Privacy policy

This policy covers marburg.club and all its pages, the web app app.marburg.club, the Marburg Club app for iOS and Android, the public card page marburg.club/c/… and the admin panel.

Die deutsche Fassung ist rechtlich verbindlich. This English text is a convenience translation. In case of any discrepancy, the German version prevails — read it here.

1. Controller

Represented by Geschäftsführerin (Managing Director) Yasaman Serajian Moghaddam
Email: info@palebluedot.de

For all data-protection matters: datenschutz@marburg.club. This address serves every club operated by Pale Blue Dot GmbH.

2. Data protection officer

We have not appointed a data protection officer. In our assessment the conditions of Art. 37 GDPR and § 38 BDSG are not met.

3. Supervisory authority

It is competent for every club because the controller is established in Hesse. Under Art. 77 GDPR you may also complain to the authority where you live.

4. Principles

We use no tracking, no web analytics, no advertising networks, no social media plugins and no profiling. We do not sell data. There is no automated decision within the meaning of Art. 22 GDPR. We use no error-reporting service either. The pages this policy covers load fonts and scripts from our own servers. The only exception are the Apple and Google sign-in scripts, which the web app loads only after you have agreed (section 6.1). The presentation page presentation.marburg.club is not part of the programme and is not covered by this policy.

5. Public pages

5.1 Hosting and logs

Our servers are operated by Hetzner Online GmbH in data centres in Germany.

Every request first passes our entry server. It logs the time, an IP address, the full requested address including everything after the “?” (such as the location coordinates of section 6.5) and including card numbers in the address of the card page, the method, the status code, the amount of data, the previous page (referrer) and the browser identifier (user agent). Whether that IP address is yours or a Cloudflare server's depends on the host name (section 5.2). The application server behind it logs only time, method, path (card numbers masked), status code and response time, without IP address, parameters or browser identifier.

The logs are rotated by volume, not by time, and discarded whenever a service restarts, which happens with every update. In practice they are kept for a few days to a few weeks. They are not passed to third parties or combined into profiles. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interests are operation, troubleshooting and defending against attacks.

5.2 Cloudflare

Cloudflare, Inc. (USA) provides name resolution (DNS) for all our host names, and delivers some of them through its own network. For those host names Cloudflare processes your IP address and your request, and our logs show a Cloudflare address instead of yours. Cloudflare may instruct your browser to report network errors to a.nel.cloudflare.com (Network Error Logging, a provider default). Legal basis: Art. 6 (1) (f) GDPR; our interest is secure and fast delivery. For the transfer to the USA see section 13.

5.3 Storage in your browser

The public pages set no cookies. Some store a setting you choose yourself in your browser's local storage until you clear it:

• mc-lang: the language you picked on the website;
• lang and theme: language and light or dark display on the general start page, biz_lang and biz_theme on the page for businesses;
• mc_lang: the language you picked on our older information pages.

These entries are strictly necessary for the display you chose (§ 25 (2) no. 2 TDDDG). The legal pages and the card page store nothing in your browser.

6. Taking part in the programme (app and web app)

6.1 Signing in

There are three ways. The legal basis is Art. 6 (1) (b) GDPR in each case.

• One-time code by email. The six-digit code is valid for 15 minutes and is held for that time under a hash of your address, not the address itself. Sent through Mailgun (section 11).
• “Sign in with Apple” (Apple Distribution International Ltd., Ireland). We receive a permanent Apple user identifier, an email address (possibly a relay address @privaterelay.appleid.com) and, on the first sign-in, the name you share. If you have no display name yet, we use it as your display name. We keep Apple's refresh token only to revoke the link at Apple when you delete your account; it is deleted with the account.
• “Sign in with Google” (Google Ireland Ltd., Ireland). We receive a permanent Google user identifier, the email address with its verification status and the name. If you have no display name yet, we use the name as your display name. We store neither tokens nor the profile picture from Google.

In the web app the Apple and Google sign-in scripts load only after you have ticked the box; in the apps only when you tap the button. Our server checks the sign-in with the providers' public keys. How Apple and Google themselves handle your data: apple.com/legal/privacy, policies.google.com/privacy.

