Skip to content
CleanUpYourCity

Privacy policy

Privacy policy

Draft. This text describes what this website actually does technically. It is written to the best of our knowledge from the source code and the configuration, but it does not replace legal review – whether it is complete and accurate for operating the site is for somebody who can stand behind that judgement to decide. The passages marked […] must be filled in before publication.

This is a translation of the German original. In case of doubt the German version is the one that applies: it is the text this site is operated under, and a translation cannot create rights the original does not grant.

1. Controller

The controller for data processing on this website is:

Marcel Steinmetz
Lüdemannstraße 68
24114 Kiel, Germany
E-mail: info@cleanupyourcity.eu

No data protection officer has been appointed; under § 38 BDSG that only becomes mandatory from 20 people permanently engaged in automated processing.

2. If you only look at the site

When you open a page, your browser transmits technically necessary data to our host, which stores it in server log files:

  • your IP address
  • the date and time of the request
  • the address requested
  • the page visited before, if your browser sends it
  • browser and operating system identification

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is technical operation and defence against attacks. We do not evaluate this data in relation to individuals and do not combine it with other data.

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A data processing agreement under Art. 28 GDPR is in place with the provider. [Please confirm that this agreement has been concluded.]

3. Cookies and local storage

This website uses no cookies for advertising or analytics. The only ones set are:

  • fe_typo3_user – only after you log in. Keeps your session alive. Becomes invalid when you log out or close the browser.
  • typo3nonce_… – protects forms from being submitted from other sites (CSRF protection).

In addition, the map stores your decision about whether it may load in your browser's localStorage (key cuc.map.consent). That value is never transmitted to us and contains nothing but your own answer. You can delete it at any time through your browser settings.

This storage is strictly necessary for operation (§ 25(2)(2) TDDDG); no consent is required for it.

4. Member account

For an account we process:

  • e-mail address (which is also your login name)
  • password – only ever as an Argon2 hash; we do not know it in plain text and cannot recover it
  • display name
  • optionally town and postcode
  • the time at which you consented to this privacy policy

Double opt-in: after registration your account is initially locked. We send you an e-mail with a confirmation link; the account is only activated when you click it. The link is valid for 48 hours. This prevents somebody from creating an account on somebody else's address.

The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). We store the data for as long as your account exists. You can have it deleted at any time (see section 11).

5. Company and organisation accounts

Anybody registering as an organisation additionally provides:

  • the organisation's name and – optionally – its legal form
  • the name of a contact person
  • optionally: address, telephone number, website, VAT identification number

The organisation's name and the contact person are required, because participants need to know who is running an action and whom to approach on the day. The legal basis is Art. 6(1)(b) GDPR.

6. Actions and participation

Anybody creating an action thereby publishes its title, description, place, meeting point, time and – if provided – a picture. Once approved, these details are visible to everybody. The display name of the person or organisation running it is shown alongside.

If you sign up for an action, we store the fact that you are taking part and the time you signed up. On the public page only the number of participants appears, together with the initials of the first few – not your full details. The organiser can see the participant list of their own action, so that they can plan and recognise you on the day.

The legal basis is Art. 6(1)(b) GDPR. You can cancel at any time.

7. Newsletter

For the newsletter we store your e-mail address and the time of your confirmation. Double opt-in applies here too: without a click on the confirmation link we send nothing.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time – through the unsubscribe link in every newsletter or informally to info@cleanupyourcity.eu. After withdrawal we delete your address from the distribution list.

8. The map

A map can be shown on the actions page and on the detail pages. The map tiles come from OpenStreetMap (OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom).

The map does not load by itself. As long as you do not explicitly load it, not a single request is made to OpenStreetMap and your IP address is not transmitted there. Only when you click “Load map” are the tiles fetched; OpenStreetMap then learns your IP address and – from the tiles requested – roughly which section you are looking at.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it by deleting the stored cuc.map.consent value in your browser; after that we ask again. OpenStreetMap's privacy policy is at osmfoundation.org.

Every other part of the map – the mapping software itself – we serve from our own server. So nothing is loaded from elsewhere before you agree.

9. Determining coordinates

So that an action appears on the map, we determine coordinates from its address. For this we query the Nominatim service of the OpenStreetMap Foundation.

Importantly, this query is made by our server, not by your browser. What is transmitted is the action's address – a meeting point, a postcode and a town. Your IP address is not transmitted. The same applies when you type a place into the search field: that lookup is also made by our server, and the result is cached at our end so that the same place does not have to be requested repeatedly.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is making actions findable.

10. E-mails

We send you e-mails when you register (confirmation link), when a decision has been made about an action you submitted, and – if you asked for it – the newsletter. They are sent through our host's servers. There are no other recipients; in particular we do not pass your address to third parties and use no external mailing provider.

11. Your rights

You have the following rights against us regarding your personal data:

  • Access (Art. 15 GDPR) – what data we hold about you
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on a legitimate interest (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Write to us informally at info@cleanupyourcity.eu.

You also have a right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the federal state where you usually reside. The authority competent for us is the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany.

12. Erasure and storage periods

We store personal data only for as long as it is needed for the purpose in question:

  • Account data: until the account is deleted
  • Unconfirmed registrations: the confirmation link expires after 48 hours. If it is not used, the account stays locked and is deleted 30 days after the link expired – together with any organisation created along with it that nobody else belongs to. The address is free again afterwards. It is in fact free before then too: registering again with the same address takes over the pending entry and issues a fresh link.
  • Newsletter: until withdrawal
  • Actions and participation: for as long as the action exists; past actions are kept for the time being as documentation
  • Server logs: as specified by the host [ask the host for the retention period and enter it here]

Statutory retention obligations – tax law, for instance – remain unaffected as soon as invoices arise.

13. Changes

We adapt this policy when the processing changes – because a feature is added, for example. The version published here at the time applies.

Last updated: 7 August 2026