Privacy policy
1. Controller
The controller for data processing on this website and in the “Campus Ilmenau” app within the meaning of the GDPR is:
Kai Gothe
Eisenbahnstr. 24
98693 Ilmenau, Germany
Email: kontakt@campus-ilmenau.de
2. Overview
You don't need an account for the website or the app. There are no ads, no cookies and no tracking of devices or people. What you save in the app – Thoska balance, reading list, saved events, settings – stays on your device. Below you'll find exactly which data is still processed and why.
Part A: This website
3. Hosting
The website is hosted on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in its data centres in Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.
With every request, the web server processes technically necessary data sent by your browser: IP address, date and time, requested address, and browser and operating system. This is needed to deliver the page to you. The legal basis is Art. 6 (1)(f) GDPR. This data is only processed for the duration of the request and is not stored: neither the web server nor the upstream proxy writes access logs.
4. Encryption
The website is delivered exclusively via HTTPS. The certificate is issued by Let's Encrypt; no visitor data is transmitted in the process.
5. No cookies, no third-party content
The website doesn't store or read anything on your device, which is why there is no cookie banner (§ 25 TDDDG). Fonts, images and scripts are served from the same server; no content is loaded from other providers.
6. Contact by email
If you write to me, I process your sender address, the content and the metadata of the email in order to answer your request. The legal basis is Art. 6 (1)(f) GDPR (legitimate interest in answering requests). I delete the data once the request has been dealt with, unless retention obligations apply. Emails are not necessarily encrypted end to end in transit.
Part B: The “Campus Ilmenau” app
7. What stays on your device only
The app stores this data only locally on your phone. It is not transmitted to me or to third parties and is removed when you delete the app:
- the Thoska balance you read, the last transaction and the resulting history,
- your library reading list, saved events and favourite dishes,
- your settings, e.g. price group, mensa on the home screen, filters, language and appearance.
8. Content from our server
The app fetches menus, opening hours, events, catalogue search results and book covers from our server api.campus-ilmenau.de. For technical reasons your IP address is transmitted, and the app sends the platform (iOS or Android). There is no user identifier, no device ID and no advertising ID. The legal basis is Art. 6 (1)(f) GDPR; my legitimate interest is providing you with the content.
The server keeps an error and operations log that explicitly contains no IP addresses, browser or device data and is deleted after 30 days. Like the website, the server is hosted by Hetzner Online GmbH (see section 3) in its data centres in Nuremberg and Falkenstein, Germany. The data processing agreement under Art. 28 GDPR applies here as well. The upstream proxy does not write access logs.
9. Anonymous analysis of library searches
To improve the search, I count what people search for in the catalogue and which titles they open afterwards. Only the simplified search term and selected filters, the number of results, the opened title, certain actions on a title (e.g. floor plan opened, added to the reading list), the platform and the time are recorded. No IP address, device identifier or any other feature that could link an entry to you is recorded. If a search term looks like an email address, phone number or similar, it is discarded.
Individual entries are deleted after seven days at the latest; after that only totals per quarter of an hour remain. The legal basis is Art. 6 (1)(f) GDPR, my legitimate interest in a good catalogue search.
10. Signing in to the library
To see your loans, you sign in with the user number and password of your account at the university library in Ilmenau. The app sends this data encrypted directly to the library's loan interface (PAIA) at paia.gbv.de, operated by the Verbundzentrale des Gemeinsamen Bibliotheksverbundes (VZG), Platz der Göttinger Sieben 1, 37073 Göttingen, Germany – not to our server. User number, password and the session are kept only in the app's memory, not in the keychain and not permanently; after a restart you sign in again. The university library is responsible for processing your account data; its privacy policy applies.
11. Permissions on your device
The app only asks for permissions it needs for a feature, and only when you use it:
- NFC, to read your Thoska. The card data stays on your device.
- Calendar, when you add an event to your calendar. The app only writes that event and doesn't read your calendar.
- Photos (add only), when you save a shared image. The app can't see your photos.
You can revoke any permission at any time in your phone's settings.
12. Sharing, links and maps
When you share something, you choose the recipient in your phone's share menu; the app itself doesn't transmit anything. Links to tickets, the library catalogue or organisers open in your browser, and “Open in Maps” opens your device's maps app. From then on, the privacy policies of those providers apply.
13. App Store, Google Play and crash reports
You get the app from Apple's App Store or Google Play. Any processing during download, e.g. of your store account, is the responsibility of Apple or Google; I receive no data that identifies you.
Crash reports: If you have chosen on your iPhone to share analytics with app developers (Settings › Privacy & Security › Analytics & Improvements), Apple sends me reports about app crashes. They contain technical details such as device model, iOS version and the place in the code where the error occurred, but nothing that lets me identify you. I only use them to fix bugs. The legal basis is the consent you gave to Apple; you can switch it off there at any time. I don't use any other analytics or crash reporting services, my own or third-party.
Your rights
14. Access, erasure, objection
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where I process data on the basis of legitimate interests, you can object at any time on grounds relating to your particular situation. An email to kontakt@campus-ilmenau.de is enough. As the app doesn't store any data that identifies you, I can often only answer: no data about you is held.
15. Complaints to a supervisory authority
You can lodge a complaint with a data protection supervisory authority. The authority responsible for me is the Thüringer Landesbeauftragter für den Datenschutz und die Informationsfreiheit, Häßlerstraße 8, 99096 Erfurt, Germany, www.tlfdi.de.
16. Changes
I update this policy when the website, the app or the law changes. The version published here applies.