6.2 Data in the programme

The legal basis is Art. 6 (1) (b) GDPR unless stated otherwise.

• Your email address(es). You can add more and remove them again.
• Optional: display name, date of birth, language, display mode. Your display name appears on the business's tablet when you ask for a stamp or a redemption.
• Your card number.
• Visits, stamps, rewards, offer requests and reservations.
• The time of your last sign-in, to measure the period in section 14; Art. 6 (1) (f) GDPR.
• Technical scan records: at which business a scan happened and whether a session existed, for abuse detection and troubleshooting; Art. 6 (1) (f) GDPR.

6.3 Guest profile when you scan without an account

If you scan the QR code at the counter without signing in, for example with your phone's camera in the browser, you first accept the terms of participation, take note of this privacy policy and confirm that you are at least 16 years old. Only then do we create a guest profile and send the stamp request. If that declaration is missing, for instance because your browser did not keep the session, we ask again at the scan.

A guest profile holds an internal number, a card number, your stamps and visits and a session identifier in your browser or app that is valid for up to 180 days. It holds no name and no email address. After the stamp we offer to secure the stamps with an email address or through Apple or Google; your guest profile then becomes a regular account with the same stamps. If the email address or the Apple or Google sign-in you pick already belongs to an account, you sign in to that account; the guest profile then stays as it is and its stamps are not transferred. Legal basis: Art. 6 (1) (b) GDPR. You can delete a guest profile in the app under Profile → Account or by email to datenschutz@marburg.club.

6.4 Printed loyalty card

• Card without an account. When a new printed card is scanned at a counter for the first time, we create a card profile for it, without name, email address or device. It stores the card number and the visits, stamps and rewards at participating businesses.
• Card page. Anyone who scans the card's QR code with a phone sees, at marburg.club/c/…, the stamp balance and the available rewards with the names of the businesses, but no name, no email address and no history. The page sets no cookies and loads nothing from third parties. To stop card numbers being guessed in bulk we count views per IP address, only as a hash and for at most one hour; Art. 6 (1) (f) GDPR.
• Whoever holds the card sees and uses its balance. Treat it like a paper loyalty card, and report a loss (section 15).
• Linking it to the app. A new, unused card can be added to any account. A card that has been used only to an account that has no stamps, visits, rewards or offers in Marburg yet. The card's data then moves unchanged to your account and the card profile is deleted. We log every such takeover with pseudonymous identifiers, without the card number, so that it can be traced; Art. 6 (1) (f) GDPR.
• Deletion. A card profile has no app. Ask for deletion by email to datenschutz@marburg.club giving the card number. After deletion, including when the period in section 14 runs out, the card is released rather than destroyed: it can be used again and starts empty. A card blocked as lost or stolen stays blocked.

6.5 Location

Only with your permission in the operating system and only while the app is open: the coordinates are attached to the requests for the home and discover pages to sort businesses by distance. We do not store them in our database. Because they are part of the requested address, they do appear in our entry server's logs (section 5.1). Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw the permission in your device settings at any time; the app then works without sorting by distance.

6.6 Camera

Only to read QR codes. Only the decoded text leaves your device; no image is transmitted or stored.

6.7 Wallet cards

Only if you add a card to your wallet; Art. 6 (1) (b) GDPR.

• Apple Wallet. We create the pass file with display name, card number and “member since” on our server. It is deleted with the account.
• Google Wallet. We send display name, card number and “member since” to the Google Wallet API of Google LLC (USA, section 13). When you delete your account we empty the card at Google and set it to “expired”. Only Google can remove it; it then holds no data about you.

6.8 Storage on your device

Every entry is strictly necessary for the service you asked for (§ 25 (2) no. 2 TDDDG). None serves analytics or advertising, which is why we do not ask for cookie consent. If you delete them, a guest profile loses access to its stamps.

