claims.
06 Transfers outside the European Union
We choose processors that process within the European Union or the European Economic Area, and our own systems do so.
Where a processor nonetheless transfers data to a third country, it happens only on a legal basis under Chapter V GDPR: an adequacy decision of the European Commission, or the standard contractual clauses the Commission has adopted together with the additional measures the transfer requires. PayPal decides on its own transfers and describes them in its privacy statement.
07 Your rights
You have all of the following in respect of the data we hold about you. Exercising any of them costs nothing, and a request sent to the contact details above is enough.
- Access, under Article 15 GDPR: to be told whether we process data about you and, if so, what and why.
- Rectification, under Article 16 GDPR: to have anything inaccurate corrected and anything incomplete completed.
- Erasure, under Article 17 GDPR: to have data deleted, unless a retention period or a legal claim stands in the way.
- Restriction, under Article 18 GDPR: to have processing limited while a dispute about it is resolved.
- Portability, under Article 20 GDPR: to receive the data you gave us in a structured, commonly used, machine readable format, or to have it sent to another controller.
- Objection, under Article 21 GDPR: see the separate notice below.
- Withdrawal of consent, under Article 7(3) GDPR: at any time, with effect for the future.
- Complaint, under Article 77 GDPR: to a supervisory authority, in the member state where you live or work or where you believe the infringement happened.
08 Right to object
09 Do you have to provide data?
Only where a contract or the law requires it. Opening an account and placing an order need the data named above, and without it we cannot conclude or perform a contract with you. Everything else, including the optional fields on the contact form and the news by email, is voluntary, and leaving it out has no consequence beyond our not having it.
10 Automated decisions and profiling
There are none. No decision affecting you is taken automatically within the meaning of Article 22 GDPR, and we do not profile you.
11 Data security
Every page here is delivered over an encrypted TLS connection, which your browser shows as a padlock. Passwords are stored only as cryptographic hashes. Access to personal data inside the company is limited to the people whose work requires it, and every administrative action is authenticated and logged.
No transmission over the internet can be made completely secure, and we do not claim otherwise. We keep our measures under review as the state of the art moves.
12 Changes to this notice
We update this notice when the processing it describes changes, or when the law does. The version published here is the one that applies, and the date it was last changed is shown at the top of the page.