Below we inform you pursuant to Articles 13 and 14 GDPR about the processing of personal data when you use the Konvoii community platform. This notice is not individual legal advice and will be updated if processing changes materially.
1. Controller
The controller under the GDPR is the provider named in the legal notice (Impressum). For privacy requests, please use the privacy contact email provided there.
A data protection officer has not been appointed at present, where not legally required.
2. Purposes and legal bases
We process personal data only as necessary to provide and secure the platform, to perform the user contract or pre-contractual steps (Art. 6(1)(b) GDPR), based on your consent (Art. 6(1)(a) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), or based on legitimate interests (Art. 6(1)(f) GDPR), in particular operation, abuse prevention, moderation and security.
Where information is stored on the user’s terminal equipment, we also observe Section 25 TDDDG (consent or exception for strictly necessary storage).
3. Hosting and infrastructure
The application is hosted and delivered by Vercel Inc. (USA). Technical access data (e.g. IP address, timestamp, requested resource, user agent, referrer) may be processed in server or edge logs. Application data is stored in a PostgreSQL database connected via the operator’s hosting/database infrastructure.
Legal bases: Art. 6(1)(b) and (f) GDPR (contract / legitimate interest in secure, stable operation).
If data is transferred to a third country (in particular the USA), we rely – where required – on an adequacy decision (e.g. EU-US Data Privacy Framework, if the recipient is certified) and/or appropriate safeguards under Art. 46 GDPR (in particular EU Standard Contractual Clauses).
4. Account, authentication and profile
Sign-in is provided via Auth.js (NextAuth). When you register with email and password, we process in particular your email address, username, name (if provided) and a password hash (bcrypt). Sessions are maintained as JWT cookies (typical validity: up to 30 days).
Optionally – if configured – magic links via SMTP and OAuth sign-in via Google or Apple may be available. In that case, identity data from the provider (e.g. email, name, profile image URL) may be transmitted to us and stored.
Profile information (e.g. display name, username, image, other optional fields) is stored to provide your account. Legal basis: Art. 6(1)(b) GDPR; for voluntary information, Art. 6(1)(a) GDPR may also apply.
5. Platform content and communication
Konvoii enables, among other things, convoys (including optional live location sharing with confirmed participants), meetups, help requests, campsite spot exchange (Platzbörse), Local Voice, as well as messaging, comments and notifications. Ride-sharing features may be temporarily disabled; if enabled, the same principles apply.
When you create content or participate, the data required for that purpose is processed (text, locations/routes, participations, messages, moderation reports, etc.). Location data may be stored or displayed at different levels of accuracy depending on your settings. Other users may see certain data where the feature requires it.
Moderation, audit and report data may be processed to prevent abuse and keep the community safe. Legal bases: Art. 6(1)(b) and (f) GDPR; where consent applies, Art. 6(1)(a) GDPR.
Where system or user-related emails are sent, configured operational copy recipients may receive technical metadata or copies for support and abuse-prevention purposes (Art. 6(1)(f) GDPR).
6. Maps and geodata (third parties)
Map display loads tiles from OpenStreetMap (tile.openstreetmap.org). Place search and reverse geocoding use Nominatim (OpenStreetMap), typically via our own API routes. Providers may receive technical data including your IP address.
Leaflet marker assets may be loaded from a CDN (e.g. cdnjs / Cloudflare). “Open in map” may link to Google Maps; we do not embed the Google Maps JavaScript API.
Please refer to the privacy notices of the respective providers (OpenStreetMap Foundation / Nominatim usage policy, Cloudflare/cdnjs, Google).
7. Email delivery
Where emails are sent (e.g. magic link, system notices, contact or participation messages), delivery uses a configured SMTP service. Recipient address and necessary metadata are transmitted to the email provider. Legal basis: Art. 6(1)(b) or (f) GDPR.
8. Cookies and similar technologies
We use strictly necessary cookies and similar technologies (session/authentication, language preference, and where applicable CSRF protection). Details are set out under “Cookies”. Legal basis: Art. 6(1)(b) GDPR and, where applicable, Section 25(2) TDDDG.
Your last granted browser location may be held temporarily in your device’s sessionStorage so that other pages do not need to ask for location permission again.
9. Storage period and deletion
We store personal data only as long as necessary for the respective purposes or where statutory retention obligations apply. Account data and related content may be deleted or anonymised after cancellation or deletion of the account unless retention is required by law.
Where provided in the profile, you may request account deletion. Moderation and security logs may have shorter or longer retention periods where required to prevent abuse or comply with legal duties.
10. Your rights
Subject to legal requirements, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection (Arts. 15–21 GDPR).
Objection (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then assess whether compelling legitimate grounds override your interests.
Where processing is based on consent, you may withdraw consent with effect for the future, without affecting the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with a data protection supervisory authority. For the operator in Bavaria (Germany), this is typically the Bavarian Data Protection Authority (BayLDA). You may also contact the authority at your place of habitual residence.
11. Automated decision-making / profiling
No solely automated decision-making including profiling within the meaning of Art. 22 GDPR takes place that produces legal effects concerning you or similarly significantly affects you.
12. Minors
The platform is not directed at children under 16. Persons under 18 should use the platform only with any required parental consent and in accordance with the terms of use.