6.9 Record of acceptance and age

When you accept the terms of participation and confirm that you are at least 16 — at registration, for a new version, or when scanning as a guest — we store the version of the terms, the time, the origin (registration, re-acceptance, browser scan) and a hash of your IP address, never the address itself. For a guest scan we also store which version of this privacy policy was shown to you. Legal basis: Art. 6 (1) (f) GDPR; our interest is proof that the terms were agreed.

6.10 Abuse protection

Sign-in attempts, code requests and attempts to add a card are counted per email address, account or IP address, only as a hash and for at most one hour; Art. 6 (1) (f) GDPR.

7. Participating businesses

• When you ask for a stamp or a redemption at the counter, staff see on the tablet your display name (if set) and your balance in that programme.
• Business owners see in the panel the visits, stamps and redemptions at their business, with display name and a shortened email address (such as “ma***@***”). For their bookkeeping they get a reward ledger with pseudonymous customer numbers (section 10).
• Businesses receive no full email addresses, no lists of all members and no data about visits to other businesses. Where a programme runs at several businesses, your balance there is the same for all of them.
• The counter tablets read QR codes with the camera; only the decoded text is transmitted.
• What a business does with this information in its own business is its own responsibility as an independent controller.

8. City administration

People we give the city-administration role for Marburg in the panel look after the programme locally. In the panel they see this city's members with full email address and card number, to help with questions and to clear up misuse, and they manage the numbers of the printed cards. Legal basis: Art. 6 (1) (b) and (f) GDPR.

9. Admin panel

• For staff of businesses and of Pale Blue Dot GmbH we process user name, email address, password hash, role and the session identifier.
• We log changes made in the panel with person, time, subject and the values before and after, so that they can be traced.
• Owners can receive a monthly summary by email, with totals only and no customer data.
• Legal basis: Art. 6 (1) (b) and (f) GDPR.
• The forms with a map load map tiles from OpenStreetMap (tile.openstreetmap.org) and look up addresses and places at Nominatim (nominatim.openstreetmap.org), Overpass (overpass-api.de) and Wikimedia Commons (commons.wikimedia.org). Those services receive the signed-in person's IP address; Art. 6 (1) (f) GDPR. The panel's fonts and scripts are served from our servers.

10. Reward ledger

For every redeemed reward and offer we keep, per business, a booking entry: business, sequence number, time, reward, value, tax rate and a pseudonymous customer number. Name, email address and card number are not in it. It serves the businesses' tax record-keeping duties (§ 147 AO); Art. 6 (1) (c) and (f) GDPR. Once your account is deleted, the number can no longer be linked to you.

11. Email

We send sign-in codes and, to businesses, the monthly summary through Mailgun (Mailgun Technologies, Inc., part of the Sinch group), using its servers in the EU. If that route is not configured, we send nothing. The recipient address and the content of the message are transmitted; Art. 6 (1) (b) GDPR.

12. Recipients

13. Transfers to third countries

Transfers to the USA (Cloudflare, Google, Apple and, where applicable, Mailgun) rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).

14. Retention

15. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). You may withdraw a consent at any time with effect for the future (Art. 7 (3) GDPR). For complaints see section 3.

In the app under Profile → Account you find, immediately and without a request:

• Download data: profile, email addresses, card, consents, stamps, visits, redemptions and reservations as one file.
• Delete account: deletion removes the account, profile, email addresses and your current stamp balance. A printed card is released. Past visits and redeemed rewards remain as anonymised statistics of the businesses and can no longer be linked to you.

Everything else, including blocking a lost card or deleting a card profile: datenschutz@marburg.club. We reply within one month.

Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We then stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. Send your objection to datenschutz@marburg.club.

16. Obligation to provide data

A permanent account needs an email address or a sign-in with Apple or Google. Everything else is voluntary; using the programme as a guest or with a printed card needs neither.

17. Automated decisions

None. Every stamp and every redemption is confirmed by staff.

18. Security

We transmit only encrypted (TLS). Passwords, the device identifiers of the tablets and email and IP addresses in counters and records are stored only as hashes. The databases are not reachable from the internet.

19. Changes

We update this policy when the processing changes. The version published here, with the date below, applies.

Version: 2026-11-04